WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-200✕
Overview 12,083 matches · 918 in Waratek scope · 26 protected · 120 exploited · 19 CISA KEV · 697 public PoC · 98 EPSS ≥ 0.5
12,083matches 918in Waratek scope7.6% 26protected0.2% 120exploited1.0% 19CISA KEV0.2% 697public PoC5.8% 98EPSS ≥ 0.50.8%
Protected by Waratek 26 0.2% Rule in development 0 0.0% Mitigation candidate 30 0.2% No exploit published 862 7.1% Outside Waratek scope 124 1.0% Not applicable 11,040 91.4% Withdrawn CVE 1 0.0%
Critical 424 3.5% High 2,743 22.7% Medium 7,719 63.9% Low 1,191 9.9% None 2 0.0% Unknown 4 0.0%
blocked by ARMR today 26 0.2% partly blocked 0 0.0% not blocked 12,057 99.8% not established 0 0.0% unrecorded 0 0.0%
Exploited 120 1.0% Working exploit published 590 4.9% Proof of concept only 929 7.7% Forecast only 14 0.1% No public exploit 10,430 86.3%
split by peak 2,532 / year
Withdrawn CVE: 1Not applicable: 11,040Outside Waratek scope: 124No exploit published: 862Mitigation candidate: 30Protected by Waratek: 26 Unknown: 4None: 2Low: 1,191Medium: 7,719High: 2,743Critical: 424 not blocked: 12,057blocked by ARMR today: 26 No public exploit: 10,430Forecast only: 14Proof of concept only: 929Working exploit published: 590Exploited: 120
19974 Not applicable4 Critical1 High1 Medium2 not blocked4 No public exploit4 19981 Not applicable1 Medium1 not blocked1 No public exploit1 19999 Not applicable9 High1 Medium7 Low1 not blocked9 Working exploit published2 No public exploit7 20005 Mitigation candidate1 Not applicable4 Medium3 Low2 not blocked5 Working exploit published4 No public exploit1 20013 Mitigation candidate1 No exploit published1 Not applicable1 Medium2 Low1 not blocked3 Working exploit published1 No public exploit2 200218 Mitigation candidate1 Not applicable17 High1 Medium15 Low2 not blocked18 Exploited1 Working exploit published5 Forecast only1 No public exploit11 200326 No exploit published1 Not applicable25 High3 Medium22 Low1 not blocked26 Working exploit published14 No public exploit12 20045 Protected by Waratek1 Not applicable4 Medium5 blocked by ARMR today1 not blocked4 Working exploit published2 No public exploit3 200520 Mitigation candidate2 No exploit published4 Not applicable14 High3 Medium14 Low3 not blocked20 Working exploit published3 No public exploit17 200633 Mitigation candidate1 No exploit published4 Not applicable28 High1 Medium26 Low6 not blocked33 Working exploit published10 No public exploit23 2007101 Mitigation candidate2 No exploit published2 Outside Waratek scope3 Not applicable94 High13 Medium75 Low13 not blocked101 Working exploit published22 No public exploit79 2008191 Mitigation candidate1 No exploit published8 Outside Waratek scope3 Not applicable179 High25 Medium128 Low38 not blocked191 Exploited1 Working exploit published32 No public exploit158 2009160 Mitigation candidate1 No exploit published17 Outside Waratek scope1 Not applicable141 High28 Medium107 Low25 not blocked160 Exploited1 Working exploit published36 No public exploit123 2010158 Mitigation candidate1 No exploit published5 Not applicable152 High4 Medium122 Low32 not blocked158 Working exploit published18 No public exploit140 2011293 No exploit published8 Outside Waratek scope1 Not applicable284 High4 Medium258 Low31 not blocked293 Working exploit published10 No public exploit283 2012222 Protected by Waratek2 No exploit published3 Outside Waratek scope1 Not applicable216 High1 Medium186 Low35 blocked by ARMR today2 not blocked220 Working exploit published18 No public exploit204 2013246 Mitigation candidate1 No exploit published6 Outside Waratek scope7 Not applicable232 Critical1 High11 Medium176 Low58 not blocked246 Exploited1 Working exploit published8 Forecast only1 No public exploit236 2014356 Protected by Waratek6 No exploit published15 Outside Waratek scope10 Not applicable325 High22 Medium263 Low71 blocked by ARMR today6 not blocked350 Exploited3 Working exploit published25 Proof of concept only1 No public exploit327 2015596 No exploit published13 Outside Waratek scope13 Not applicable570 Critical2 High22 Medium434 Low138 not blocked596 Exploited2 Working exploit published28 Proof of concept only1 Forecast only1 No public exploit564 2016684 Protected by Waratek1 Mitigation candidate4 No exploit published36 Outside Waratek scope12 Not applicable631 Critical13 High130 Medium459 Low82 blocked by ARMR today1 not blocked683 Exploited2 Working exploit published30 Proof of concept only5 Forecast only3 No public exploit644 20171,315 Mitigation candidate1 No exploit published75 Outside Waratek scope16 Not applicable1,223 Critical47 High284 Medium886 Low98 not blocked1,315 Exploited8 Working exploit published132 Proof of concept only6 Forecast only1 No public exploit1,168 20181,079 Mitigation candidate3 No exploit published72 Outside Waratek scope14 Not applicable990 Critical57 High357 Medium618 Low47 not blocked1,079 Exploited9 Working exploit published51 Proof of concept only7 Forecast only2 No public exploit1,010 2019563 Protected by Waratek2 Mitigation candidate1 No exploit published18 Outside Waratek scope7 Not applicable535 Critical19 High144 Medium371 Low29 blocked by ARMR today2 not blocked561 Exploited5 Working exploit published14 Proof of concept only4 Forecast only2 No public exploit538 2020366 Protected by Waratek1 Mitigation candidate2 No exploit published19 Outside Waratek scope9 Not applicable335 Critical15 High109 Medium220 Low22 blocked by ARMR today1 not blocked365 Exploited3 Working exploit published17 Proof of concept only3 Forecast only1 No public exploit342 2021317 Protected by Waratek4 Mitigation candidate2 No exploit published21 Outside Waratek scope9 Not applicable281 Critical17 High84 Medium194 Low22 blocked by ARMR today4 not blocked313 Exploited12 Working exploit published9 Proof of concept only3 No public exploit293 2022497 Protected by Waratek1 Mitigation candidate1 No exploit published21 Outside Waratek scope4 Not applicable470 