HackZoneLabs News
Newsletter

CVE records

39811 records, newest first. We hold CVEs that were published recently, that are in the CISA KEV catalogue, or that an article mentions.

CVETitlePublishedTop scoreKEV
CVE-2026-126298NLTK before 3.10.4 Quadratic CPU Denial of Service via Tree.chomsky_normal_form13 Nov 20268.7
CVE-2026-126299NLTK before 3.10.4 Quadratic-Time Denial of Service via CCG Lexicon fromstring13 Nov 20268.7
CVE-2026-126300NLTK from 3.2.5 before 3.10.4 CPU Exhaustion via TreebankWordTokenizer.span_tokenize13 Nov 20266.9
CVE-2026-126301NLTK from 3.6 before 3.10.4 Quadratic CPU Exhaustion via LegalitySyllableTokenizer.tokenize13 Nov 20266.9
CVE-2026-126302NLTK 3.9.4 before 3.10.4 Symlink Sandbox Escape via chat80.sql_query13 Nov 20264.8
CVE-2026-126303NLTK before 3.10.4 Denial of Service via SteppingRecursiveDescentParser.parse()13 Nov 20268.7
CVE-2026-103645Integer overflow vulnerability in QTextCodec fromUnicode() and toUnicode() impacts Qt13 Nov 20261.1
CVE-2026-126304NLTK 3.10.0 before 3.10.4 Symlink Escape in YCOECorpusReader13 Nov 20268.7
CVE-2026-126305EspoCRM before 10.0.9 Stored XSS via Knowledge Base Article Attachments13 Nov 20268.5
CVE-2026-126306EspoCRM before 10.0.8 Stored XSS via Malicious SVG Attachment13 Nov 20268.6
CVE-2026-126307Nezha Dashboard before 2.6.0 Multiple Authorization and Tenant Isolation Flaws13 Nov 20268.7
CVE-2026-126308Coder 2.38.0 before 2.38.2 Session Token Leak via Sub-Agent External Apps13 Nov 20268.7
CVE-2026-126309OpenBao before 2.6.5 and 2.7.2 Path Traversal in Transit Key Import13 Nov 20267.6
CVE-2026-126310OpenBao before 2.6.5 and 2.7.2 OIDC Provider Authentication Bypass via Client Credentials13 Nov 20268.7
CVE-2026-126311OpenBao before 2.6.5 and 2.7.2 Wildcard Principals in SSH Certificates via Identity Templates13 Nov 20265.8
CVE-2026-126312OpenBao before 2.6.5 and 2.7.2 ACL Bypass via Non-Canonical Plugin Paths13 Nov 20267.6
CVE-2026-126313Frappe HRMS 16.0.0 before 16.20.1 Authorization Bypass via Employee Records13 Nov 20265.3
CVE-2026-126314Frappe HRMS 15.0.0 before 15.64.6 Missing Authorization in Bulk Record Creation13 Nov 20268.8
CVE-2026-126315Frappe HRMS 16.14.0 before 16.20.1 Telemetry Setting Bypass Information Exposure13 Nov 20269.8
CVE-2026-126316Frappe HRMS 16.0.0 before 16.20.1 Subscription Key Exposure via Request URL13 Nov 20262.2
CVE-2026-126317Frappe HRMS 16.0.0 before 16.20.1 Missing Authorization in Company Details Endpoint13 Nov 20268.8
CVE-2026-126318REDAXO before 5.21.6 Authorization Bypass of Live Version Permission13 Nov 20265.3
CVE-2026-126319Dockhand before 1.0.55 Arbitrary File Read via Stack Adoption Compose Path13 Nov 20267.1
CVE-2026-126320Dockhand before 1.0.55 Improper Authorization via Container File Download Endpoint13 Nov 20267.1
CVE-2026-126321Dockhand before 1.0.55 Path Traversal via Symlink in File-Browser Endpoints13 Nov 20268.3
CVE-2026-126322OpenEMR before 8.3.0 Unsanitized Deserialization via patient_match_dialog.php13 Nov 20268.6
CVE-2026-126323Vvveb through 1.0.8.6 CSRF via GET Admin State-Changing Actions13 Nov 20265.3
CVE-2026-126369Vvveb through 1.0.8.6 Stored XSS via sanitizeHTML() Blacklist Bypass13 Nov 20265.4
CVE-2026-126370Vvveb through 1.0.8.6 Authenticated RCE via .sql Code Injection in editor/code/save13 Nov 20268.8
CVE-2026-126371Vvveb through 1.0.8.6 SQL Injection via Admin_Auth_TokenSQL::update() Array Keys13 Nov 20265.4
CVE-2026-126372Vvveb through 1.0.8.6 Template Upload Bypass via MediaTrait editor/code13 Nov 20268.8
CVE-2026-126373Vvveb 1.0.8.4 through 1.0.8.6 Authorization Bypass via Post Revisions13 Nov 20265.3
CVE-2026-126374Vvveb through 1.0.8.6 SQL Injection via @KEYS(:each) Array Keys13 Nov 20265.3
CVE-2026-126375Vvveb through 1.0.8.6 Cross-Tenant Digital Asset Tampering via Media Trait13 Nov 20268.1
CVE-2026-126376Vvveb 1.0.8.4 through 1.0.8.6 BOLA via Posts, Products, and Digital Assets13 Nov 20265.4
CVE-2026-126377Vvveb before 1.0.9.0 Cookie Forgery via PHP Type Juggling in generateCookie()13 Nov 20269.2
CVE-2026-126378Vvveb through 1.0.8.6 Webshell Upload via Theme Installer validFile() Bypass13 Nov 20269.4
CVE-2026-126379Vvveb 1.0.8.6 SSRF via oEmbed Proxy DNS Rebinding13 Nov 20268.3
CVE-2026-126380Vvveb before 1.0.9.0 RCE via .phar Extension Denylist Bypass in Media Upload13 Nov 20269.4
CVE-2026-126381n8n before 2.44.1 SQL Injection via Vector Store (OracleDB) Metadata Filter Key13 Nov 20266.3
CVE-2026-126382n8n before 2.38.0 Authentication Bypass via Asana Trigger Webhook Secret Reset13 Nov 20266.3
CVE-2026-126383n8n before 1.123.89 NoSQL Injection via MongoDB Node Update Key13 Nov 20268.2
CVE-2026-126384n8n before 1.123.89 RCE via Bundled GraphicsMagick in Edit Image Node13 Nov 20267.7
CVE-2026-126385n8n before 2.46.1 OAuth Account Hijack via Unauthenticated Credential Callback13 Nov 20267.7
CVE-2026-126386n8n before 1.123.89 Open Redirect via MCP OAuth Dynamic Client Registration13 Nov 20265.1
CVE-2026-126387n8n before 2.46.1 Arbitrary File Read via Browser Use browser_upload Tool13 Nov 20266.0
CVE-2026-126388n8n before 2.46.1 Credential Leak via Cross-Origin Redirects in Nodes13 Nov 20266.3
CVE-2026-126389n8n before 1.123.89 Authentication Bypass via Chat Trigger Embedded Chat13 Nov 20266.3
CVE-2026-126390n8n before 1.123.89 NocoDB Node API Token Leak via Attachment Download13 Nov 20266.3
CVE-2026-126391n8n before 1.123.89 RCE via Workflow Expression Evaluation Sandbox Escape13 Nov 20267.7