Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,798

CVE-2024-41786

IBM Engineering Requirements Management DOORS Next for J2EE File Disclosure Rule

IBM Engineering Requirements Management DOORS Next 7.1, and 7.2 could allow a remote attacker to force the Web server to return contents of a sensitive requested file due to improper input validation.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibm
Products
Engineering Requirements Management Doors Next
CVE-2026-124492

SunEditor before 3.4.0 Stored XSS via Link Modal Bookmark List

SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in ModalAnchorEditor's #createBookmarkList, which inserts entity-decoded h1-h6 header textContent into the bookmark list via innerHTML without escaping. Attackers can store HTML-encoded payloads in editor headers that execute JavaScript when a victim opens the link modal and types # in the URL input.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed
Vendors
Jihong88
Products
Suneditor
CVE-2026-124474

MRBS before 1.12.3 Reflected XSS via error parameter of view_entry.php

MRBS (Meeting Room Booking System) before 1.12.3 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script via the error parameter of view_entry.php. Attackers can send crafted links to logged-in users to read CSRF tokens, modify or delete bookings, or perform administrative actions.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Meeting-room-booking-system
Products
Mrbs-code
CVE-2026-124426

Craft CMS before 5.11.2 GraphQL Sites Scope Bypass via localized Field

Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows unauthenticated attackers to read content from sites outside a GraphQL schema's Sites scope. Attackers can send a POST request to /actions/graphql/api selecting the localized field without the siteId argument to disclose out-of-scope site content.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Craftcms
Products
Cms Craft Cms
CVE-2026-124427

Craft CMS 5.0.0 before 5.11.2 GraphQL Schema Scope Bypass via prev/next

Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows anonymous GraphQL clients to read out-of-scope section entries via prev/next fields. Attackers can chain next hops from one visible in-scope entry to enumerate entries and read titles, slugs, and custom-field content from withheld sections.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Craftcms
Products
Cms Craft Cms
CVE-2026-124437

Scriban before 7.5.3 Denial of Service via Unguarded Builtins and Recursion

Scriban before 7.5.3 contains a resource exhaustion vulnerability that allows untrusted template authors to exhaust memory and CPU because builtins like math.format, regex.replace and string.escape skip the LimitToString allocation guard. Attackers can submit small templates using huge format precision specifiers, shared-structure array comparison, BigInteger multiplication or exponential function recursion that ignore LoopLimit and CancellationToken, crashing or stalling multi-tenant hosts.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Scriban
Products
Scriban
CVE-2026-124438

Scriban before 7.5.2 Delegate Target Exposure via array.map Member Access

Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template authors to access .NET internals of function values through reflection member accessors. Attackers can use array.map to read Target, Method, or ReturnType on imported delegates, exposing and overwriting service properties, captured closure secrets, and assembly paths.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Scriban
Products
Scriban
CVE-2026-124551

ClassroomIO through 1.0.0 Cross-Organization Course Disclosure via Clone Endpoint

ClassroomIO through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users of any organization to clone other tenants' courses via the POST /course/:courseId/clone endpoint. Attackers who know a target course id can copy its sections, lessons, exercises, and quiz answer keys into their own organization, exposing private course content.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Classroomio
Products
Classroomio
CVE-2026-124331

Jinher OA ProjectAfficheManage.aspx sql injection

A vulnerability was identified in Jinher OA C6. This impacts an unknown function of the file /C6/JHSoft.Web.Project/OfficeReadOnly/ProjectAfficheManage.aspx. Such manipulation of the argument ProjID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Jinher
Products
Oa
CVE-2026-124489

OpenEMR before 8.3.0 Broken Access Control via portal_payment.php

OpenEMR before 8.3.0 contains a broken access control vulnerability in portal/portal_payment.php that allows low-privilege authenticated users to bypass billing ACL checks by tampering patient identifiers. Attackers can modify the pid and form_pid parameters to view payment pages and record fraudulent payment receipts for arbitrary patients, corrupting billing records.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-124488

