CVE-2026-109899

Missing Authorization vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Melapress Role Editor: from n/a through 1.3.0...

CVE-2026-109900

Incorrect Privilege Assignment vulnerability in Melapress Melapress Role Editor melapress-role-editor allows Privilege Escalation.This issue affects Melapress Role Editor: from n/a through 1.3.0...

CVE-2026-114186

Missing Authorization vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AnyWhere Elementor: from n/a through 1.3.0...

CVE-2026-103320

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader role to obtain sensitive information...

CVE-2026-102618

IBM i 7.6, 7.5, 7.4, and 7.3 could allow an authenticated user to indirectly disable system auditing, which they otherwise don't have authority to disable...

CVE-2024-41786

IBM Engineering Requirements Management DOORS Next 7.1, and 7.2 could allow a remote attacker to force the Web server to return contents of a sensitive requested file due to improper input validation...

CVE-2025-0166

IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could disclose sensitive source code information that should not be accessible...

CVE-2025-36075

IBM Safer Payments 6.4.0.00 through 6.4.2.11, 6.5.0.00 through 6.5.0.09, 6.6.0.00 through 6.6.0.07, 6.7.0.00 through 6.7.0.03, and 6.8.0.00 could allow an authenticated user to obtain sensitive information, caused by improper user input validation. By using a set of API requests the user could...

CVE-2025-1837

IBM watsonx Orchestrate Cartridge for Cloud Pak for Data 4.8.4 through 4.8.5, and 5.0.0 through 5.4.2 could allow an authenticated user to perform unauthorized actions due to improper trust of server-side permission methods...

CVE-2026-124553

BabelDOC from 0.3.61 before 0.7.0 contains a resource exhaustion vulnerability that allows remote attackers to exhaust CPU and memory by supplying unbounded bfrange and cidrange spans. Attackers can submit a crafted PDF whose embedded ToUnicode CMap declares a huge range, driving billions of loop...

CVE-2026-124551

ClassroomIO through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users of any organization to clone other tenants' courses via the POST /course/:courseId/clone endpoint. Attackers who know a target course id can copy its sections, lessons, exercises, and quiz...

CVE-2026-124493

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the DocumentType constructor that injects header textContent into innerHTML without HTML escaping. Attackers can store entity-encoded HTML in h1-h6 headers that executes JavaScript when editors using document:header mo...

CVE-2026-124494

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability because the html.clean sanitizer's normalizeURL function decodes named entities like to an empty string. Attackers can inject href values such as javascript that pass the isSafeURL check but are decoded by browsers,...

CVE-2026-124552

Webmin through 2.670 contains a stored cross-site scripting vulnerability in the Shorewall and Shorewall6 modules' list.cgi, which renders table fields and COMMENT lines unescaped. Authenticated users with table edit permission can store JavaScript via savecmt.cgi or table entries that executes...

CVE-2026-124491

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create method that assigns server-returned file names to innerHTML without escaping. Attackers can upload files with HTML-laden names that bypass html.clean and execute JavaScript in victims'...

CVE-2026-124490

OpenEMR before 8.3.0 contains a path traversal vulnerability in the RingCentral RCFaxClient disposeDocument method of oe-module-faxsms that allows authenticated attackers to read and write arbitrary files via the filepath parameter. Attackers can use action=download to read credentials and source...

CVE-2026-124492

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's createBookmarkList, which inserts entity-decoded h1-h6 header textContent into the bookmark list via innerHTML without escaping. Attackers can store HTML-encoded payloads in editor headers that...

CVE-2026-124488

OpenEMR before 8.3.0 contains an authorization bypass vulnerability that allows authenticated clinicians lacking high-sensitivity permission to read and modify encounter-bound forms via loadform.php. Attackers can request the Clinical Notes or Care Plan direct loader to obtain restricted content...

CVE-2026-124487

OpenEMR before 8.4.0 contains an improper authorization vulnerability in the non-patient POST /fhir/DocumentReference/$docref route that allows low-privileged users to generate any patient's CCDA. Attackers with only demographics and documents permissions can supply a victim patient parameter, th...

CVE-2026-124486

OpenEMR before 8.3.0 contains a missing authorization vulnerability in the classic document controller that allows low-privilege authenticated users to recategorize other patients' documents. Attackers can invoke moveactionprocess to move a document into a patients|demo category, then retrieve it...

CVE-2026-124489

OpenEMR before 8.3.0 contains a broken access control vulnerability in portal/portalpayment.php that allows low-privilege authenticated users to bypass billing ACL checks by tampering patient identifiers. Attackers can modify the pid and formpid parameters to view payment pages and record...

CVE-2026-124485

OpenEMR before 8.3.0 contains an authorization bypass vulnerability in the patient portal onsitedocuments API that allows authenticated patients to read other patients' documents by overriding query criteria. Attackers can send empty pidEquals and denialReasonIsNotLike parameters to remove patien...

CVE-2026-124479

OpenEMR before 8.4.0 contains an arbitrary local file read vulnerability in REST document download, where the controller passes stored uploaded document bytes to Symfony's BinaryFileResponse as a filesystem path instead of returning them as content. Authenticated users with document upload and...

CVE-2026-124480

OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed apicsrftokenjs value to skip FHIR scope checks and...

CVE-2026-124483

OpenEMR before 8.4.0 contains an incorrect authorization vulnerability because the prescription REST API routes check the patients.med ACL instead of patients.rx and request no specific permission bit, so read-only Medical/History access passes the check. Authenticated staff users can reuse the...