Critical14 High141 Medium303 Low39 blocked by ARMR today1 not blocked496 Exploited5 Working exploit published9 Proof of concept only42 No public exploit441 2023605 Protected by Waratek1 Mitigation candidate2 No exploit published29 Outside Waratek scope5 Not applicable568 Critical23 High237 Medium327 Low18 blocked by ARMR today1 not blocked604 Exploited13 Working exploit published14 Proof of concept only77 No public exploit501 2024845 Protected by Waratek2 Mitigation candidate2 No exploit published35 Outside Waratek scope3 Not applicable802 Withdrawn CVE1 Critical37 High256 Medium515 Low35 Unknown2 blocked by ARMR today2 not blocked843 Exploited21 Working exploit published23 Proof of concept only105 Forecast only2 No public exploit694 2025833 Protected by Waratek3 No exploit published22 Outside Waratek scope4 Not applicable804 Critical64 High210 Medium491 Low68 blocked by ARMR today3 not blocked830 Exploited20 Working exploit published21 Proof of concept only188 No public exploit604 20262,532 Protected by Waratek2 No exploit published427 Outside Waratek scope2 Not applicable2,101 Critical114 High651 Medium1,489 Low274 None2 Unknown2 blocked by ARMR today2 not blocked2,530 Exploited13 Working exploit published32 Proof of concept only487 No public exploit2,000
1999200220052008201120142017202020232026
12,083 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 121 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-68541 Medium 2026-11-13 Not applicable No public exploit PolicyPress is a compliance policy management tool for small and mid-size teams. Prior to version 1.4.1, sensitive content is disclosed via CSS-only web redaction and insecure starter workflow defaults. This issue has been patched in version 1.4.1.
CVE-2026-5514 Low 2026-11-13 Not applicable No public exploit IBM Bob 2.0.3 allows unauthorized extensions to retrieve session tokens via the authentication provider API. The token is exposed in the account identifier field during account enumeration, without requiring explicit user consent. This may allow malicious extensions to access sensitive session information and potentially perform unauthorized actions on behalf of the user.
CVE-2026-128790 High 2026-11-13 Not applicable No public exploit In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment do not apply an access rule's `FILTERLIST` fragment filters to single Submodel reads. `GET /submodels` removes the fields that a rule's `FILTERLIST` hides, but `GET /submodels/{submodelIdentifier}` and `GET /submodels/{submodelIdentifier}/$metadata` return them unfiltered. An authenticated caller with READ access to a Submodel can therefore read fields that the access rules hide from them, for example `supplementalSemanticIds` keys that name the other parties allowed to read the Submodel. If versioning is enabled (`history.mode` set to `api` or `audit`), `GET /submodels/{submodelIdentifier}/$history` and `GET /shells/{aasIdentifier}/$history` in the Submodel Repository, AAS Repository and AAS Environment return the complete stored version without applying the rule's formula or fragment filters. A caller whose rules grant READ on these routes can read fields that the access rules hide, and Submodels and Asset Administration Shells that the direct read does not return to them at all. The issue is fixed in Eclipse BaSyx Go Components v1.1.3.
CVE-2026-128118 High 2026-11-13 Not applicable No public exploit SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From version 3.0.0 until 3.1.1, the build-time server-only module guard did not treat src/params.js as a client entry point even though parameter matchers can run in the browser. Server-only modules imported through src/params.js could consequently enter the client bundle, where statically replaced private environment values or other server secrets could be exposed. This issue is fixed in 3.1.1.
CVE-2026-128080 Medium 2026-11-13 Not applicable No public exploit OpenTelemetry JavaScript is the OpenTelemetry JavaScript client. From 0.204.0 until 0.222.0, @opentelemetry/instrumentation-http writes the raw query string from incoming HTTP requests to the url.query server-span attribute without applying the redactedQueryParams protection used for outgoing spans. Services receiving signed URLs or other credentials in query parameters can therefore export still-valid secrets to tracing backends, where observability infrastructure and users with span-read access may read them. The redactedQueryParams option does not protect incoming spans in affected versions. This issue is fixed in version 0.222.0.
CVE-2026-128033 Medium 2026-11-13 Not applicable No public exploit OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an information disclosure vulnerability in Mage_Rss_Model_Resource_Order::getAllCommentCollection(), which omits the is_visible_on_front filter for invoice, shipment and credit-memo comments. Authenticated customers can open the /rss/order/status feed for their order to read internal staff comments, such as fraud-review and payment notes.
CVE-2026-128021 Medium 2026-11-13 Not applicable Proof of concept only FrankenPHP before 1.13.2 contains an information disclosure vulnerability that allows later clients to read earlier clients' libxml errors because worker mode never resets LIBXML(error_list) between requests. Attackers sending requests to the same worker thread can call libxml_get_errors() or libxml_get_last_error() to obtain other clients' parsed-document fragments and server filesystem paths.
CVE-2026-128019 Medium 2026-11-13 Not applicable No public exploit FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that leaks per-request environment variables into later requests on the same PHP thread. Attackers can read values set via env directives with request placeholders or WithRequestEnv() through getenv() or $_SERVER, causing applications to act on another user's routing, tenant, or authorization values.
