Export limit exceeded: 421579 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 421579 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 421579 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (421579 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-118465 | 1 Compugroup Medical | 4 Infantia, Phronesis, Profim and 1 more | 2026-11-09 | N/A |
| Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across installations. | ||||
| CVE-2026-118467 | 1 Compugroup Medical | 4 Infantia, Phronesis, Profim and 1 more | 2026-11-09 | N/A |
| Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers without adequate pseudonymization or protection. | ||||
| CVE-2026-118468 | 1 Compugroup Medical | 4 Infantia, Phronesis, Profim and 1 more | 2026-11-09 | N/A |
| XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity (XXE) attacks. | ||||
| CVE-2026-118790 | 1 Compugroup Medical | 1 Wingesfar | 2026-11-09 | N/A |
| Multiple hardcoded credentials are embedded within product components and administrative functionalities. These credentials may enable unauthorized access to privileged accounts, services, or application features across affected deployments. | ||||
| CVE-2026-118791 | 1 Compugroup Medical | 1 Wingesfar | 2026-11-09 | N/A |
| The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification. | ||||
| CVE-2026-118792 | 1 Compugroup Medical | 1 Wingesfar | 2026-11-09 | N/A |
| Default credentials permit access through AcuXDBC. | ||||
| CVE-2026-118795 | 1 Compugroup Medical | 3 Infantia, Profim, Venere | 2026-11-09 | N/A |
| Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access. | ||||
| CVE-2026-118798 | 1 Compugroup Medical | 1 Wingesfar | 2026-11-09 | N/A |
| Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, are exposed through application logs and persistent client-side storage, enabling unauthorized access and session compromise. | ||||
| CVE-2026-95648 | 1 C-prot | 1 Appdefense | 2026-11-09 | 8.1 High |
| Improperly controlled modification of Dynamically-Determined object attributes vulnerability in C-Prot Inc. C-Prot AppDefense allows Privilege Escalation. This issue affects C-Prot AppDefense: before 1.0.2729. | ||||
| CVE-2026-16283 | 1 Osbil Technology | 1 Opanel | 2026-11-09 | 8.8 High |
| Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Osbil Technology Ltd.Osbil Technology Ltd. OPanel allows OS Command Injection. This issue affects oPanel: before 1.20.66. | ||||
| CVE-2026-95779 | 1 Hpe | 1 Morpheus Software | 2026-11-09 | 8.8 High |
| An exposure of the appliance’s confidential certificate information vulnerability exists in HPE Morpheus manager software. | ||||
| CVE-2026-19552 | 2 Python, Python Software Foundation | 2 Cpython, Cpython | 2026-11-09 | N/A |
| When ca_certs parameter was supplied to ssl.get_server_certificate() function, the identity of the certificate is not checked. | ||||
| CVE-2026-124249 | 2 Python, Python Software Foundation | 2 Cpython, Cpython | 2026-11-09 | N/A |
| http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delete cookies belonging to other domains from a shared cookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix consults the cookie policy before an expired cookie may delete an existing one, as required by RFC 6265 section 5.3. | ||||
| CVE-2025-10248 | 1 Opentext | 1 Filr | 2026-11-09 | N/A |
| XSS Vulnerability in OpenText Filr Appliance versions upto 25.1.2 could allow an authenticated user to upload a malicious file and exercise Stored XSS attack. | ||||
| CVE-2026-112165 | 2026-11-09 | N/A | ||
| The LaserGest mobile application disables TLS certificate and hostname verification via setServerTrustMode("nocheck"), allowing a man-in-the-middle attacker to intercept or modify network traffic, including credentials and API communications. | ||||
| CVE-2026-95773 | 2 Hewlett Packard Enterprise (hpe), Hpe | 2 Fabric Composer, Fabric Composer | 2026-11-09 | 3.8 Low |
| A denial-of-service vulnerability has been identified in HPE Networking Fabric Composer. Successful exploitation of this vulnerability could allow a low-privileged local attacker to cause a partial denial-of-service condition affecting other workloads on the same host. | ||||
| CVE-2026-115212 | 2026-11-09 | 8.8 High | ||
| The mView 豆瓣电影 WordPress plugin through 1.0.3 does not validate the type, name, or source of a remotely fetched file, nor perform any capability or authorization check, before saving it to a web-accessible directory, allowing any authenticated user such as a subscriber to upload arbitrary PHP files and achieve remote code execution. | ||||
| CVE-2026-115256 | 2026-11-09 | 7.5 High | ||
| The Mail Debug for WooCommerce WordPress plugin through 1.3.0 does not perform any capability, authentication, or nonce check on one of its email-logging actions, which is exposed to unauthenticated users and is not restricted to its own data, allowing anyone to read the full body of every email the site has sent, including password-reset emails whose reset key lets an attacker take over an administrator account. | ||||
| CVE-2026-123129 | 2026-11-09 | 5.3 Medium | ||
| The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not validate the ticket-type price sent to one of its unauthenticated AJAX actions when the referenced product has no ticket types configured, and stores the submitted price site-wide, where it is applied to the next event ticket added to any cart, allowing unauthenticated visitors to buy event tickets at an arbitrary price, including for free. This is due to an incomplete fix of CVE-2026-34898. | ||||
| CVE-2026-106008 | 2026-11-09 | 5.3 Medium | ||
| The FraudLabs Pro SMS Verification WordPress plugin from 1.11.2 to 1.12.1 does not perform authorisation or validity checks before marking a WooCommerce order's SMS verification as completed, allowing unauthenticated users to forge the verified state of an order and bypass the plugin's SMS verification control. | ||||