| CVE-2026-127207 | MEDIUM | 5.4 | Sendcloud for WooCommerce through 1.0.41 contains a missing authorization vulnerability that allows authentica… | 2026-11-12 |
| CVE-2026-127208 | HIGH | 8.8 | datamodel-code-generator before 0.84.0 contains a code injection vulnerability that allows attackers to achiev… | 2026-11-12 |
| CVE-2026-86322 | HIGH | 8.8 | A flaw was found in Foreman’s Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAware#fi… | 2026-11-12 |
| CVE-2026-86323 | MEDIUM | 4.3 | A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specifi… | 2026-11-12 |
| CVE-2026-86324 | MEDIUM | 4.3 | A flaw was found in Foreman’s Api::V2::SshKeysController, where the target user is resolved through Foreman::C… | 2026-11-12 |
| CVE-2026-126210 | MEDIUM | 5.3 | @hono/node-server allows running the Hono application on Node.js. Prior to 1.19.18 and from 2.0.0 until 2.1.6,… | 2026-11-12 |
| CVE-2026-126343 | MEDIUM | 5.3 | @hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrad… | 2026-11-12 |
| CVE-2026-126344 | MEDIUM | 5.4 | @hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.1.6, the WebSocket upgrad… | 2026-11-12 |
| CVE-2026-126345 | MEDIUM | 5.3 | basic-ftp is an FTP client for Node.js. Prior to 6.2.4, the MLSD directory-listing parser in src/parseListMLSD… | 2026-11-12 |
| CVE-2026-126346 | MEDIUM | 5.9 | basic-ftp is an FTP client for Node.js. Prior to 6.2.3, FTPContext.send() throws when a command contains carri… | 2026-11-12 |
| CVE-2026-126347 | LOW | 3.1 | Tornado is a Python web framework and asynchronous networking library. In versions through 6.6.0, applications… | 2026-11-12 |
| CVE-2026-126348 | MEDIUM | 4.3 | Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library… | 2026-11-12 |
| CVE-2026-126349 | LOW | 3.1 | Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library… | 2026-11-12 |
| CVE-2026-126350 | MEDIUM | 5.9 | Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library… | 2026-11-12 |
| CVE-2026-126351 | MEDIUM | 5.9 | Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library… | 2026-11-12 |
| CVE-2026-126352 | MEDIUM | 5.9 | Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library… | 2026-11-12 |
| CVE-2026-126353 | MEDIUM | 5.9 | Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library… | 2026-11-12 |
| CVE-2026-126354 | MEDIUM | 4.8 | Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library… | 2026-11-12 |
| CVE-2026-126823 | HIGH | 7.0 | A local user with an ordinary account on the same host can place a file in a shared temporary location that th… | 2026-11-12 |
| CVE-2026-127209 | MEDIUM | 4.0 | Xiaomi Mi Browser Android Application (com.mi.globalbrowser) before 14.66.0-gn contains a path traversal vulne… | 2026-11-12 |
| CVE-2026-127211 | MEDIUM | 6.5 | MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the /wp-json… | 2026-11-12 |
| CVE-2026-91141 | NA | N/A | A vulnerability in the default configuration of vsomeip allows a remote, unauthenticated attacker to trigger m… | 2026-11-12 |
| CVE-2026-126188 | LOW | 3.7 | Active Storage makes it simple to upload and reference files in cloud services and attach those files to Activ… | 2026-11-11 |
| CVE-2026-126495 | MEDIUM | 6.1 | MQTTX desktop through 1.13.3 contains a stored cross-site scripting vulnerability that allows attackers to inj… | 2026-11-11 |
| CVE-2026-126496 | MEDIUM | 4.3 | 1Panel-dev CordysCRM before 1.9.6 contains an authorization bypass vulnerability in CustomerContactController.… | 2026-11-11 |