CVE-2026-127102 High 2026-11-13 Not applicable No public exploit In Eclipse BaSyx Go Components versions up to and including 1.1.2, ABAC-enabled deployments of the Submodel Repository and the AAS Environment return Submodel Elements that the caller is not authorized to read from `GET /submodels/{submodelIdentifier}/submodel-elements`. If an access rule grants READ on a single Submodel Element through a `$sme` `REFERABLE` object, the list route returns every element of that Submodel, including its value, as soon as one element matches the caller's rules. The single-element route and the full Submodel read enforce the same rule and deny access to the other elements. An authenticated caller with a READ grant for one element of a Submodel can therefore read all other elements of that Submodel. The issue is fixed in Eclipse BaSyx Go Components v1.1.3.
CVE-2026-126941 High 2026-11-13 Not applicable No public exploit Zipline through 4.6.2 contains an authorization bypass vulnerability that allows authenticated administrators to read superadmin secrets because GET /api/users and GET /api/users/:id lack the canInteract check. Attackers can retrieve plaintext totpSecret and OAuth tokens to bypass 2FA and take over superadmin accounts, while any authenticated user can enumerate other users' folders via GET /api/user/folders.
CVE-2026-126939 Medium 2026-11-13 Not applicable No public exploit Zipline before 4.6.4 contains an information disclosure vulnerability in GET /api/server/folder/:id that allows unauthenticated attackers to list files in non-public upload-only folders. Attackers who know the folder UUID can supply the page query parameter to bypass the metadata-only early return and enumerate file names, IDs, MIME types, sizes, and view counts.
CVE-2026-126490 Low 2026-11-13 Not applicable No public exploit OpenEMR before 8.5.0 contains active debug code in interface/fax/fax_view.php that executes passthru("groups") and discloses the web server's Unix group memberships. Authenticated attackers with fax module access can supply a nonexistent jid value to reveal groups such as adm or shadow, aiding privilege escalation planning.
CVE-2026-126292 Medium 2026-11-13 Not applicable No public exploit NocoDB before 2026.06.1 contains an information disclosure vulnerability in the profile update handler in users.service.ts, which returns the stored user record without passing it through the user-serialization filter, exposing the bcrypt password hash, salt, and session token counter. Attackers holding a stolen or hijacked session can update the profile to retrieve that account's password hash and salt for offline cracking.
CVE-2026-126290 High 2026-11-13 Not applicable No public exploit NocoDB before 2026.07.0 contains an information disclosure vulnerability in base-integrations.service.ts that allows authenticated base members to read private integration configurations by omitting a query flag. Attackers can request another user's private integration without the configuration flag, bypassing the ownership check to obtain stored connection credentials.
CVE-2026-126288 Medium 2026-11-13 Not applicable No public exploit NocoDB before 2026.06.2 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve full OAuth client records by querying the public client lookup route in oauth.controller.ts. Attackers who know or guess a client identifier can obtain the registration access token to modify or delete registrations, plus the bcrypt client secret hash and owner's internal identifier.
CVE-2026-126266 High 2026-11-13 Not applicable No public exploit SiYuan from 3.6.0 before 3.8.9 contains an information disclosure vulnerability that allows unauthenticated publish visitors to bypass per-document passwords via regex search in getDoc. Attackers can send POST requests to /api/filetree/getDoc with queryMethod 3 and a broad regex to read protected body text returned in the unfiltered keywords field.
CVE-2026-126264 High 2026-11-13 Not applicable No public exploit SiYuan before 3.8.9 contains an information disclosure vulnerability that allows authenticated Reader users to retrieve credential-named widget files by bypassing the sensitive-path guard in getFile. Attackers can request paths like /data/widgets/<package>/credentials.json for publish-referenced widgets to obtain API keys, tokens, or other stored secrets.
CVE-2026-123965 Critical 2026-11-13 Not applicable No public exploit A prompt injection vulnerability in all versions of Jet Admin Cloud Platform allows a remote attacker with a free account to expose sensitive .env configuration files and exfiltrate critical credentials. Mitigated via sandbox component around October 29, 2026.
CVE-2026-123628 High 2026-11-13 Not applicable No public exploit IBM webMethods Integration Server 10.15 and 11.1 could allow a remote attacker to obtain sensitive information due to an exposure of sensitive server-side environment variables and Java runtime details.
CVE-2026-121518 Medium 2026-11-13 Not applicable No public exploit The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 5.127.0 via the 'search' parameter of the cr_show_more_all_reviews and cr_show_more_reviews AJAX actions. This is due to the handlers being hooked on wp_ajax_nopriv_* without a capability check (and, in the product-page handler, with a nonce check that is behind a filter defaulting to false) while passing the visitor-supplied search string straight into get_comments() as the 'search' argument, which core expands into LIKE conditions over comment_author, comment_author_email, comment_author_url, comment_author_IP and comment_content. This makes it possible for unauthenticated attackers to extract review author email addresses and IP addresses — fields WordPress and WooCommerce never expose to the public — one character at a time by observing whether the returned result set matches a probed substring.
CVE-2026-107525 Medium 2026-11-13 Not applicable No public exploit Dell PowerStore contains an information disclosure vulnerability. An unauthenticated attacker could exploit this vulnerability to obtain service metadata useful for further attacks.
