Export limit exceeded: 423702 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 423702 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (423702 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-104139 | 2 Open-emr, Openemr | 2 Openemr, Openemr | 2026-11-10 | 6.5 Medium |
| OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, library/ajax/set_pt.php allows any authenticated user to set an arbitrary patient identifier in the active session without an ACL check, and interface/patient_file/download_template.php trusts that session value while enforcing only CSRF validation. A low-privilege user can select another patient and download a rendered document template containing the patient's demographics, encounter information, allergies, medications, and problem list despite lacking patients/docs access. This issue is fixed in version 8.3.0. | ||||
| CVE-2026-104138 | 2 Open-emr, Openemr | 2 Openemr, Openemr | 2026-11-10 | 6.5 Medium |
| OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, custom/ajax_download.php, custom/download_qrda.php, custom/export_qrda_xml.php, and custom/qrda_download.php validate CSRF but do not enforce the patients/med ACL used by the canonical CQM report page. The endpoints also accept an unscoped report_id, allowing a low-privilege authenticated user to reach report generation and download logic for other reports. In a clinic with generated CQM reports, this can expose QRDA Category One and Category Three clinical documents for patients in a measure. This issue is fixed in version 8.3.0. | ||||
| CVE-2026-104137 | 2 Open-emr, Openemr | 2 Openemr, Openemr | 2026-11-10 | 6.5 Medium |
| OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, the sms_search branch of interface/main/messages/save.php requires an authenticated session but does not enforce patient or feature-level ACLs. A low-privilege user who cannot access patient data through the normal interface can search the MedEx SMS endpoint and receive patient identifiers, names, phone numbers, SMS permission status, and recent message information. This issue is fixed in version 8.3.0. | ||||
| CVE-2026-40273 | 2026-11-10 | 4 Medium | ||
| Improper Input Validation in a procnto message handler could allow an attacker with local access to send a crafted message which can cause an information disclosure in the QNX Neutrino kernel | ||||
| CVE-2026-40274 | 2026-11-10 | 4 Medium | ||
| Invalid Pointer Reference in the TimerSettime() system call could allow an attacker with local access to arm a crafted timer event which can cause an information disclosure in the QNX Neutrino kernel. | ||||
| CVE-2026-49142 | 2 Open-emr, Openemr | 2 Openemr, Openemr | 2026-11-10 | 8.8 High |
| OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that allows users with Clinician-level privileges to read and modify arbitrary database contents by submitting crafted values in the form_icd_codes[] POST parameter to the syndromicsurveillance/index endpoint. Attackers can inject an unquoted numeric IN() clause and UNION DISTINCT SELECT statement using hex-encoded literals to abuse MySQL extractvalue() for error-based exfiltration of bcrypt password hashes and execute stacked queries that reset passwords, resulting in full administrative account takeover. | ||||
| CVE-2026-17493 | 1 Ibm | 1 Watson Speech Services Cartridge | 2026-11-10 | 7.5 High |
| IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to cause a denial of service due to an out-of-bounds read. | ||||
| CVE-2026-126136 | 2026-11-10 | N/A | ||
| For Exchange accounts using EWS or Microsoft Graph with OAuth2 authentication, Thunderbird sent the OAuth2 access token to the server even when the configured server URL used unencrypted HTTP. An attacker able to observe network traffic could obtain the token and use it to access the user's mailbox until the token expired. An attacker positioned on the network during account setup could cause such a URL to be configured. This vulnerability was fixed in Thunderbird 160. | ||||
| CVE-2026-126135 | 2026-11-10 | N/A | ||
| If an attacker was able to perform a man-in-the-middle attack on an SMTP or POP3 server connection using STARTTLS, the attacker could inject server responses before the TLS handshake completed. Thunderbird would process these responses after the handshake, as if they had been received from the server over the encrypted connection. This could be used to make Thunderbird report a different outcome for sending or fetching mail, and to show attacker-controlled text in error messages. The encrypted connection itself was not compromised, and credentials were not exposed. Connections using SSL/TLS instead of STARTTLS were not affected. This vulnerability was fixed in Thunderbird 160. | ||||
| CVE-2026-126134 | 2026-11-10 | N/A | ||
| Thunderbird allowed feed subscriptions to file: URLs that point to a network share. If a user was tricked into subscribing to such a URL, Thunderbird connected to the attacker's server when fetching the feed. Windows then sent the user's NTLM credentials to that server. This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 160. | ||||
| CVE-2026-126133 | 2026-11-10 | N/A | ||
| When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication, Thunderbird could answer the proxy with the calendar server's username and password. This affected both setting up a new calendar and syncing existing calendars, where a saved password could be sent without any user interaction. A malicious or compromised proxy could use this to obtain the calendar credentials, even for calendars served over HTTPS. This vulnerability was fixed in Thunderbird 160. | ||||
| CVE-2026-126132 | 2026-11-10 | N/A | ||
| When a message was forwarded inline, edited as new, or had an attachment dragged into a compose window, a specially crafted link attachment (a .desktop file on Linux, or a .url or .lnk file on Windows) was replaced with the content of the file or URL it pointed to when the message was saved or sent. This could disclose local files, or content from the user's network, to the message recipients or to the mail provider. This bug only affects Thunderbird on Linux and Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 160. | ||||
| CVE-2026-120572 | 1 Mozilla | 1 Firefox | 2026-11-10 | 8.8 High |
| Incorrect boundary conditions in the Layout: Block and Inline component. This vulnerability was fixed in Firefox 159.0.1 and Thunderbird 160. | ||||
| CVE-2026-124950 | 2026-11-10 | N/A | ||
| Same-origin policy bypass in the CSS Parsing and Computation component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. | ||||
| CVE-2026-124949 | 2026-11-10 | N/A | ||
| Other issue in the SVG component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. | ||||
| CVE-2026-124947 | 2026-11-10 | 8.8 High | ||
| Incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. | ||||
| CVE-2026-124946 | 2026-11-10 | N/A | ||
| Invalid pointer in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. | ||||
| CVE-2026-124945 | 2026-11-10 | N/A | ||
| Invalid pointer in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. | ||||
| CVE-2026-124944 | 2026-11-10 | 4.3 Medium | ||
| Information disclosure in the Marionette component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. | ||||
| CVE-2026-124943 | 2026-11-10 | 8.8 High | ||
| Use-after-free in the Layout component. This vulnerability was fixed in Firefox 160 and Thunderbird 160. | ||||