| CVE-2026-126497 | HIGH | 7.8 | LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw dwgRe… | 2026-11-11 |
| CVE-2026-126498 | MEDIUM | 5.4 | WriteFreely before 0.17.3 contains a stored cross-site scripting vulnerability that allows authenticated autho… | 2026-11-11 |
| CVE-2026-126499 | HIGH | 7.4 | Jellyfin before 12.0 contains a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST /L… | 2026-11-11 |
| CVE-2026-126539 | HIGH | 8.1 | Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to… | 2026-11-11 |
| CVE-2026-126541 | HIGH | 8.1 | WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints th… | 2026-11-11 |
| CVE-2026-126542 | CRITICAL | 9.8 | WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated att… | 2026-11-11 |
| CVE-2026-126543 | HIGH | 7.5 | WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.p… | 2026-11-11 |
| CVE-2026-126544 | MEDIUM | 4.3 | WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode() in ob… | 2026-11-11 |
| CVE-2026-126545 | MEDIUM | 4.3 | WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::get_api_tags() in plugin/API… | 2026-11-11 |
| CVE-2026-126546 | MEDIUM | 4.3 | Viber for iOS through 29.4.0.24 fails to validate the logical screen width and height in received GIF headers,… | 2026-11-11 |
| CVE-2026-116645 | NA | N/A | LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant i… | 2026-11-11 |
| CVE-2026-126559 | MEDIUM | 4.8 | Semantic MediaWiki 4.2.0 before 7.4.1 contains a stored cross-site scripting vulnerability in OptionsBuilder::… | 2026-11-11 |
| CVE-2026-126560 | MEDIUM | 5.4 | Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in the DataTables i… | 2026-11-11 |
| CVE-2026-126561 | HIGH | 7.1 | Semantic MediaWiki 2.5.0 before 7.4.1 contains a missing authorization vulnerability that allows editors witho… | 2026-11-11 |
| CVE-2026-126562 | MEDIUM | 4.3 | Semantic MediaWiki 3.0.0 before 7.4.1 contains an uncontrolled recursion vulnerability in the ElasticStore Con… | 2026-11-11 |
| CVE-2026-126563 | MEDIUM | 6.1 | Semantic MediaWiki 2.4.0 before 7.4.1 contains a reflected cross-site scripting vulnerability in TimeValueForm… | 2026-11-11 |
| CVE-2026-126564 | MEDIUM | 5.4 | Semantic MediaWiki 2.5.0 before 7.4.1 contains a stored cross-site scripting vulnerability in ValueFormatter::… | 2026-11-11 |
| CVE-2026-126565 | MEDIUM | 4.3 | Semantic MediaWiki 3.0.0 before 7.4.1 contains a denial of service vulnerability in the ElasticStore and SPARQ… | 2026-11-11 |
| CVE-2026-126566 | HIGH | 7.1 | Semantic MediaWiki 7.3.1 before 7.4.1 contains an incorrect authorization vulnerability in EditProtectionUpdat… | 2026-11-11 |
| CVE-2026-126567 | MEDIUM | 5.4 | Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in Special:Ask with… | 2026-11-11 |
| CVE-2026-126569 | MEDIUM | 5.4 | Mbin 1.2.1 before 1.11.1 contains a stored cross-site scripting vulnerability in EmbedElement::buildDestructed… | 2026-11-11 |
| CVE-2026-126570 | HIGH | 7.6 | Padloc 4.0.0 before 4.3.1 contains a prototype pollution vulnerability that allows SCIM token holders to modif… | 2026-11-11 |
| CVE-2026-126571 | MEDIUM | 4.8 | Padloc 4.0.0 before 4.3.1 contains an authentication bypass vulnerability in the legacy retrieveMFAToken handl… | 2026-11-11 |
| CVE-2026-63192 | NA | N/A | OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). I… | 2026-11-11 |
| CVE-2026-63194 | NA | N/A | OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). I… | 2026-11-11 |