CVE-2026-127046 Critical 2026-11-12 Not applicable No public exploit The MISP Modules website component contains an information disclosure vulnerability in the external tools management interface. The /external_tools/list endpoint returned stored API keys (the api_key field) in its JSON response via the ExternalTools model serializer. Additionally, the browser-based edit form pre-populated the API key input field with the stored credential value, exposing it in the DOM. The /external_tools/list endpoint is accessible without authentication (the regression tests verify the response for both authenticated and unauthenticated clients), meaning any network-reachable client could retrieve the API keys for all configured external tools. These keys are used by the server to authenticate submissions to external analysis or enrichment services, so their disclosure allows an attacker to impersonate the MISP instance or directly access those external services. The vulnerability also affected the edit workflow: the change_config endpoint previously required the API key to be present and non-empty on every save, forcing the key to round-trip through the client. The browser JavaScript stored the key in a reactive state object and updated the in-memory tool list with the credential value, further increasing the window of exposure in client-side memory and network traffic. Affected component: the website sub-application of MISP Modules, specifically the external_tools module (serializer in models.py, list endpoint, and the external_tools_index.html template). The impact is limited to confidentiality of the stored API keys; no integrity or availability impact on the MISP Modules website itself is indicated by the patch.
CVE-2026-126957 Medium 2026-11-12 Not applicable No public exploit An integer underflow in Zephyr's IPv4 option handling allows a remote, unauthenticated attacker to read stack memory. When replying to an ICMP Echo Request that carries an IPv4 Record Route or Timestamp option, icmpv4_update_record_route() and icmpv4_update_time_stamp() in subsys/net/ip/icmpv4.c compute the length of the already recorded data as ptr - ptr_offset in uint8_t arithmetic. The attacker-controlled Pointer field is checked against the option length but not against the RFC 791 minimum (4 for Record Route, 5 for Timestamp), so a smaller value wraps the length to up to 252 bytes. net_pkt_write() then reads past the 40-byte opt_data stack buffer and up to 213 bytes of stack memory, which can include stack and heap pointers, are returned in the ICMP Echo Reply. A single packet triggers the leak and the device does not crash, so it can be repeated. Devices built with CONFIG_NET_IPV4_HDR_OPTIONS, which CONFIG_NET_IPV4_IGMP selects, are affected.
CVE-2026-124653 Medium 2026-11-12 Not applicable No public exploit The Mine CloudVod WordPress plugin before 2.6.6 does not restrict who can request cloud storage upload credentials from several of its REST API routes, allowing unauthenticated attackers to obtain signed upload policies and temporary credentials for the site's configured Alibaba Cloud OSS, Tencent Cloud COS and Dogecloud accounts and use them to upload or overwrite files in the site's storage.
CVE-2026-120468 Medium 2026-11-12 Not applicable No public exploit Joomla Extension - acymailing.com - Unauthenticated disclosure of mailing list metadata in AcyMailing 1.0.0 - 11.1.1 - An unauthenticated attacker can retrieve every mailing list of the site, including lists that are not publicly visible and lists restricted to an access level, together with their descriptions, access levels, owning user account and subscriber counts. The WordPress plugin is not affected.
CVE-2026-118495 High 2026-11-12 Not applicable No public exploit Joomla / WordPress Extension - acymailing.com - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 - 11.1.1 - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 through 11.1.1. An unauthenticated attacker who knows a subscriber's email address can read that subscriber's record, including the per-subscriber secret key that authorises the subscription management links. Holding that key, the attacker can act as that subscriber on those endpoints, which includes triggering the GDPR data export and the GDPR account deletion where those options are enabled.
CVE-2026-117544 High 2026-11-12 Not applicable No public exploit Joomla Extension - jdownloads.com - IDOR allowing restricted file downloads in jDownloads < 4.1.8 - The `other_file_id` parameter could reference another download’s file without fully enforcing the target download’s access restrictions. This allowed files to be delivered to users who were not authorised to access the target download.
CVE-2026-57500 Medium 2026-11-11 Not applicable No public exploit REVA is an interoperability platform. Prior to versions 2.40.5 and 2.46.4, Reva exposes internal metadata folders in the spaces of an authenticated user. This can lead to unwanted ways of interaction with the data. This issue has been patched in versions 2.40.5 and 2.46.4.
CVE-2026-126920 Medium 2026-11-11 Not applicable No public exploit Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126882 Low 2026-11-11 Not applicable No public exploit Information leak in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126878 Medium 2026-11-11 Not applicable No public exploit Information leak in Core in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)
CVE-2026-126327 Unknown 2026-11-11 Not applicable No public exploit Improper access control in the connection history in Devolutions Server 2026.3.13.0 allows an authenticated user without the permission to view passwords to obtain historical entry passwords via the connection history API.
CVE-2026-126188 Low 2026-11-11 Not applicable No public exploit Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record objects. Prior to 8.0.5.2 and from 8.1 until 8.1.4.1, Active Storage's ActiveStorage::Previewer::VideoPreviewer, ActiveStorage::Analyzer::VideoAnalyzer, and ActiveStorage::Analyzer::AudioAnalyzer pass uploaded blob contents to FFmpeg without restricting the demuxer. A direct upload can retain a client-declared video/* or audio/* content type for an HLS playlist. FFmpeg content probing selects the hls demuxer, which opens attacker-named file:// segments when the blob is previewed or analyzed. Applications that accept untrusted uploads and generate video previews or analyze video or audio attachments can disclose a local media file readable by the application process when the attacker knows its path. This issue is fixed in versions 8.0.5.2 and 8.1.4.1.
CVE-2026-123829 Low 2026-11-11 Not applicable No public exploit A Permission Model bypass in Node.js recursive file watching discloses the names of files and directories the process is not permitted to read. On macOS and Windows, fs.watch() and fs.promises.watch() in recursive mode are backed by the native libuv watcher: FSEventWrap::Start checks kFileSystemRead only once, on the watched root, and FSEventWrap::OnEvent then forwards every filename libuv reports (relative paths at any depth) to the JavaScript callback without checking that each path is covered by the read grant. Code running under --permission with an exact read grant on a directory can therefore learn names such as sub/secret.txt even though readdir on that subdirectory is denied. The flaw exposes names and timing metadata, not file contents, and requires macOS or Windows plus files created under the watched directory by another actor. This vulnerability affects Node.js 26.x, 24.x, and 22.x.
