HackZoneLabs News
Newsletter

CVE records

39839 records, newest first. We hold CVEs that were published recently, that are in the CISA KEV catalogue, or that an article mentions.

CVETitlePublishedTop scoreKEV
CVE-2026-126392Parse Server 9.10.6-alpha.1 before 9.10.8-alpha.1 Information Disclosure via Dot Notation Update13 Nov 20263.1
CVE-2026-126393SiYuan before 3.8.10 SSRF via Skill-Install Download Redirect and DNS Rebinding13 Nov 20266.1
CVE-2026-126394vLLM 0.30.0 before 0.31.0 Resource Exhaustion via OpenPangu Video Backend num_frames13 Nov 20266.9
CVE-2026-126395vLLM 0.14.0rc1 before 0.31.0 Heap Address Disclosure via sanitize_message()13 Nov 20266.9
CVE-2026-126396vLLM from 0.24.0 before 0.31.0 Resource Exhaustion via MiniMax M3 min_pixels13 Nov 20266.9
CVE-2026-126397vLLM 0.10.1 before 0.31.0 Cohere2 Vision DoS via max_patches13 Nov 20268.7
CVE-2026-126398vLLM 0.28.0 before 0.30.0 Denial of Service via Prompt Embeds on XD-RoPE Models13 Nov 20268.2
CVE-2026-126399vLLM 0.19.0 before 0.31.0 Resource Exhaustion via Request-Level num_frames13 Nov 20267.1
CVE-2026-126400Password Pusher 1.49.0 before 2.17.0 IP Spoofing via Unanchored Trusted-Proxy Regex13 Nov 20266.3
CVE-2026-126401Fleet before 4.86.2 Unauthenticated DoS via SSO Callback XML Canonicalization13 Nov 20268.7
CVE-2026-126402Fleet before 4.89.0 Broken Access Control via User Administration API13 Nov 20268.6
CVE-2026-126403Coder 2.38.0 before 2.38.4 Authorization Bypass via External Agent Credentials Endpoint13 Nov 20268.5
CVE-2026-126404Coder from 2.38.0 before 2.38.4 Privilege Escalation via API Key Creation13 Nov 20267.6
CVE-2026-126405Coder from 2.38.0 before 2.38.4 Memory Exhaustion DoS via Web Push13 Nov 20267.1
CVE-2026-126406Wasmtime before 36.0.20 HTTP Request Smuggling via wasi-http p2 Content-Length13 Nov 20266.3
CVE-2026-126407Wasmtime before 36.0.20 Denial of Service via Borrowed Resource Transfer13 Nov 20265.9
CVE-2026-126408Wasmtime 47.0.0 before 48.0.8 Denial of Service via TypedFunc Type-Check Panic13 Nov 20261.8
CVE-2026-126409Wasmtime 47.0.0 before 48.0.8 Cross-Engine Type Confusion via StructType Supertype13 Nov 20262.0
CVE-2026-126410Wasmtime 48.0.0 before 48.0.8 TOCTOU UDP Send Policy Bypass via wasip3 Sockets13 Nov 20266.4
CVE-2026-126411Frappe HRMS 16.0.0 before 16.50.0 Missing Authorization in HR Workflow Endpoints13 Nov 20265.4
CVE-2026-126412Frappe HRMS 15.0.0 before 15.64.1 Missing Authorization in Bulk Record Action13 Nov 20268.8
CVE-2026-126413Frappe HRMS 15.0.0 before 15.64.1 Missing Authorization on File Details Endpoint13 Nov 20265.3
CVE-2026-126414Frappe HRMS 15.0.0 before 15.64.2 Missing Authorization in Record Update Endpoints13 Nov 20268.8
CVE-2026-126415OpenEMR before 8.5.0 Missing Authorization via Patientvalidation Module13 Nov 20267.1
CVE-2026-126416OpenEMR before 8.5.0 Improper Authorization via patient_tracker_status.php13 Nov 20267.1
CVE-2026-126417OpenEMR before 8.5.0 Information Disclosure via get_claim_file.php13 Nov 20266.0
CVE-2026-126418OpenEMR before 8.5.0 Stored XSS via Billing Code in sl_eob_invoice.php13 Nov 20266.9
CVE-2026-126419OpenEMR before 8.5.0 Missing Authorization in E-Sign Form Submission13 Nov 20265.4
CVE-2026-126420OpenEMR before 8.5.0 Missing Authorization in FaxSMS utility.php Patient Creation13 Nov 20266.0
CVE-2026-126421OpenEMR before 8.5.0 Denial of Service via labs_ajax.php Label Count13 Nov 20265.3
CVE-2026-126422OpenEMR before 8.5.0 Missing Authorization via lists_touch.php13 Nov 20265.3
CVE-2026-126423OpenEMR before 8.5.0 Denial of Service via ZIP Upload Decompression13 Nov 20265.3
CVE-2026-126424OpenEMR before 8.5.0 Stored XSS via Billing Code Descriptions13 Nov 20264.6
CVE-2026-126425OpenEMR before 8.5.0 Stored SQL Injection via History Layout Field Identifiers13 Nov 20267.2
CVE-2026-126426OpenEMR 5.0.2 before 8.5.0 Missing Re-Authentication for MFA Factor Deletion and U2F Registration13 Nov 20265.3
CVE-2026-126427OpenEMR before 8.5.0 Idle Session Timeout Bypass via Eye Exam Form13 Nov 20264.6
CVE-2026-126428OpenEMR before 8.5.0 RCE via Stored ERA Upload and Background Services13 Nov 20267.7
CVE-2026-126429OpenEMR before 8.5.0 Local File Disclosure via doc_lib.php PDF Renderer13 Nov 20267.1
CVE-2026-126430OpenEMR before 8.5.0 SQL Injection via CCR revandapprove Field Names13 Nov 20268.6
CVE-2026-126431OpenEMR before 8.5.0 Second-Order SQL Injection via Carecoordination CCDA Mapper13 Nov 20267.6
CVE-2026-126432OpenEMR before 8.5.0 Improper Authorization in Lab Order Transmission via list_reports.php13 Nov 20266.0
CVE-2026-126433OpenEMR before 8.5.0 Improper Authorization via dispense_drug.php13 Nov 20266.0
CVE-2026-126434OpenEMR before 8.5.0 Missing Authorization in Procedure Order Form13 Nov 20268.6
CVE-2026-126435OpenEMR before 8.5.0 Improper Authorization via order_manifest.php Lab-Order Flags13 Nov 20265.4
CVE-2026-126436OpenEMR before 8.5.0 OAuth2 Grant Type Enforcement Bypass via Token Endpoint13 Nov 20268.7
CVE-2026-126437OpenEMR before 8.5.0 Authorization Bypass via portal/lib/download_template.php13 Nov 20267.1
CVE-2026-126438OpenEMR before 8.5.0 Improper Authorization in Clinical-Rule Editor patient_data.php13 Nov 20265.3
CVE-2026-126439OpenEMR before 8.5.0 Authorization Bypass via C-CDA Gateway ccda_gateway.php13 Nov 20266.0
CVE-2026-126440OpenEMR before 8.5.0 Document ACL Bypass via Care Coordination Import13 Nov 20266.0
CVE-2026-126441OpenEMR before 8.5.0 IDOR via CAMOS rx_print.php Prescription Disclosure13 Nov 20266.0