Export limit exceeded: 26155 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (421604 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-118458 | 1 Compugroup Medical | 2 Phronesis, Venere | 2026-11-09 | N/A |
| The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application codes, accepting fixed administrator accounts. | ||||
| CVE-2026-76235 | 1 Redhat | 4 Enterprise Linux, Openshift Dev Spaces, Openshift Devspaces and 1 more | 2026-11-09 | 7.5 High |
| A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service. | ||||
| CVE-2026-118459 | 1 Compugroup Medical | 4 Infantia, Phronesis, Profim and 1 more | 2026-11-09 | N/A |
| A time-derived emergency password can be derived from publicly available application code, enabling authentication without legitimate credentials. | ||||
| CVE-2026-118460 | 1 Compugroup Medical | 4 Infantia, Phronesis, Profim and 1 more | 2026-11-09 | N/A |
| Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary practitioner identifiers, enabling unauthorized practitioner token requests. | ||||
| CVE-2026-118461 | 1 Compugroup Medical | 4 Infantia, Phronesis, Profim and 1 more | 2026-11-09 | N/A |
| The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring authentication or authorization credentials. | ||||
| CVE-2026-118462 | 1 Compugroup Medical | 4 Infantia, Phronesis, Profim and 1 more | 2026-11-09 | N/A |
| Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths also permit archive traversal or script execution. | ||||
| CVE-2026-118464 | 1 Compugroup Medical | 4 Infantia, Phronesis, Profim and 1 more | 2026-11-09 | N/A |
| Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible transformations to protect credentials, IPC data, configuration values, and clinical fields. | ||||
| CVE-2026-118465 | 1 Compugroup Medical | 4 Infantia, Phronesis, Profim and 1 more | 2026-11-09 | N/A |
| Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are identical across installations. | ||||
| CVE-2026-118467 | 1 Compugroup Medical | 4 Infantia, Phronesis, Profim and 1 more | 2026-11-09 | N/A |
| Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and low-entropy identifiers without adequate pseudonymization or protection. | ||||
| CVE-2026-118468 | 1 Compugroup Medical | 4 Infantia, Phronesis, Profim and 1 more | 2026-11-09 | N/A |
| XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled, potentially allowing XML External Entity (XXE) attacks. | ||||
| CVE-2026-118790 | 1 Compugroup Medical | 1 Wingesfar | 2026-11-09 | N/A |
| Multiple hardcoded credentials are embedded within product components and administrative functionalities. These credentials may enable unauthorized access to privileged accounts, services, or application features across affected deployments. | ||||
| CVE-2026-118791 | 1 Compugroup Medical | 1 Wingesfar | 2026-11-09 | N/A |
| The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient cryptographic verification. | ||||
| CVE-2026-118792 | 1 Compugroup Medical | 1 Wingesfar | 2026-11-09 | N/A |
| Default credentials permit access through AcuXDBC. | ||||
| CVE-2026-118795 | 1 Compugroup Medical | 3 Infantia, Profim, Venere | 2026-11-09 | N/A |
| Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation for attackers with database write access. | ||||
| CVE-2026-118798 | 1 Compugroup Medical | 1 Wingesfar | 2026-11-09 | N/A |
| Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and authentication artifacts, are exposed through application logs and persistent client-side storage, enabling unauthorized access and session compromise. | ||||
| CVE-2026-95648 | 1 C-prot | 1 Appdefense | 2026-11-09 | 8.1 High |
| Improperly controlled modification of Dynamically-Determined object attributes vulnerability in C-Prot Inc. C-Prot AppDefense allows Privilege Escalation. This issue affects C-Prot AppDefense: before 1.0.2729. | ||||
| CVE-2026-16283 | 1 Osbil Technology | 1 Opanel | 2026-11-09 | 8.8 High |
| Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Osbil Technology Ltd.Osbil Technology Ltd. OPanel allows OS Command Injection. This issue affects oPanel: before 1.20.66. | ||||
| CVE-2026-95779 | 1 Hpe | 1 Morpheus Software | 2026-11-09 | 8.8 High |
| An exposure of the appliance’s confidential certificate information vulnerability exists in HPE Morpheus manager software. | ||||
| CVE-2026-19552 | 2 Python, Python Software Foundation | 2 Cpython, Cpython | 2026-11-09 | N/A |
| When ca_certs parameter was supplied to ssl.get_server_certificate() function, the identity of the certificate is not checked. | ||||
| CVE-2026-124249 | 2 Python, Python Software Foundation | 2 Cpython, Cpython | 2026-11-09 | N/A |
| http.cookiejar.CookieJar deleted a stored cookie when a response carried an already expired Set-Cookie header for it, using the Domain and Path attributes from the header without consulting the cookie policy. A server could therefore delete cookies belonging to other domains from a shared cookie jar, such as the one used by urllib's HTTPCookieProcessor. The fix consults the cookie policy before an expired cookie may delete an existing one, as required by RFC 6265 section 5.3. | ||||