CVE-2026-123705 Medium 2026-11-11 Not applicable No public exploit The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve a detailed report of the server, PHP and WordPress configuration, including installed Security For WooCommerce WordPress plugin through 1.0.16 and versions and the site administrator's email address.
CVE-2026-123704 Medium 2026-11-11 Not applicable No public exploit The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes, allowing unauthenticated users to retrieve the email address of every administrator on the site.
CVE-2026-122087 Low 2026-11-11 Not applicable No public exploit The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not restrict attendee data to events the requester is allowed to view, allowing unauthenticated users to retrieve the attendees of private and other non-public events.
CVE-2026-122061 Medium 2026-11-11 Not applicable No public exploit The Event Tickets and Registration WordPress plugin before 5.30.3.1 does not correctly check whether an event displays a public attendee list before returning one of its attendees over the REST API, allowing unauthenticated users to retrieve the names of attendees of events that do not show a public attendee list.
CVE-2026-119034 Medium 2026-11-11 Not applicable No public exploit The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not verify that a post is publicly viewable before returning its approved comments through the review feature, allowing unauthenticated attackers to read approved comments on private, draft and password-protected posts, and to retrieve approved comments site-wide.
CVE-2026-118418 Medium 2026-11-11 Not applicable No public exploit The WP Directory Kit WordPress plugin before 1.6.3 does not restrict which database models and columns its public directory-search action may return, nor verify authorisation on it, allowing unauthenticated attackers to read other users' personal data, including email addresses and logins, and private contact-form submissions.
CVE-2026-118409 Medium 2026-11-11 Not applicable No public exploit Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to recover the email addresses of people who left approved comments. The search index stored commenter email addresses, and the public weblog search accepted queries on that field, including wildcard queries that confirm an address one character at a time. Users are recommended to upgrade to Apache Roller 6.1.7 or later and rebuild the search index.
CVE-2026-118405 Medium 2026-11-11 Not applicable No public exploit Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows any logged-in user to learn other users' email addresses. The user search in the authoring interface shows only user names, but it also matched the search text against email addresses, so a user could confirm an address one character at a time. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which matches only user names for users who are not administrators.
CVE-2026-117524 Low 2026-11-11 Not applicable No public exploit The Dynific Addons for Elementor (formerly Anywhere Elementor) WordPress plugin before 1.3.1 does not perform a status or capability check when resolving post identifiers passed to one of its shortcodes, allowing authenticated users with at least the Contributor role to disclose the content of other users' draft, private and password-protected posts. An Author can republish that content to anonymous visitors.
CVE-2026-111597 Medium 2026-11-11 Not applicable No public exploit The Forminator Forms WordPress plugin before 1.58.4 does not verify that a Stripe Checkout payment has completed before returning a pending submission's after-payment response, allowing unauthenticated visitors to obtain the post-payment redirect URL and thank-you message of a payment-gated form without paying.
CVE-2026-111024 High 2026-11-11 Not applicable No public exploit A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through the repository files API: a Viewer could read files in folders they could not access, and an Editor could create, modify, move or delete provisioned dashboards and folders there (incorrect authorization).
CVE-2026-105152 Medium 2026-11-11 Not applicable No public exploit Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows a weblog administrator to read another user's stored password hash by authoring a custom weblog template that reaches the wrapped persistent object behind the template's weblog or entry data, rather than the reduced set of fields the wrapper is meant to expose. Roller treats weblog administrators as untrusted and exposes weblog and entry data to templates only through wrapper classes, but a public accessor on those wrapper classes returned the underlying persistent object directly, including the stored password hash of the weblog's creator and of any author whose entry renders on the page. No non-default configuration is required; this affects any weblog whose administrator can author templates. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which removes template access to the underlying wrapped objects.
CVE-2026-102589 High 2026-11-11 Not applicable No public exploit When independent Grafana instances share the same [rendering] renderer_token, an image renderer key issued by one instance is accepted by the others, so a user on one instance could act as the user with the same ID on another (origin validation error). This affects instances with the renderAuthJWT feature toggle enabled, the default from Grafana 13.0.0.
CVE-2026-0331 Medium 2026-11-11 Not applicable No public exploit An information disclosure vulnerability in Palo Alto Networks PAN-OS® software enables an unauthenticated remote attacker with network access to obtain sensitive firewall and session information by sending traffic to or through a dataplane interface. Panorama is not affected by this vulnerability.
CVE-2026-96769 Medium 2026-11-10 Not applicable No public exploit The Extend B2B - Companies and Users Management for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 via the register_company_api. This makes it possible for unauthenticated attackers to extract sensitive company data including owner and member WordPress user IDs, company billing email addresses, credit balances and full credit histories with admin user IDs, per-member purchase limits and spend totals, and shared-cart records containing purchase-order numbers.
CVE-2026-96156 Medium 2026-11-10 Not applicable No public exploit Use of uninitialized resource in Windows Broker Infrastructure Service allows an authorized attacker to disclose information locally.
