| CVE-2026-111240 | NA | N/A | The JDBC based JAAS login module accepts a login without a password for accounts whose stored password is NULL… | 2026-11-10 |
| CVE-2026-111241 | NA | N/A | When a non-default stateful session bean passivation strategy is configured, passivated bean state is written … | 2026-11-10 |
| CVE-2026-111242 | NA | N/A | When MicroProfile JWT authentication is used for servlets that declare a run-as identity, the security state e… | 2026-11-10 |
| CVE-2026-111243 | NA | N/A | A negative MicroProfile JWT clock skew setting is not rejected and disables validation of the token expiration… | 2026-11-10 |
| CVE-2026-111244 | NA | N/A | When MicroProfile JWT role-based access control is used, the access constraints of JAX-RS resources are not al… | 2026-11-10 |
| CVE-2026-111245 | NA | N/A | After a successful WS-Security UsernameToken authentication, the caller identity stays associated with the wor… | 2026-11-10 |
| CVE-2026-111246 | NA | N/A | The embedded OpenEJB HTTP server does not isolate HTTP sessions between web applications. A remote attacker ca… | 2026-11-10 |
| CVE-2026-111247 | NA | N/A | When resolving security roles of a realm-authenticated caller, the caller's user name is also treated as a rol… | 2026-11-10 |
| CVE-2026-111248 | NA | N/A | The Jakarta Security identity store backed by the Tomcat user database compares the supplied password with the… | 2026-11-10 |
| CVE-2026-111249 | NA | N/A | The development-time LiveReload support listens on all network interfaces without authentication and accepts w… | 2026-11-10 |
| CVE-2026-111250 | NA | N/A | The embedded OpenEJB HTTP server reports every request as authenticated when an application requests authentic… | 2026-11-10 |
| CVE-2026-111251 | NA | N/A | The admin service of the standalone OpenEJB server accepts stop requests without any authentication. Any local… | 2026-11-10 |
| CVE-2026-111256 | NA | N/A | When JAX-WS or JAX-RS endpoints are published by the embedded OpenEJB HTTP server rather than Tomcat, some con… | 2026-11-10 |
| CVE-2026-111257 | NA | N/A | With the default configuration and no users defined in the default user database, TomEE silently adds an admin… | 2026-11-10 |
| CVE-2026-111258 | NA | N/A | The optional request routing feature forwards requests to their configured destination without applying the se… | 2026-11-10 |
| CVE-2026-111259 | NA | N/A | The embedded server generates HTTP session identifiers with a non-cryptographic random number generator by def… | 2026-11-10 |
| CVE-2026-111260 | NA | N/A | The Jakarta Security OpenID Connect authentication mechanism generates the state and nonce values with a non-c… | 2026-11-10 |
| CVE-2026-111261 | NA | N/A | The Jakarta Security LDAP identity store accepts an empty password as valid if the directory server allows una… | 2026-11-10 |
| CVE-2026-112191 | NA | N/A | In Eclipse Kura versions 5.4.0 through 5.6.2, the Identity REST APIs (identity/v1, and identity/v2 since 5.5.0… | 2026-11-10 |
| CVE-2026-11315 | MEDIUM | 4.3 | A out-of-bounds read vulnerability exists in the dr_mp3 drmp3_init_internal functionality of dr_libs (version(… | 2026-11-10 |
| CVE-2026-11316 | HIGH | 8.8 | A out-of-bounds write vulnerability exists in the dr_wav drwav__read_cue_to_metadata_obj functionality of dr_l… | 2026-11-10 |
| CVE-2026-121653 | CRITICAL | 9.8 | SQL injection in the Core of Ivanti Endpoint Manager before version 2024 SU8 allows a remote unauthenticated a… | 2026-11-10 |
| CVE-2026-121683 | CRITICAL | 9.4 | Missing authentication in Ivanti Cloud Services Application version 5.0.8 allows a remote unauthenticated atta… | 2026-11-10 |
| CVE-2026-123179 | MEDIUM | 5.5 | An insecure default initialization of resource in the Tomcat shutdown listener of Ivanti Sentry before version… | 2026-11-10 |
| CVE-2026-123181 | MEDIUM | 5.5 | A path traversal vulnerability in Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a remote authe… | 2026-11-10 |
