HackZoneLabs News
Newsletter

CVE records

39811 records, newest first. We hold CVEs that were published recently, that are in the CISA KEV catalogue, or that an article mentions.

CVETitlePublishedTop scoreKEV
CVE-2025-71460Zipline before 4.2.1 Missing Ownership Check via /api/user/files/transaction13 Nov 20264.2
CVE-2025-71461Zipline before 4.0.2 Predictable Filenames via Math.random State Recovery13 Nov 20266.9
CVE-2025-71462Zipline before 3.7.12 XSS via url parameter on login page13 Nov 20266.1
CVE-2025-71463Scapy before 2.7.0 Insecure Deserialization RCE via Session Files13 Nov 20266.7
CVE-2026-75487Cudy TR3000 before 2.5.42 Command Injection via WireGuard private_key Export13 Nov 20268.6
CVE-2026-75488Cudy TR3000 before 2.5.42 Stack Buffer Overflow via CWMP Basic Authorization Builder13 Nov 20268.2
CVE-2026-75489Cudy TR3000 before 2.5.42 SMT Message Forgery via Probe Request Vendor IE13 Nov 20266.8
CVE-2026-75490Cudy TR3000 before 2.5.42 Unauthenticated RCE via mDNS Automesh Broker Adoption13 Nov 20267.7
CVE-2026-75491Cudy TR3000 before 2.5.42 MQTT JWT Authentication Bypass via alg none Tokens13 Nov 20269.2
CVE-2026-75492Cudy TR3000 before 2.5.42 Stack Buffer Overflow via stun_client UDP Parser13 Nov 20268.7
CVE-2026-75493Cudy TR3000 before 2.5.42 Stack Buffer Overflow via obuspa KeyPassphrase Getter13 Nov 20268.2
CVE-2026-75494Cudy TR3000 before 2.5.42 Curl Argument Injection via TR-069 Upload13 Nov 20268.3
CVE-2026-75495Cudy TR3000 before 2.5.42 OS Command Injection via TR-098 User Password Parameter13 Nov 20269.2
CVE-2026-75576Cudy TR3000 before 2.5.42 Command Injection via VPN Configuration Upload Filename13 Nov 20268.6
CVE-2026-75577Cudy TR3000 before 2.5.42 Command Injection via vpn.export_conf WireGuard Private Key13 Nov 20268.6
CVE-2026-75578Cudy TR3000 before 2.5.42 Command Injection via OpenVPN Client Configuration Upload13 Nov 20268.6
CVE-2026-126264SiYuan before 3.8.9 Sensitive File Disclosure via /api/file/getFile13 Nov 20268.3
CVE-2026-126265SiYuan 2.1.0 before 3.8.9 CAPTCHA Bypass via Stale Login Cookie13 Nov 20269.1
CVE-2026-126266SiYuan from 3.6.0 before 3.8.9 Publish-Password Bypass via getDoc Regex Keywords13 Nov 20268.7
CVE-2026-126267NocoDB from 0.300.0 before 2026.04.4 Denial of Service via MetaService Logging13 Nov 20267.1
CVE-2026-126268NocoDB before 2026.08.0 IP Address Spoofing via Unconditional Proxy Trust13 Nov 20266.9
CVE-2026-126269NocoDB before 2026.09.0 Stored XSS via Attachment MIME Type13 Nov 20269.3
CVE-2026-126270NocoDB before 2026.09.1 Unauthenticated Information Disclosure via Aggregated Meta Endpoint13 Nov 20266.9
CVE-2026-126271NocoDB before 2026.09.0 TLS Private Key Exposure via Data Source Read13 Nov 20268.3
CVE-2026-126272NocoDB before 2026.09.0 Uncontrolled Resource Consumption via Bulk Record Endpoints13 Nov 20267.1
CVE-2026-126273NocoDB before 2026.09.0 Privilege Escalation via Incomplete Admin Bootstrap13 Nov 20269.2
CVE-2026-126274NocoDB before 2026.08.0 Stored XSS via Table Deletion Dialog13 Nov 20269.3
CVE-2026-126275NocoDB before 2026.09.0 IDOR in Row Comment Operations13 Nov 20267.1
CVE-2026-126276NocoDB before 2026.08.1 Client Authentication Bypass via OAuth Token Exchange13 Nov 20268.2
CVE-2026-126277NocoDB before 2026.08.1 Uncontrolled Resource Consumption via Shared View Bulk API13 Nov 20268.7
CVE-2026-126278NocoDB before 2026.08.1 Password Reset Token Race Condition13 Nov 20268.7
CVE-2026-126279NocoDB before 2026.06.2 Stored XSS via AI Field Prompt Tooltip13 Nov 20267.0
CVE-2026-126280NocoDB before 2026.08.0 Refresh Token Reuse via Non-Atomic Rotation13 Nov 20269.1
CVE-2026-126281NocoDB before 2026.08.0 Private Integration Credential Exposure via Copy13 Nov 20267.1
CVE-2026-126282NocoDB from 2026.04.0 before 2026.08.0 Improper Privilege Management via Organization Role Update13 Nov 20268.6
CVE-2026-126283NocoDB before 2026.08.0 Incorrect Authorization via Base-Scoped API Tokens13 Nov 20268.8
CVE-2026-126284NocoDB 2026.05.2 before 2026.07.0 SSRF via Data Import URL Fetch13 Nov 20263.1
CVE-2026-126285NocoDB before 2026.08.0 SQL Injection via Legacy where Query Filter13 Nov 20268.3
CVE-2026-126286NocoDB before 2026.08.0 Reflected XSS via ncRedirectUrl in PageLeavingWarning.vue13 Nov 20268.6
CVE-2026-126287NocoDB before 2026.06.2 OAuth Refresh Token Rotation Race Condition13 Nov 20266.0
CVE-2026-126288NocoDB before 2026.06.2 Credential Disclosure via Public OAuth Client Endpoint13 Nov 20266.9
CVE-2026-126289NocoDB before 2026.06.1 CSV Formula Injection via export.service.ts13 Nov 20265.4
CVE-2026-126290NocoDB before 2026.07.0 Private Integration Credential Exposure via Base Integration Read13 Nov 20267.1
CVE-2026-126291NocoDB before 2026.06.2 SQL Injection via User Email in Base User Query13 Nov 20268.8
CVE-2026-126292NocoDB before 2026.06.1 Password Hash Exposure via Profile Update Response13 Nov 20265.3
CVE-2026-126293NocoDB before 2026.06.2 Attachment Size Limit Bypass via Upload by URL13 Nov 20267.1
CVE-2026-126294Grav Login Plugin before 3.11.0 Two-Factor Authentication Bypass via /login13 Nov 20268.7
CVE-2026-126295NLTK 3.10.0 before 3.10.4 Arbitrary File Read via BllipParser Model Paths13 Nov 20267.0
CVE-2026-126296NLTK before 3.10.4 Path Traversal via save_maxent_params and load_maxent_params13 Nov 20266.3
CVE-2026-126297NLTK before 3.10.4 CPU Denial of Service via ConllCorpusReader srl_instances13 Nov 20268.7