CVE-2026-124471: openemr: OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_invoice.php that allows…

OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sleobinvoice.php that allows any authenticated user to read and modify billing data for any encounter. Attackers can iterate the id parameter to read patient names and billing notes, and post payments,...

CVE-2026-124442: AzuraCast: AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows users with station WebHooks…

AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows users with station WebHooks permission to bypass the UserUrlFilter SSRF guard through HTTP redirects. Attackers can configure Mastodon, Telegram, GroupMe, or RadioReg webhooks pointing to a redirecting URL,...

CVE-2026-124444: openemr: OpenEMR before 8.4.0 contains a mass assignment vulnerability in the patient portal OnsiteDocument query API that lets…

OpenEMR before 8.4.0 contains a mass assignment vulnerability in the patient portal OnsiteDocument query API that lets request parameters set bitwise criteria filters whose values are placed unquoted into the SQL WHERE clause. Authenticated patient portal users can inject SQL via parameters such ...

CVE-2026-124458: openemr: OpenEMR before 8.4.0 contains an authorization bypass vulnerability in the FHIR GET /fhir/Person/:uuid route that…

OpenEMR before 8.4.0 contains an authorization bypass vulnerability in the FHIR GET /fhir/Person/:uuid route that allows patient-portal users to read any staff member's demographics by bypassing compartment enforcement. Attackers holding a patient SMART token with patient/Person.read can harvest...

CVE-2026-124455: openemr: OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query()…

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query that allows authenticated portal patients to read other patients' documents by overriding PidEquals criteria. Attackers can supply PidEquals, PidGreaterThan, or PidIn request...

CVE-2026-124467: openemr: OpenEMR before 8.4.0 contains a local file inclusion in the ESign router (library/ESign/Router.php), which passes the…

OpenEMR before 8.4.0 contains a local file inclusion in the ESign router library/ESign/Router.php, which passes the unsanitized module parameter into a requireonce of ' /Controller.php', and the fax module's faxProcessUploads writes attacker-named files to a predictable temp path without extensio...

CVE-2026-124331: Jinher OA: A vulnerability was identified in Jinher OA C6

A vulnerability was identified in Jinher OA C6. This impacts an unknown function of the file /C6/JHSoft.Web.Project/OfficeReadOnly/ProjectAfficheManage.aspx. Such manipulation of the argument ProjID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly...

CVE-2026-124479: openemr: OpenEMR before 8.4.0 contains an arbitrary local file read vulnerability in REST document download, where the…

OpenEMR before 8.4.0 contains an arbitrary local file read vulnerability in REST document download, where the controller passes stored uploaded document bytes to Symfony's BinaryFileResponse as a filesystem path instead of returning them as content. Authenticated users with document upload and...

CVE-2026-123495: go-vikunja vikunja: Vikunja 2.0.0 before 2.7.1 accepts form-encoded bodies on the /api/v2 login and OIDC callback endpoints without CSRF or…

Vikunja 2.0.0 before 2.7.1 accepts form-encoded bodies on the /api/v2 login and OIDC callback endpoints without CSRF or Origin checks, enabling login cross-site request forgery. An attacker with an account can lure a victim to a page posting the attacker's credentials or OIDC code, switching the...

CVE-2026-123520: go-vikunja vikunja: Vikunja from 0.18.0 before 2.7.1 contains a privilege escalation vulnerability that allows team owners to gain admin or…

Vikunja from 0.18.0 before 2.7.1 contains a privilege escalation vulnerability that allows team owners to gain admin or ownership of read-only shared projects by deleting accounts. Attackers can create a bot, add it to their team, and delete it through the bots endpoint, triggering...

CVE-2026-123517: go-vikunja vikunja: Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine…

Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exist by calling the team member self-removal endpoint. Attackers can send DELETE requests to /teams/id/members/own username for arbitrary team ids and use the...

CVE-2026-123529: go-vikunja vikunja: Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write…

Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write access to inject arbitrary CSS via unsanitized table-cell data-background-color attributes. Attackers can store crafted task descriptions or comments to render full-viewport...

CVE-2026-123573: hickory-dns: hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS…

hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation format parser. Attackers can supply untrusted zone files where only a single or double quote replaces a service parameter value, triggering a panic that crashes...

CVE-2026-123589: hickory-dns: The DNS-over-QUIC (DoQ) server in hickory-server (hickory-dns) before 0.26.2 does not apply any timeout when reading a…

The DNS-over-QUIC DoQ server in hickory-server hickory-dns before 0.26.2 does not apply any timeout when reading a request message from a QUIC stream, bypassing all configured timeouts. A remote unauthenticated client can open a connection and a request stream and hold it open indefinitely,...

CVE-2026-123551: OpenIdentityPlatform OpenAM: OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers…

OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers to read live session tokens from the notification WebSocket. Attackers can bypass the agent-only check through an unvalidated internal forward on legacy Liberty ID-FF endpoints,...

