HackZoneLabs News
Newsletter

CVE records

39770 records, newest first. We hold CVEs that were published recently, that are in the CISA KEV catalogue, or that an article mentions.

CVETitlePublishedTop scoreKEV
CVE-2025-71466GPAC before 26.02.0 NULL Pointer Dereference via m2tsdmx_update_sdt15 Nov 20266.8
CVE-2025-71467GPAC before 26.02.0 NULL Pointer Dereference via gf_node_get_field_by_name15 Nov 20266.8
CVE-2025-71468GPAC before 26.02.0 NULL Pointer Dereference via gf_dash_group_get_audio_channels15 Nov 20266.8
CVE-2025-71469GPAC before 26.02.0 Type Confusion DoS via XMT/BT Scene Loader15 Nov 20266.8
CVE-2025-71470MicroQuickJS before commit 99eed3f Out-of-Bounds Read in build_backtrace15 Nov 20266.8
CVE-2026-129490littlefs through 2.11.3 Type Confusion in lfs_dir_traverse via lfs_migrate15 Nov 20266.8
CVE-2026-129484Kroki before 0.36.0 Reflected XSS via /goat/svg Color Scheme Options15 Nov 20266.1
CVE-2026-129485Kroki before 0.36.0 SSRF via BlockDiag Icon and Background Attributes15 Nov 20266.9
CVE-2026-125765WordPress ShortPixel Adaptive Images plugin <= 3.11.6 - Cross Site Scripting (XSS) vulnerability15 Nov 20267.1
CVE-2026-125795WordPress Estatik plugin <= 4.3.6 - Local File Inclusion vulnerability15 Nov 20269.8
CVE-2026-125793WordPress Flexmls® IDX plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability15 Nov 20267.1
CVE-2026-128893WordPress Wise Chat plugin <= 3.4.5 - Cross Site Scripting (XSS) vulnerability15 Nov 20267.1
CVE-2026-125799WordPress Flow-Flow Social Stream plugin <= 5.0.5 - Sensitive Data Exposure vulnerability15 Nov 20267.5
CVE-2026-125447WordPress Kali Forms plugin <= 2.4.31 - Cross Site Scripting (XSS) vulnerability15 Nov 20267.1
CVE-2026-125733WordPress ShopLentor plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability15 Nov 20267.1
CVE-2026-125771WordPress MCP Server for WordPress plugin <= 2.0.3 - Privilege Escalation vulnerability15 Nov 20267.2
CVE-2026-125780WordPress Woocommerce Custom Product Addons Pro plugin <= 5.9.0 - Arbitrary File Deletion vulnerability15 Nov 20267.5
CVE-2026-125449WordPress Testimonial Slider plugin <= 3.0.2 - PHP Object Injection vulnerability15 Nov 20268.8
CVE-2026-124755WordPress Advanced Custom Fields: Font Awesome Field plugin <= 6.1.4 - Cross Site Scripting (XSS) vulnerability15 Nov 20266.5
CVE-2026-125769WordPress Advanced Form Integration plugin <= 2.11.3 - Privilege Escalation vulnerability15 Nov 20269.8
CVE-2026-125764WordPress e2pdf plugin <= 1.32.65 - Cross Site Scripting (XSS) vulnerability15 Nov 20267.1
CVE-2026-124259WordPress Events Made Easy plugin <= 3.3.5 - Cross Site Scripting (XSS) vulnerability15 Nov 20267.1
CVE-2026-125805WordPress GeoDirectory plugin <= 2.8.204 - Cross Site Scripting (XSS) vulnerability15 Nov 20266.5
CVE-2026-125828WordPress BookIt plugin <= 2.6.0.7 - Cross Site Scripting (XSS) vulnerability15 Nov 20267.1
CVE-2026-125791WordPress Orphans plugin <= 3.4.6 - Cross Site Scripting (XSS) vulnerability15 Nov 20267.1
CVE-2026-125832WordPress WP Data Access plugin <= 5.5.92 - SQL Injection vulnerability15 Nov 20268.5
CVE-2026-124254WordPress EWWW Image Optimizer plugin <= 8.9.1 - Cross Site Scripting (XSS) vulnerability15 Nov 20267.1
CVE-2026-125813WordPress Survey Maker plugin <= 5.2.4.3 - Cross Site Scripting (XSS) vulnerability15 Nov 20267.1
CVE-2026-125443WordPress WPJAM Basic plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability15 Nov 20267.1
CVE-2026-124995WordPress Track, Analyze & Optimize by WP Tao plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability15 Nov 20267.1
CVE-2026-124270WordPress NEX-Forms plugin <= 9.3.3 - Cross Site Scripting (XSS) vulnerability15 Nov 20267.1
CVE-2026-125789WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.20 - Cross Site Scripting (XSS) vulnerability15 Nov 20267.1
CVE-2026-125790WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.20 - Cross Site Scripting (XSS) vulnerability15 Nov 20267.1
CVE-2026-122662WordPress Document Library Pro plugin < 4.2.2 - PHP Object Injection vulnerability15 Nov 20269.8
CVE-2026-125857WordPress Dynamic User Directory plugin <= 2.4 - Cross Site Scripting (XSS) vulnerability15 Nov 20266.5
CVE-2026-125775WordPress CRM Perks Forms plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability15 Nov 20267.1
CVE-2026-129482OkHttp through 5.5.1 Certificate Pinning Bypass via Trailing-Dot Hostname15 Nov 20266.3
CVE-2026-129483Cyrus SASL through 2.1.28 SRP Authentication Bypass via plugins/srp.c15 Nov 20269.3
CVE-2026-129453DrayTek Vigor2960 File Existence Check mainfunction.cgi check_file_exist heap-based overflow15 Nov 20269.9
CVE-2026-129477Assimp through 6.0.6 Path Traversal via glTF External Buffer URIs15 Nov 20266.8
CVE-2026-129478Assimp through 6.0.6 Heap Out-of-Bounds Read via glTF ParseDataURI15 Nov 20266.9
CVE-2026-129479Assimp through 6.0.6 Integer Overflow via OgreBinarySerializer::ReadSubMesh15 Nov 20266.8
CVE-2026-129480Assimp through 6.0.6 Heap Out-of-Bounds Read via MD2 Importer frameSize15 Nov 20265.8
CVE-2026-129467GeoPulse 1.5.0 through 2.3.0 IDOR via Geocoding Place-Details Endpoint15 Nov 20265.3
CVE-2026-129468Netcccyun dnsmgr 2.18 before 2.22 Missing Authorization via get_domain_default_line15 Nov 20265.3
CVE-2026-129469Course-tencent-cloud before 2.0.2 IDOR via /api/refund/confirm15 Nov 20266.9
CVE-2026-129452DrayTek Vigor2960 mainfunction.cgi set_table command injection15 Nov 20269.4
CVE-2026-129451DrayTek Vigor2960 mainfunction.cgi app_guest_export path traversal15 Nov 20269.9
CVE-2026-129450DrayTek Vigor2960 mainfunction.cgi sub_1E084 path traversal15 Nov 20269.9
CVE-2026-129449DrayTek Vigor2960 mainfunction.cgi sub_14914 command injection15 Nov 20269.9