CVE-2026-18093
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to broken access cont
CVSS
7.5
High
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Nov 8, 2026 · Last modified: Nov 8, 2026 · CWE-863
Not enough EPSS history yet.
IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to broken access control.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1245024.3 MED—
———A security vulnerability has been detected in yungifez Skuul School Management System up to 2.6.3. Affected by this vulnerability is the function GraduationController::resetGraduation of the file app/Http/Controllers/GraduationController.php of the component Delete Handler. Such manipulation of the argument student leads to missing authorization. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 3.0.0 addresses this issue. The name of the patch is b42f2c80a8e5e01ca6e607bbd97f137ede368ac9. The affected component should be upgraded.5hCVE-2026-144695.4 MED—
——0IBM Storage Scale 5.2.3.0 through 5.2.3.9 and 6.0.1.0 could allow an authenticated attacker to access and manipulate filesets beyond their control due to improper authorization.11hCVE-2026-1244876.5 MED—
——0OpenEMR before 8.4.0 contains an improper authorization vulnerability in the non-patient POST /fhir/DocumentReference/$docref route that allows low-privileged users to generate any patient's CCDA. Attackers with only demographics and documents permissions can supply a victim patient parameter, then download the full-chart CCDA from Patient Documents to exfiltrate clinical data.15hCVE-2026-1244838.3 HIG—
——0OpenEMR before 8.4.0 contains an incorrect authorization vulnerability because the prescription REST API routes check the patients.med ACL instead of patients.rx and request no specific permission bit, so read-only Medical/History access passes the check. Authenticated staff users can reuse the UI-exposed APICSRFTOKEN to enumerate prescription UUIDs, forge prescriptions for arbitrary patients, and deactivate existing prescriptions tenant-wide.15hCVE-2026-1244418.8 HIG—
——0Kyverno before 1.19.2 contains an authorization bypass vulnerability that allows namespaced tenants to generate any resource kind in any namespace by templating the generate rule's kind and namespace with variables. Attackers can create a Policy and trigger ConfigMap in their own namespace, causing the privileged background-controller to write NetworkPolicies or RoleBindings into victim or kube-system namespaces.15hCVE-2026-1244368.0 HIG—
——0OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows realm administrators to access and modify global resources by calling admin endpoints lacking super administrator checks. Attackers can change the global keycloakUrl via /configuration/manager to redirect other realms' console authentication for credential phishing, inject CSS, replace map tiles, and delete logs.15h