CVE-2026-123553: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 ships built-in identities in the Top Level Realm (demo, anonymous, wsc, wsp, SecurityTokenService…

OpenAM before 16.1.4 ships built-in identities in the Top Level Realm demo, anonymous, wsc, wsp, SecurityTokenService and agentAuth with passwords that are identical on every installation, publicly known, and able to authenticate. Unauthenticated remote attackers can log in as these identities to...

CVE-2026-123557: ZcashFoundation zebra: ZcashFoundation Zebra zebrad before 7.0.0 contains a reachable assertion race condition that allows unauthenticated…

ZcashFoundation Zebra zebrad before 7.0.0 contains a reachable assertion race condition that allows unauthenticated remote peers to abort the node by triggering disconnection during a blocked outbound send. Malicious peers can return empty FindBlocks or FindHeaders replies and stop reading their...

CVE-2026-123558: ZcashFoundation zebra: Zebra zebrad before 7.0.0 contains a denial of service vulnerability that allows a malicious peer to stall checkpoint…

Zebra zebrad before 7.0.0 contains a denial of service vulnerability that allows a malicious peer to stall checkpoint sync by cancelling the verifier rewind after a failed commit. Attackers can serve a forged block with altered authorizing data plus a restart-triggering block, leaving the verifie...

CVE-2026-123564: sveltejs devalue: Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, whose generated code for sparse…

Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, whose generated code for sparse arrays allocates memory proportional to the array's declared length when evaluated. Attackers who can influence a very large sparse array serialized by an application can exhaust...

CVE-2026-124439: scriban: Scriban and Scriban.Signed before 7.5.3 contain uncontrolled recursion flaws in which postfix member, indexer, and call…

Scriban and Scriban.Signed before 7.5.3 contain uncontrolled recursion flaws in which postfix member, indexer, and call chains bypass ExpressionDepthLimit, array comparison lacks depth and cycle checks, and object.eval bypasses RecursiveLimit. Attackers who can supply templates can trigger an...

CVE-2026-124459: openemr: OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in many encounter-form view and save…

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in many encounter-form view and save endpoints that lack patient/encounter ownership checks. Authenticated clinical users can enumerate sequential form id values in requests such as soap/view.php and save.php to read...

CVE-2026-124468: openemr: OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Standard REST API patient insurance and employer…

OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Standard REST API patient insurance and employer search, which concatenates query-string parameter names into SQL as column identifiers without escaping. Authenticated clients, including low-privilege patient-portal OAuth2 tokens...

CVE-2026-124480: openemr: OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to…

OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed apicsrftokenjs value to skip FHIR scope checks and...

CVE-2026-120113: IBM Aspera Connect: IBM Aspera Connect 1.6.1 through 4.2.19 could allow a remote attacker to obtain sensitive information and modify host…

IBM Aspera Connect 1.6.1 through 4.2.19 could allow a remote attacker to obtain sensitive information and modify host trust configuration due to missing authentication and overly permissive cross-origin access controls in the local HTTP service. By persuading a victim to visit a malicious web pag...

CVE-2026-93879: IBM Hibernate Validator: Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption…

Hibernate Validator could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption resulting from improper escaping of user-controlled data in Expression Language EL expressions...

CVE-2026-17437: IBM App Connect Enterprise: IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.29 could allow a local attacker to…

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.29 could allow a local attacker to perform an arbitrary file write due to improper validation of pathnames during archive extraction...

CVE-2026-107331: IBM DataStage on Cloud Pak for Data: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information…

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability...

CVE-2026-124477: openemr: OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to…

OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete arbitrary patient recall records via the deleteRecall action. Attackers can send POST requests to /interface/main/messages/save.php with a target pid and rID to remove reca...

CVE-2026-124552: webmin: Webmin through 2.670 contains a stored cross-site scripting vulnerability in the Shorewall and Shorewall6 modules'…

Webmin through 2.670 contains a stored cross-site scripting vulnerability in the Shorewall and Shorewall6 modules' list.cgi, which renders table fields and COMMENT lines unescaped. Authenticated users with table edit permission can store JavaScript via savecmt.cgi or table entries that executes...

CVE-2026-124433: thorsten phpMyFAQ: phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators…

phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators holding only GROUPDELETE permission to delete higher-privileged groups. Attackers can submit a target grouplistselect value to /admin/group/confirm and then /admin/group/delete to remo...

CVE-2026-124465: Trendyol kafka-konsumer: Trendyol kafka-konsumer from 2.3.3 before 2.6.18 contains a denial of service vulnerability in batch_consumer.go that…

Trendyol kafka-konsumer from 2.3.3 before 2.6.18 contains a denial of service vulnerability in batchconsumer.go that panics when a single record exceeds MessageGroupByteSizeLimit. Attackers able to produce to the consumed topic can publish one oversized record that terminates the consumer before...

CVE-2026-124441: kyverno: Kyverno before 1.19.2 contains an authorization bypass vulnerability that allows namespaced tenants to generate any…

Kyverno before 1.19.2 contains an authorization bypass vulnerability that allows namespaced tenants to generate any resource kind in any namespace by templating the generate rule's kind and namespace with variables. Attackers can create a Policy and trigger ConfigMap in their own namespace, causi...