| CVE-2026-124036 | HIGH | 7.1 | Missing authorization checks in the visual alert feature of FlockOS, Flock's hosted public safety platform, pr… | 2026-11-10 |
| CVE-2026-124037 | MEDIUM | 5.9 | An information exposure flaw in the public access-list sign-up feature of the Flock Safety Platform, present f… | 2026-11-10 |
| CVE-2026-124038 | LOW | 2.3 | An uncontrolled XML entity expansion vulnerability in the Flock Installer app for Android before version 2.35.… | 2026-11-10 |
| CVE-2026-125747 | MEDIUM | 5.4 | ZenTao PMS through 22.7 contains a missing object-level authorization vulnerability in module/build/control.ph… | 2026-11-10 |
| CVE-2026-125748 | MEDIUM | 4.3 | Parabol before 15.21.2 contains a missing authorization vulnerability in the addReactjiToReactable GraphQL mut… | 2026-11-10 |
| CVE-2026-125749 | MEDIUM | 4.2 | TaxHacker through 0.8.5 contains an insecure direct object reference vulnerability in app/(app)/settings/actio… | 2026-11-10 |
| CVE-2026-125750 | HIGH | 7.1 | Firekylin through 2.18.1 contains an improper authorization vulnerability that allows editor-role users to rea… | 2026-11-10 |
| CVE-2026-125751 | LOW | 3.1 | Meteroid before 2.2.0 contains an authorization bypass vulnerability in the ApiTokensService GetApiTokenById g… | 2026-11-10 |
| CVE-2026-125752 | MEDIUM | 5.0 | Meteroid before 2.2.0 contains a cross-tenant authorization bypass vulnerability in the CouponsService UpdateC… | 2026-11-10 |
| CVE-2026-125753 | MEDIUM | 5.9 | ABP Framework 2.9.0 before 10.6.2 and 10.7.0 pre-releases before 10.7.0 contain a path traversal vulnerability… | 2026-11-10 |
| CVE-2026-125754 | HIGH | 7.1 | Dolibarr 20.0.0 through 23.0.4 and 24.x before 24.0.2 contains an insecure direct object reference vulnerabili… | 2026-11-10 |
| CVE-2026-125755 | MEDIUM | 6.5 | Nodemailer 3.0.0 before 10.4.1 contains an address parsing flaw in addressparser that truncates domains at fol… | 2026-11-10 |
| CVE-2026-125756 | MEDIUM | 5.9 | postal-mime before 4.2.1 contains a parser differential vulnerability in its address parser that truncates the… | 2026-11-10 |
| CVE-2026-125757 | CRITICAL | 9.1 | mailcow: dockerized before 2026-11 contains a server-side template injection vulnerability that allows domain … | 2026-11-10 |
| CVE-2026-125758 | HIGH | 7.4 | Aptabase before commit 61d4c01 contains an authentication bypass vulnerability that allows unauthenticated att… | 2026-11-10 |
| CVE-2026-125759 | HIGH | 7.5 | Nango before 0.71.3 contains an sql injection vulnerability that allows unauthenticated attackers to execute a… | 2026-11-10 |
| CVE-2026-18128 | MEDIUM | 6.8 | Cleartext transmission of sensitive information in the Agent of Ivanti Endpoint Manager before version 2024 SU… | 2026-11-10 |
| CVE-2026-86336 | NA | N/A | Apache TomEE running on JDK 21 or later skips EJB method authorization checks, allowing callers to invoke EJB … | 2026-11-10 |
| CVE-2026-86531 | NA | N/A | The embedded OpenEJB HTTP server does not limit the size of incoming request bodies or of multipart requests, … | 2026-11-10 |
| CVE-2026-87758 | NA | N/A | The remote EJB client does not verify that the hostname of the server it connects to matches the server's TLS … | 2026-11-10 |
| CVE-2026-97402 | NA | N/A | In Eclipse Kura versions 3.1.0 to 5.6.2, the iBeacon and Eddystone advertisement decoders wrongly parse the AD… | 2026-11-10 |
| CVE-2026-97849 | NA | N/A | The embedded Derby network service ignores its configured bind address and listens on all network interfaces. … | 2026-11-10 |
| CVE-2026-97867 | NA | N/A | The EJBd remote protocol returns datasource connection details, including database credentials, to remote clie… | 2026-11-10 |
| CVE-2026-97870 | NA | N/A | When Hessian remoting endpoints are served by the embedded HTTP server, configured authentication and transpor… | 2026-11-10 |
| CVE-2026-97872 | NA | N/A | When an EJB is exposed over the optional Hessian protocol inside an existing web application, some configured … | 2026-11-10 |