CVE-2026-124481

OpenEMR before 8.4.0 contains an improper authorization vulnerability in Rainforest patient portal payments that trusts browser-supplied patientId, encounter, and amount values instead of deriving them from the portal session. Authenticated portal patients can tamper with JSON sent to...

CVE-2026-124482

OpenEMR before 8.4.0 contains an authorization bypass allowing low-privileged SMART standalone-launch users to bind arbitrary patient UUIDs into the OAuth token context. Attackers with only the patients|demo ACL can select a victim during authorization and read that patient's clinical notes and...

CVE-2026-124484

OpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any authenticated core user to access cross-patient documents. Attackers can omit the patientId parameter and supply arbitrary record IDs to list, read, and overwrite other patients'...

CVE-2026-124473

OpenEMR before 8.3.0 contains a broken object-level authorization vulnerability in the SOAP note update API, which does not verify that the supplied SOAP note ID sid belongs to the supplied patient and encounter. Authenticated users with encounters/notes permission can send PUT requests to...

CVE-2026-124475

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authenticated portal patients to modify other patients' settings by supplying an arbitrary settingpatient value. Attackers can insert or overwrite patientsettings rows for victims...

CVE-2026-124478

OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of /interface/main/messages/save.php that allows low-privileged authenticated users to modify arbitrary patients' recall data. Attackers can submit a crafted newpid with recall, contact, provider, facility...

CVE-2026-124476

OpenEMR before 8.3.0 contains an insecure direct object reference in portal/lib/paylib.php, which writes the request-supplied formpid or the patientidcc value in Sphere data to onsiteportalactivity without checking it against the session patient. Authenticated portal patients can submit...

CVE-2026-124474

MRBS Meeting Room Booking System before 1.12.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script via the error parameter of viewentry.php. Attackers can send crafted links to logged-in users to read CSRF tokens, modify or delete booking...

CVE-2026-124477

OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete arbitrary patient recall records via the deleteRecall action. Attackers can send POST requests to /interface/main/messages/save.php with a target pid and rID to remove reca...

CVE-2026-124470

OpenEMR before 8.3.0 contains a broken object level authorization vulnerability in portal/report/portalcustomreport.php that allows authenticated portal patients to read other patients' problem list entries. Attackers can enumerate sequential IDs in issue parameter names to retrieve other patient...

CVE-2026-124471

OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sleobinvoice.php that allows any authenticated user to read and modify billing data for any encounter. Attackers can iterate the id parameter to read patient names and billing notes, and post payments,...

CVE-2026-124469

OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Fee Sheet drug-inventory lookup DrugSalesService::sellDrug that interpolates the prodNwarehouse POST field into an ORDER BY clause. Low-privileged authenticated users can submit Fee Sheet product lines with constant subqueries to...

CVE-2026-124472

OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sleobpatientnote.php that allows any authenticated user to read and modify patient billing notes. Attackers with low-privilege accounts can enumerate the patientid parameter and submit POST requests using the...

CVE-2026-124465

Trendyol kafka-konsumer from 2.3.3 before 2.6.18 contains a denial of service vulnerability in batchconsumer.go that panics when a single record exceeds MessageGroupByteSizeLimit. Attackers able to produce to the consumed topic can publish one oversized record that terminates the consumer before...

CVE-2026-124466

OpenEMR before 8.4.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send HTTP requests by registering an OAuth2 client with an unvalidated jwksuri. Attackers can trigger the fetch via the token introspection endpoint with an unsigned...

CVE-2026-124467

OpenEMR before 8.4.0 contains a local file inclusion in the ESign router library/ESign/Router.php, which passes the unsanitized module parameter into a requireonce of '/Controller.php', and the fax module's faxProcessUploads writes attacker-named files to a predictable temp path without extension...

CVE-2026-124464

OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows patient-scoped SMART tokens to read other patients' questionnaire responses because FhirQuestionnaireResponseService does not implement IPatientCompartmentResourceService. Attackers holding a...

CVE-2026-124463

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability that allows authenticated users with CAMOS access to inject HTML by saving malicious CAMOS content through ajaxsave.php. Attackers can store a script payload that executes unencoded when the entry is printed via the...

CVE-2026-124462

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query that allows authenticated portal patients to bypass the lowercase pid authorization guard by supplying a capitalised Pid parameter. Attackers can request the api/onsitedocuments...

CVE-2026-124468

OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Standard REST API patient insurance and employer search, which concatenates query-string parameter names into SQL as column identifiers without escaping. Authenticated clients, including low-privilege patient-portal OAuth2 tokens...

CVE-2026-124456

OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the oe-module-prior-authorizations module that allow authenticated low-privilege users to access and modify other patients' records. Attackers can request public/reports/listreport.php to...

CVE-2026-124461

OpenEMR before 8.3.0 contains a missing authorization vulnerability in library/ajax/upload.php that allows any authenticated user to read and overwrite document data by supplying an arbitrary docid. Low-privilege users can enumerate docid values with the fetch and save actions to disclose patient...

CVE-2026-124458

OpenEMR before 8.4.0 contains an authorization bypass vulnerability in the FHIR GET /fhir/Person/:uuid route that allows patient-portal users to read any staff member's demographics by bypassing compartment enforcement. Attackers holding a patient SMART token with patient/Person.read can harvest...

CVE-2026-124459

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in many encounter-form view and save endpoints that lack patient/encounter ownership checks. Authenticated clinical users can enumerate sequential form id values in requests such as soap/view.php and save.php to read...

CVE-2026-124457

OpenEMR before 8.3.0 contains a path traversal vulnerability in interface/billing/sleobprocess.php that allows authenticated users to write and read files by supplying unsanitized eraname values. Attackers without billing privileges can inject ../ sequences to create ERA report .html files anywhe...