OpenEMR before 8.3.0 Authorization Bypass via load_form.php High-Sensitivity Encounters

OpenEMR before 8.3.0 contains an authorization bypass vulnerability that allows authenticated clinicians lacking high-sensitivity permission to read and modify encounter-bound forms via load_form.php. Attackers can request the Clinical Notes or Care Plan direct loader to obtain restricted content and a CSRF token, then submit save.php to tamper with clinical records.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-124485

OpenEMR before 8.3.0 Cross-Patient Document Disclosure via Onsite Documents API

OpenEMR before 8.3.0 contains an authorization bypass vulnerability in the patient portal onsitedocuments API that allows authenticated patients to read other patients' documents by overriding query criteria. Attackers can send empty pid_Equals and denialReason_IsNotLike parameters to remove patient scoping and locked filters, exposing consent bodies, signatures, file paths, and template data.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-124484

OpenEMR before 8.4.0 Missing Authorization in Portal Onsite-Document APIs

OpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any authenticated core user to access cross-patient documents. Attackers can omit the patientId parameter and supply arbitrary record IDs to list, read, and overwrite other patients' portal documents, signatures, and template data.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-124481

OpenEMR before 8.4.0 Cross-Patient Payment Tampering via Rainforest Portal Payments

OpenEMR before 8.4.0 contains an improper authorization vulnerability in Rainforest patient portal payments that trusts browser-supplied patientId, encounter, and amount values instead of deriving them from the portal session. Authenticated portal patients can tamper with JSON sent to portal_payment.rainforest.php so the payin.authorized webhook writes forged ar_activity credits to other patients' encounters exceeding the amount actually paid.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-124480

OpenEMR before 8.4.0 Authorization Bypass via FHIR QuestionnaireResponse APICSRFTOKEN

OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read cross-patient FHIR QuestionnaireResponse data by sending the APICSRFTOKEN header. Attackers can reuse the session-exposed api_csrf_token_js value to skip FHIR scope checks and call GET /fhir/QuestionnaireResponse, exfiltrating site-wide questionnaire answer PHI.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-124477

OpenEMR before 8.3.0 Missing Authorization via delete_Recall in save.php

OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete arbitrary patient recall records via the delete_Recall action. Attackers can send POST requests to /interface/main/messages/save.php with a target pid and r_ID to remove recall data without ACL or ownership checks.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-124476

OpenEMR before 8.3.0 IDOR via form_pid in portal/lib/paylib.php

OpenEMR before 8.3.0 contains an insecure direct object reference in portal/lib/paylib.php, which writes the request-supplied form_pid (or the patient_id_cc value in Sphere data) to onsite_portal_activity without checking it against the session patient. Authenticated portal patients can submit portal-save, review-save, AuthorizeNet, Stripe, or Sphere requests to insert or modify forged payment-audit records in other patients' billing records.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-124472

OpenEMR before 8.3.0 Missing Authorization via sl_eob_patient_note.php

OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_patient_note.php that allows any authenticated user to read and modify patient billing notes. Attackers with low-privilege accounts can enumerate the patient_id parameter and submit POST requests using the embedded CSRF token to view or tamper with confidential billing data.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-124471

OpenEMR before 8.3.0 Missing Authorization and IDOR via sl_eob_invoice.php

OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_invoice.php that allows any authenticated user to read and modify billing data for any encounter. Attackers can iterate the id parameter to read patient names and billing notes, and post payments, adjustments, deletions, or billing notes against any patient's account.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr
CVE-2026-124468

OpenEMR before 8.3.0 SQL Injection via Patient Insurance and Employer REST API

OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Standard REST API patient insurance and employer search, which concatenates query-string parameter names into SQL as column identifiers without escaping. Authenticated clients, including low-privilege patient-portal OAuth2 tokens, can send crafted parameter names to /api/patient/{puuid}/insurance or /api/patient/{puuid}/employer to extract patient PHI, user records, and API client secrets.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Open-emr
Products
Openemr