CVE-2026-33563 Medium 2026-11-10 Not applicable No public exploit Exposure of sensitive information to an unauthorized actor for some Intel(R) Platform Monitoring Technology (Intel(R) PMT) software before version 3.2.0.22 within Ring 3: User Applications may allow an information disclosure. System software adversary with an authenticated user combined with a low complexity attack may enable data exposure. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (low), integrity (none) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
CVE-2026-126077 Medium 2026-11-10 Not applicable No public exploit Action Pack is a framework for handling and responding to web requests. Prior to 8.1.4.1 and 8.0.5.2, When ActionDispatch::Cookies reads a signed or encrypted cookie that was written under a rotated secret (config.action_dispatch.cookies_rotations) or in the format that a :hybrid cookie serializer migrates from, it writes the cookie back to the response in the current format, and that write ignores request.session_options[:skip]. ActiveStorage::DisableSession relies on that option to keep the session cookie off the public, immutable responses of the Active Storage proxy controllers, but those controllers still load the session, so a request carrying an old-format session cookie could receive the rewritten session cookie in Set-Cookie on a cacheable response. A shared cache that stores such a response together with its Set-Cookie header could then serve one user's session to later requesters of the same URL, or serve an attacker's session to other users. Applications are affected when they serve Active Storage files through the proxy controllers, have a cookie rotation or a :hybrid serializer migration configured, and run behind a cache that stores Set-Cookie on public responses. This is a path around the fix for CVE-2024-26144. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.
CVE-2026-125329 High 2026-11-10 Not applicable No public exploit Kaneo is a project management application with boards, Gantt charts, and GitHub integration that can be self-hosted or used as a cloud service. Prior to 2.13.0, GET /api/external-link/task/:taskId returns integration.config to any workspace member, including the viewer role, when a task has a linked Gitea issue or pull request. The plaintext integration.config contains the Gitea accessToken and webhookSecret, allowing the token's granted Gitea actions and forged webhook deliveries that pass HMAC verification. GitHub integrations and installations without a configured Gitea integration are not affected. This issue is fixed in version 2.13.0.
CVE-2026-124944 Medium 2026-11-10 Not applicable No public exploit Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
CVE-2026-124941 Medium 2026-11-10 Not applicable No public exploit Information disclosure in the Security: RLBox component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
CVE-2026-124930 Medium 2026-11-10 Not applicable No public exploit Information disclosure in the Address Bar component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
CVE-2026-124929 Medium 2026-11-10 Not applicable No public exploit Information disclosure in the Layout: Form Controls component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
CVE-2026-124925 Medium 2026-11-10 Not applicable No public exploit Information disclosure in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160.
CVE-2026-124909 Medium 2026-11-10 Not applicable No public exploit Information disclosure in the Private Browsing component. This vulnerability was fixed in Firefox 160, Firefox ESR 153.7, Thunderbird 160, and Thunderbird 153.7.
CVE-2026-119273 Medium 2026-11-10 Not applicable No public exploit The BulletProof Security WordPress plugin through 7.2 does not sufficiently protect its security log files or prevent sensitive authentication material from being written to them, relying on access controls that are not enforced under all common web-server configurations, allowing unauthenticated attackers to read logged request data on affected deployments.
CVE-2026-109460 Medium 2026-11-10 Not applicable No public exploit Exposure of sensitive information to an unauthorized actor in Microsoft Entra Private Network Connector allows an authorized attacker to disclose information locally.
CVE-2026-95779 High 2026-11-09 Not applicable No public exploit An exposure of the appliance’s confidential certificate information  vulnerability exists in HPE Morpheus manager software.
CVE-2026-63644 High 2026-11-09 Not applicable No public exploit bird-lg-go is a BIRD looking glass in Go. Prior to version 1.4.7, unsanitized input path enables arbitrary local file read, allowing an unauthenticated remote attacker to read sensitive files such as /etc/shadow and /root/.bash_history. This issue has been patched in version 1.4.7.
CVE-2026-124834 Medium 2026-11-09 Not applicable No public exploit A security vulnerability has been detected in iomad up to 4.5.15/5.0.11/5.1.8/5.2.4. Affected by this issue is the function store_temporary_password of the file public/local/iomad/classes/company_user.php of the component Password Field Handler. Such manipulation leads to information disclosure. The attack may be performed from remote. The attack requires a high level of complexity. The exploitation is known to be difficult. The name of the patch is 0d9c0ccaa8a77583f5dd92eb7be7fbbb8cc6ec9b/9c740fd254fd12d56d7be3b85ac5e9fb4f8c03d8/33755cdd551a84be423b1eaf784d405c1988dbad/7fcf9b52c539a67f3e46a8da6b42ab1d1f26295b. It is advisable to implement a patch to correct this issue. This CVE was requested by the vendor.
CVE-2026-124587 Low 2026-11-09 Not applicable Proof of concept only A vulnerability was identified in elizaOS eliza 2.0.3-beta.7. The affected element is an unknown function of the file packages/app/platforms/electrobun/src/lifecycle/api-base-owner.ts of the component HTTP Server. Such manipulation leads to information disclosure. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The name of the patch is cf6fa193017e70884e01c5bb7890f74b6b2b79d2. A patch should be applied to remediate this issue.
CVE-2026-123808 Medium 2026-11-09 Not applicable No public exploit Nuxt UI is an intuitive Vue UI library powered by Reka UI and Tailwind CSS. Prior to 4.8.1, the server-rendered form element produced by UForm in src/runtime/components/Form.vue omits the method and action attributes and relies solely on the hydrated @submit.prevent handler to stop native submission. UAuthForm composes UForm and can render named credential fields, including an input with type password, inside the same markup. If a user submits before Vue hydration completes, or when the client bundle is blocked or unavailable, the browser performs its default GET submission and serializes the named fields into the current URL query string. The credentials can then appear in the address bar, browser history, reverse-proxy, CDN, or WAF request logs, and Referer headers sent with same-origin subresource requests. This issue is fixed in version 4.8.1.