CVE-2026-124475: openemr: OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows…

OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows authenticated portal patients to modify other patients' settings by supplying an arbitrary settingpatient value. Attackers can insert or overwrite patientsettings rows for victims...

CVE-2026-123550: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts…

OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts unsigned assertions on the ECP PAOS and HTTP-Artifact bindings when WantAssertionsSigned is false. Unauthenticated remote attackers can submit forged assertions to obtain sessions a...

CVE-2026-124446: openemr: OpenEMR before 8.3.0 contains a path traversal vulnerability in the FaxSMS module's RCFaxClient and SignalWireClient…

OpenEMR before 8.3.0 contains a path traversal vulnerability in the FaxSMS module's RCFaxClient and SignalWireClient disposeDocument functions that allows authenticated low-privilege users to read and overwrite arbitrary files via the unsanitized filepath parameter. Attackers can request...

CVE-2026-124482: openemr: OpenEMR before 8.4.0 contains an authorization bypass allowing low-privileged SMART standalone-launch users to bind…

OpenEMR before 8.4.0 contains an authorization bypass allowing low-privileged SMART standalone-launch users to bind arbitrary patient UUIDs into the OAuth token context. Attackers with only the patients|demo ACL can select a victim during authorization and read that patient's clinical notes and...

CVE-2026-115554: IBM Tivoli Netcool/OMNIbus: IBM Tivoli Netcool/OMNIbus 8.1.0 through 8.1.0.41 is vulnerable to stored cross-site scripting

IBM Tivoli Netcool/OMNIbus 8.1.0 through 8.1.0.41 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

CVE-2026-12735: IBM Controller Disclosure Management: IBM Controller Disclosure Management 1.0.0.0 could allow an attacker to obtain sensitive EXIF metadata from uploaded…

IBM Controller Disclosure Management 1.0.0.0 could allow an attacker to obtain sensitive EXIF metadata from uploaded images due to improper removal of sensitive information before storage...

CVE-2026-114464: IBM Process Mining: IBM Process Mining 2.0.0 through 2.2.1 could allow a remote attacker to obtain sensitive information due to improper…

IBM Process Mining 2.0.0 through 2.2.1 could allow a remote attacker to obtain sensitive information due to improper access control...

CVE-2026-18196: IBM App Connect Enterprise: IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to…

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.30 could allow a remote attacker to inject arbitrary HTML due to improper output neutralization...

CVE-2026-18484: IBM ContextForge MCP Gateway: IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 could allow a remote authenticated attacker to cause a denial of…

IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 could allow a remote authenticated attacker to cause a denial of service due to improper slug normalization causing tool name collisions...

CVE-2026-18893: IBM CockroachDB PostgreSQL for IBM VPC: IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is…

IBM CockroachDB PostgreSQL for IBM VPC 26.2.0 through 26.2.3, 25.4.0 through 25.4.12, and 25.2.0 through 25.2.20 is vulnerable to privilege escalation via user-defined function...

CVE-2026-108292: IBM Process Mining: IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated user to upload a file with dangerous types that…

IBM Process Mining 2.0.0 through 2.2.1 could allow an authenticated user to upload a file with dangerous types that could be executed by another user if opened...

CVE-2026-107330: IBM DataStage on Cloud Pak for Data: IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information…

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to a Server-Side Request Forgery SSRF vulnerability...

CVE-2026-12737: IBM: IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.1_1 and IBM Sterling File Gateway 6.2.2.0 through 6.2.2.1_1 stores…

IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.11 and IBM Sterling File Gateway 6.2.2.0 through 6.2.2.11 stores potentially sensitive information in log files that could be read by a local privileged user...

CVE-2026-19307: IBM: IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.2_1 and 6.2.2.0 through 6.2.2.1_1, and IBM Sterling File Gateway…

IBM Sterling B2B Integrator 6.2.1.0 through 6.2.1.21 and 6.2.2.0 through 6.2.2.11, and IBM Sterling File Gateway 6.2.1.0 through 6.2.1.21 and 6.2.2.0 through 6.2.2.11 Standard Edition could allow a remote authenticated attacker to access unauthorized pages due to improper authorization...

CVE-2026-124470: openemr: OpenEMR before 8.3.0 contains a broken object level authorization vulnerability in…

OpenEMR before 8.3.0 contains a broken object level authorization vulnerability in portal/report/portalcustomreport.php that allows authenticated portal patients to read other patients' problem list entries. Attackers can enumerate sequential IDs in issue parameter names to retrieve other patient...

CVE-2026-123580: hickory-dns: Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient…

Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient checks on NSEC3 record names during DNSSEC verification, comparing only the hashed label without confirming the record belongs to the correct zone. Attackers can supply NSEC3 records...

CVE-2026-124463: openemr: OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability that allows authenticated users with CAMOS…

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability that allows authenticated users with CAMOS access to inject HTML by saving malicious CAMOS content through ajaxsave.php. Attackers can store a script payload that executes unencoded when the entry is printed via the...

CVE-2026-10844: IBM WebSphere Application Server - Liberty: IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow a remote attacker to conduct phishing…

IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow a remote attacker to conduct phishing attacks...