| CVE-2026-105422 | MEDIUM | 6.6 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM… | 2026-11-06 |
| CVE-2026-109883 | HIGH | 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elemento… | 2026-11-06 |
| CVE-2026-109884 | HIGH | 7.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elemento… | 2026-11-06 |
| CVE-2026-115431 | HIGH | 7.1 | Missing Authorization vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce upsell-order-bump-off… | 2026-11-06 |
| CVE-2026-115952 | MEDIUM | 6.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV… | 2026-11-06 |
| CVE-2026-123746 | NA | N/A | The Symfony Security HTTP component AuthenticatorManager::authenticateUser() does not run the firewall user ch… | 2026-11-06 |
| CVE-2026-35114 | LOW | 3.7 | HCL AION is affected by a vulnerability where the X-Content-Type-Options header was missing or insecure, allow… | 2026-11-06 |
| CVE-2026-35115 | LOW | 3.7 | HCL AION is affected by a vulnerability where the HTTP Strict-Transport-Security (HSTS) header was missing or … | 2026-11-06 |
| CVE-2026-92080 | MEDIUM | 4.3 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM… | 2026-11-06 |
| CVE-2026-123653 | MEDIUM | 6.3 | A security vulnerability has been detected in esengine DeepSeek-Reasonix up to 2.52.0. Affected is the functio… | 2026-11-06 |
| CVE-2026-21849 | LOW | 3.7 | HCL AION is affected by a missing encryption vulnerability in the WebSocket connection set up by the GenAI web… | 2026-11-06 |
| CVE-2026-21850 | MEDIUM | 6.5 | HCL AION is affected by a vulnerability where user-controlled input could be included in HTTP response headers… | 2026-11-06 |
| CVE-2026-35102 | MEDIUM | 4.7 | HCL AION is affected by an open redirect vulnerability in the navigation bar of the GenAI web interface (Navba… | 2026-11-06 |
| CVE-2026-35103 | MEDIUM | 4.7 | HCL AION is affected by an open redirect vulnerability on the role assignment pending page (RoleAssignPending … | 2026-11-06 |
| CVE-2026-35104 | MEDIUM | 4.7 | HCL AION is affected by an open redirect vulnerability on the user registration page (Signup component). The r… | 2026-11-06 |
| CVE-2026-35105 | MEDIUM | 4.7 | HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interfac… | 2026-11-06 |
| CVE-2026-35106 | MEDIUM | 4.7 | HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interfac… | 2026-11-06 |
| CVE-2026-35107 | MEDIUM | 4.7 | HCL AION is affected by an open redirect vulnerability in the user menu of the GenAI web interface (UserMenu c… | 2026-11-06 |
| CVE-2026-35109 | LOW | 3.7 | HCL AION is affected by a vulnerability where pages served over HTTPS could be cached by the browser or interm… | 2026-11-06 |
| CVE-2026-35110 | MEDIUM | 5.4 | HCL AION is affected by a vulnerability where encrypted (HTTPS) communication was not enforced for all request… | 2026-11-06 |
| CVE-2026-35111 | MEDIUM | 4.8 | HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy (CORP) header was missing or in… | 2026-11-06 |
| CVE-2026-35112 | MEDIUM | 4.2 | HCL AION is affected by a vulnerability where the Cross-Origin-Embedder-Policy (COEP) header was missing or in… | 2026-11-06 |
| CVE-2026-35113 | MEDIUM | 4.8 | HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy (COOP) header was missing or inse… | 2026-11-06 |
| CVE-2026-5345 | LOW | 3.7 | HCL AION is affected by a missing encryption vulnerability in a second WebSocket connection defined in the Gen… | 2026-11-06 |
| CVE-2026-106019 | NA | N/A | Insertion of sensitive information into log file vulnerability in Johnson Controls C-CURE 9000, Victor allows … | 2026-11-06 |
| CVE-2026-106020 | NA | N/A | Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manage… | 2026-11-06 |