CVE-2026-123796 Low 2026-11-09 Not applicable No public exploit compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.32.0 until 0.33.0, compose-lint's incomplete remediation for .env secret disclosure checks the 20,000-finding limit before replacing resolved values with their variable references. A pull request can combine a secret-referencing image field with aliased content that produces more than 20,000 findings, causing the early-stop path to emit already graded findings with the resolved secret value in text, JSON, SARIF, and Code Scanning output. Exploitation requires a workflow that writes secrets into the sibling .env and lints untrusted changes, and the run exits 2 unless --allow-partial-coverage is used. This issue is fixed in version 0.33.0.
CVE-2026-123372 Low 2026-11-09 Not applicable Proof of concept only compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. From 0.22.0 until 0.32.0, compose-lint substitutes values from a sibling .env file into image fields and quotes the resolved value in CL-0004 and CL-0019 finding messages and fix text. In a workflow that writes secrets into that file and then lints untrusted pull-request content, an attacker can reference a secret variable so its whole value reaches the job log, JSON output, SARIF artifacts, and Code Scanning alerts. Fork pull requests normally lack secrets, so exploitation requires a secret-bearing workflow such as pull_request_target, same-repository branches, or a retained .env on a self-hosted runner, and the pass or fail result is unchanged. This issue is fixed in version 0.32.0.
CVE-2026-123145 Medium 2026-11-09 Not applicable No public exploit The WooCommerce Stripe Payment Gateway WordPress plugin before 11.1.0 does not exclude the account password from the checkout fields it saves to order metadata during express checkout, causing the password a customer chooses when creating an account at checkout to be stored in plaintext in the database, readable by anyone with access to order data or the database. Version 10.9.0 stored the passwords. Version 10.9.1 stopped new ones from being stored but left existing ones in place, and version 11.1.0 removes them on update. Passwords stored this way should be considered exposed.
CVE-2026-123088 Medium 2026-11-09 Not applicable No public exploit The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not perform any authorization check before returning an order's order-received URL for an attacker-supplied order id, exposing the order's secret key in the redirect and allowing unauthenticated attackers to enumerate orders and disclose customers' personal data (name, email address, phone number and address).
CVE-2026-120409 Medium 2026-11-09 Not applicable No public exploit The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is password protected before serving it through its standalone player page and its download link, allowing unauthenticated visitors to obtain the media source of password-protected videos, such as unlisted YouTube or Vimeo links and external file URLs.
CVE-2026-115256 High 2026-11-09 Not applicable No public exploit The Mail Debug for WooCommerce WordPress plugin through 1.3.0 does not perform any capability, authentication, or nonce check on one of its email-logging actions, which is exposed to unauthenticated users and is not restricted to its own data, allowing anyone to read the full body of every email the site has sent, including password-reset emails whose reset key lets an attacker take over an administrator account.
CVE-2026-111454 Medium 2026-11-09 Not applicable No public exploit Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset without checking whether the caller may read those Dags. An authenticated user with asset read access could learn the IDs of Dags they are not authorized to see. Users are advised to upgrade to apache-airflow 3.4.0 or later. Airflow 2.x is also affected; Airflow 2 has reached end of life and will not receive a fix, so Airflow 2 users should upgrade to Apache Airflow 3.4.0 or later.
CVE-2026-97194 Low 2026-11-08 Not applicable No public exploit The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts.
CVE-2026-8642 Medium 2026-11-08 Not applicable No public exploit IBM Security Verify Directory 10.0.0 through 10.0.4 and IBM Verify Directory 11.0.0 exposes debug endpoints that disclose system information including server versions and session identifiers. This information can be used to identify vulnerable software versions.
CVE-2026-124443 Medium 2026-11-08 Not applicable No public exploit Frappe Framework before 15.121.1 and 16.x before 16.35.0 contains a broken access control vulnerability in File list and report queries that fails to restrict private file records to authorized users. Authenticated users can query File list or report views to obtain metadata of private files they are not permitted to access.
CVE-2026-124438 Critical 2026-11-08 Not applicable Proof of concept only Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template authors to access .NET internals of function values through reflection member accessors. Attackers can use array.map to read Target, Method, or ReturnType on imported delegates, exposing and overwriting service properties, captured closure secrets, and assembly paths.
CVE-2026-124434 High 2026-11-08 Not applicable No public exploit Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x calls any medium method named in image, thumb or thumb_options shortcode values without core's allowed media action check. A page editor can chain addMetaFile with value, toYaml or toJson to read server-readable YAML files, such as account password hashes, 2FA secrets and API keys, into a publicly viewable page.
CVE-2026-123504 Medium 2026-11-08 Not applicable No public exploit Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members to view full webhook target URLs by listing project webhooks. Attackers can extract incoming-webhook tokens or API keys embedded in target_url values to post to receiving channels or reuse keys until rotated.
CVE-2026-122062 Medium 2026-11-08 Not applicable No public exploit The Pronamic Pay WordPress plugin before 11.1.0, Pronamic Pay doneren met Mollie WordPress plugin before 1.7.1 do not restrict access to stored form submissions through the REST API, allowing unauthenticated users to read the messages that visitors submitted through the bundled forms.
CVE-2026-122060 Medium 2026-11-08 Not applicable No public exploit The WP Recipe Maker WordPress plugin before 10.9.2 does not check whether the post a recipe is embedded in is password protected before returning the recipe through its REST API and structured data output, allowing unauthenticated users to read the full content of recipes in password-protected posts.
CVE-2026-108284 Medium 2026-11-08 No exploit published No public exploit IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader role to obtain sensitive information.
CVE-2026-104337 Medium 2026-11-08 Not applicable No public exploit The Razorpay for WooCommerce WordPress plugin before 4.8.9 does not verify ownership of an order before returning a coupon discount computed against that order, allowing unauthenticated attackers to disclose the monetary value of arbitrary customer orders by enumerating order IDs.