| CVE-2026-106022 | NA | N/A | Cleartext storage of sensitive information in memory vulnerability in Johnson Controls EasyIO Neo IOManager an… | 2026-11-06 |
| CVE-2026-112334 | MEDIUM | 4.9 | Wazuh from 1.0.0 before 4.14.9 contains an out-of-bounds write vulnerability in wazuh-execd that allows privil… | 2026-11-06 |
| CVE-2026-112335 | MEDIUM | 5.5 | Wazuh agent from 1.0.0 before 4.14.9 contains a stack-based buffer overflow in the logcollector snort-full log… | 2026-11-06 |
| CVE-2026-112336 | MEDIUM | 6.5 | Wazuh Manager from 3.0.0 before 4.14.9 contains a memory leak vulnerability in the generic JSON decoder that a… | 2026-11-06 |
| CVE-2026-112337 | LOW | 3.7 | Wazuh from 3.7.0 before 4.14.9 contains a server-side request forgery vulnerability in the Azure wodle get_gra… | 2026-11-06 |
| CVE-2026-112338 | MEDIUM | 5.9 | Wazuh from 4.3.0 before 4.14.9 contains a server-side request forgery vulnerability in the GitHub module (wm_g… | 2026-11-06 |
| CVE-2026-112339 | MEDIUM | 5.9 | Wazuh from 3.9.0 before 4.14.9 contains a missing TLS hostname verification vulnerability in the fluent-forwar… | 2026-11-06 |
| CVE-2026-112340 | HIGH | 8.2 | Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows aut… | 2026-11-06 |
| CVE-2026-112341 | MEDIUM | 6.5 | Wazuh versions from 4.0.0 before 4.14.9 contain a sql injection vulnerability in WazuhDBBackend._substitute_pa… | 2026-11-06 |
| CVE-2026-113618 | NA | N/A | The ZSIRep client library (ZSIREP.CLIENT.DLL) is vulnerable to improper server certificate validation. It regi… | 2026-11-06 |
| CVE-2026-118514 | NA | N/A | In Symfony http-foundation prior to versions 5.4.56, 6.4.50, 7.4.23, and 8.1.11, Symfony\Component\HttpFoundat… | 2026-11-06 |
| CVE-2026-119170 | NA | N/A | There was a regression in how FIPS algorithms were enforced for the hashlib module. Only users that are using … | 2026-11-06 |
| CVE-2026-123339 | NA | N/A | Improper trust of forwarded headers in RouterListener::onKernelFinishRequest() in Symfony HttpKernel versions … | 2026-11-06 |
| CVE-2026-123485 | MEDIUM | 6.5 | Ground Station from 0.6.0 before 0.8.20 does not restrict the get-orbital-sources Socket.IO handler (also expo… | 2026-11-06 |
| CVE-2026-123486 | MEDIUM | 5.3 | WWBN AVideo 29.0 through 29.4.0 contains a race condition vulnerability in plugin/PayPalYPT/ipn.php that allow… | 2026-11-06 |
| CVE-2026-123487 | HIGH | 7.5 | Parse Server before 8.6.115 and 9.0.0 before 9.10.7-alpha.1 validates user email address format with a regular… | 2026-11-06 |
| CVE-2026-123488 | CRITICAL | 9.8 | Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability … | 2026-11-06 |
| CVE-2026-123489 | HIGH | 7.1 | Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the… | 2026-11-06 |
| CVE-2026-123490 | HIGH | 8.8 | Craft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability because getOwners() applies … | 2026-11-06 |
| CVE-2026-123491 | HIGH | 8.2 | Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an SQL injection vulnerability in GraphQL eager… | 2026-11-06 |
| CVE-2026-123492 | MEDIUM | 4.9 | SiYuan before 3.8.9 contains a nil pointer dereference vulnerability in privateCacheMiddleware that allows aut… | 2026-11-06 |
| CVE-2026-123617 | MEDIUM | 5.3 | Openwhyd before 1.65.1 contains a NoSQL injection vulnerability that allows unauthenticated attackers to manip… | 2026-11-06 |
| CVE-2026-123618 | MEDIUM | 6.8 | ABP Framework before 10.7.1 contains an authentication bypass vulnerability that skips account state and two-f… | 2026-11-06 |
| CVE-2026-123619 | MEDIUM | 6.8 | Lektor through 3.3.14 and 3.4.0b15 contains an absolute path traversal vulnerability in the admin API on Windo… | 2026-11-06 |