CVE-2026-103320 Medium 2026-11-08 No exploit published No public exploit IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.10 could allow an authenticated user with the Reader role to obtain sensitive information.
CVE-2026-97189 Low 2026-11-07 Not applicable No public exploit The Advanced Custom Fields (ACF®) WordPress plugin before 6.8.11 does not perform a read-permission check when it renders and formats the values of its relational fields, allowing users with post-editing access (Contributor and above) to disclose the titles and non-public statuses of other users' unpublished posts.
CVE-2026-93370 Medium 2026-11-07 Not applicable No public exploit The Paystack WooCommerce Payment Gateway plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.8.5 via the 'key' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including billing name, email address, phone number, billing address, shipping address, and purchased product list — embedded into page HTML via wp_localize_script by enumerating sequential order IDs. This is only exploitable when the merchant has enabled the optional custom metadata feature in the Paystack gateway settings.
CVE-2026-17231 Medium 2026-11-07 Not applicable No public exploit IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to obtain sensitive information due to an observable response discrepancy.
CVE-2026-17144 Medium 2026-11-07 Not applicable No public exploit IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation.
CVE-2026-121380 Medium 2026-11-07 Not applicable No public exploit The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the email addresses of people invited to join teams.
CVE-2026-120520 Medium 2026-11-07 Not applicable No public exploit The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 13.2.2 via the 'img (or any key the publisher references in {{GET:key}})' parameter. This makes it possible for unauthenticated attackers to extract authenticated users' HttpOnly WordPress session cookies, specifically wordpress_logged_in_* tokens, by injecting a nested {{COOKIE:}} placeholder via a GET parameter that causes the victim's browser to transmit the cookie value to an attacker-controlled host as an image src URL. Exploitation requires that a site publisher has configured a public GreenShift Element image block whose src attribute contains a {{GET:}} placeholder, and that a logged-in user can be induced to open the attacker's crafted link — neither condition is part of the plugin's default state.
CVE-2026-118801 Medium 2026-11-07 Not applicable No public exploit The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.18.0 via the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract the full rendered body content of any password-protected post of any post type by embedding the shortcode with the target post's ID. Author-level attackers and above can additionally publish a post embedding the shortcode, exposing the password-protected content to unauthenticated visitors.
CVE-2026-66984 Low 2026-11-06 Not applicable No public exploit HCL AION is affected by a vulnerability where certain application responses revealed internal server file system paths. This information could help an attacker understand the application structure and plan further attacks, potentially resulting in unintended behavior or security impact under certain conditions.
CVE-2026-62856 High 2026-11-06 Not applicable Exploited FreeScout is a self-hosted help desk and shared mailbox application. Prior to version 1.8.226, the  polycast/receive  endpoint fails to escape SQL LIKE wildcards in supplied channel names, while channel authorization applies only to names with specific prefixes. An unauthenticated attacker with a guest session and valid CSRF token can submit a wildcard channel name to retrieve matching notification events intended for other users. Notification payload generation lacks a corresponding access check, exposing conversation message content, identifiers, URLs, and notification HTML across users and mailboxes. This issue is fixed in version 1.8.226.
CVE-2026-62852 Medium 2026-11-06 Not applicable Proof of concept only FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226, RealtimeConvNewThread checks only general mailbox access and does not apply the conversation-level restriction for users configured to see only assigned conversations. A restricted authenticated user can subscribe to predictable conv.<conversation_id> Polycast channels for other conversations in the same mailbox. New event payloads can expose complete replies, internal notes, recipient addresses, conversation state, assignee data, attachment names, and attachment URLs containing valid download tokens. This issue is fixed in version 1.8.226.
CVE-2026-62851 Medium 2026-11-06 Not applicable No public exploit FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.226, the search-by-number shortcut in ConversationsController::search() resolves a user-controlled ticket number without applying the mailbox filter or view policy used by the normal search path. An authenticated non-admin agent who is a member of at least one mailbox can request /search with a hash-prefixed ticket number and use the 302 Location header to confirm that a conversation exists in a different mailbox the agent cannot access and learn its internal conversation and folder identifiers. The destination conversation remains protected, so this issue does not disclose message content, attachments, or customer data. This issue is fixed in version 1.8.226.
CVE-2026-35115 Low 2026-11-06 Not applicable No public exploit HCL AION is affected by a vulnerability where the HTTP Strict-Transport-Security (HSTS) header was missing or insecurely configured, so browsers were not instructed to always use HTTPS. This may allow connections to be downgraded or intercepted, potentially resulting in unintended behavior or security impact under certain conditions.
CVE-2026-35114 Low 2026-11-06 Not applicable No public exploit HCL AION is affected by a vulnerability where the X-Content-Type-Options header was missing or insecure, allowing browsers to MIME-sniff responses. This may cause content to be interpreted as an unintended type, potentially resulting in unintended behavior or security impact under certain conditions.
CVE-2026-35113 Medium 2026-11-06 Not applicable No public exploit HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy (COOP) header was missing or insecure, allowing cross-origin documents to share a browsing context with the application. This may enable cross-window attacks, potentially resulting in unintended behavior or security impact under certain conditions.
CVE-2026-35112 Medium 2026-11-06 Not applicable No public exploit HCL AION is affected by a vulnerability where the Cross-Origin-Embedder-Policy (COEP) header was missing or insecure, so embedded cross-origin resources were not required to explicitly grant permission. This weakens cross-origin isolation, potentially resulting in unintended behavior or security impact under certain conditions.
CVE-2026-35111 Medium 2026-11-06 Not applicable No public exploit HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy (CORP) header was missing or insecure, allowing application resources to be loaded by other origins. This may expose resources to cross-origin data leakage, potentially resulting in unintended behavior or security impact under certain conditions.
‹ prev page 1 of 121 next ›