HackZoneLabs News
Newsletter

CVE records

39839 records, newest first. We hold CVEs that were published recently, that are in the CISA KEV catalogue, or that an article mentions.

CVETitlePublishedTop scoreKEV
CVE-2026-126442OpenEMR before 8.5.0 Missing Authorization via create_portallogin.php Portal Takeover13 Nov 20268.6
CVE-2026-126443OpenEMR before 8.5.0 Missing Authorization via dynamic_finder_ajax.php Patient Finder13 Nov 20267.1
CVE-2026-118587PowerPress Podcasting plugin by Blubrry <= 11.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' and 'height' Shortcode Attributes13 Nov 20265.4
CVE-2026-126029WPZOOM Addons for Elementor <= 1.4.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regions[i][link][url]' and 'pins[i][link][url]' Parameters13 Nov 20266.4
CVE-2026-126444OpenEMR before 8.5.0 Missing Authorization in Ensora eRx via eRx.php13 Nov 20266.0
CVE-2026-119077ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.9 - Unauthenticated PHP Object Injection to Remote Code Execution via 'form' Parameter13 Nov 20269.8
CVE-2026-124218Drag and Drop File Upload for Elementor Forms <= 1.6.2 - Unauthenticated Arbitrary File Deletion via 'form_fields[upload]' Parameter13 Nov 20268.2
CVE-2026-126445OpenEMR before 8.5.0 Missing Authorization in Patient Flow Board Tracker Endpoints13 Nov 20265.3
CVE-2026-122227Easy Property Listings <= 3.5.28 - Authenticated (Contributor+) SQL Injection via 'post_type' Shortcode Attribute13 Nov 20266.5
CVE-2026-121518Customer Reviews for WooCommerce <= 5.127.0 - Unauthenticated Sensitive Information Exposure in 'search' Parameter13 Nov 20265.3
CVE-2026-126446OpenEMR before 8.5.0 Missing Authorization via destroyed_drugs_report.php13 Nov 20265.3
CVE-2026-120573WPeMatico RSS Feed Fetcher <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_category' Parameter13 Nov 20266.4
CVE-2026-116509Quiz and Survey Master (QSM) <= 11.2.9 - Authenticated (Contributor+) SQL Injection via 'qpages' Parameter13 Nov 20266.5
CVE-2026-126447OpenEMR before 8.5.0 Missing Authorization via trusted-messages-ajax.php Direct Messaging13 Nov 20266.0
CVE-2026-118191Photo Gallery, Sliders, Proofing and Themes <= 4.5.5 - Authenticated (Custom+) Arbitrary File Deletion via 'task_list' and 'app_config' Parameters13 Nov 20268.1
CVE-2026-126448OpenEMR before 8.5.0 Missing Authorization in Nation Notes Configuration Handlers13 Nov 20265.3
CVE-2026-120658Download Manager <= 7.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'file[additional_previews][]' Parameter13 Nov 20266.4
CVE-2026-125948Recipe Card Blocks Lite <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'steps' Block Attribute13 Nov 20266.4
CVE-2026-126449OpenEMR before 8.5.0 Missing Authorization in immunizations.php, diagnosis_full.php, billing_process.php13 Nov 20267.1
CVE-2026-125409Passster <= 4.3.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'metavalue' Parameter13 Nov 20266.4
CVE-2026-116614WPMR Google Feed Manager for WooCommerce <= 2.24.1 - Authenticated (Editor+) SQL Injection via 'sourceId' Parameter13 Nov 20264.9
CVE-2026-126450OpenEMR before 8.5.0 Stored XSS via Patient External ID in Prescriptions13 Nov 20265.3
CVE-2026-125055Chatterbug Forms <= 1.0.2 - Unauthenticated Arbitrary File Upload via File Upload via Public Form Submission13 Nov 20269.8
CVE-2026-122063Newsletters <= 4.18.2 - Authenticated (Subscriber+) SQL Injection via 'user_email' User Meta13 Nov 20266.5
CVE-2026-126451OpenEMR before 8.5.0 Stored XSS via Document Template Rendering13 Nov 20268.5
CVE-2026-116615Widget Options <= 4.2.6.1 - Authenticated (Contributor+) Code Injection via 'post_content' Parameter13 Nov 20268.8
CVE-2026-120688EZ SQL Reports Shortcode Widget and DB Backup <= 5.25.25 - Unauthenticated Stored Cross-Site Scripting via Comment User-Agent Header13 Nov 20267.2
CVE-2026-126452OpenEMR before 8.5.0 Missing Authorization via diagnosis_full.php Billing Operations13 Nov 20267.1
CVE-2026-120547CF7 Apps <= 3.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting via [honeypot] Form-Tag Placeholder Value13 Nov 20264.4
CVE-2026-123769SureDash <= 1.13.0 - Authenticated (Custom+) Privilege Escalation to /suredash/v1/save-settings REST Endpoint13 Nov 20268.8
CVE-2026-126453OpenEMR before 8.5.0 Inverted Document Expiration Check Exposes PHI via FHIR Binary13 Nov 20267.1
CVE-2026-115871WP STAGING <= 4.19.0 - Authenticated (Administrator+) Arbitrary Directory Deletion via 'deleteDir' Parameter13 Nov 20262.7
CVE-2026-126454OpenEMR before 8.5.0 TOTP Brute Force via main_screen.php and OAuth213 Nov 20268.6
CVE-2026-126455OpenEMR before 8.5.0 Privilege Escalation via Missing Authorization and SQL Injection13 Nov 20268.6
CVE-2026-126456OpenEMR before 8.5.0 Stored XSS via Fee Sheet notecodes field13 Nov 20265.4
CVE-2026-126457OpenEMR before 8.5.0 Missing Authorization in InstallerController Module Actions13 Nov 20267.1
CVE-2026-126458OpenEMR before 8.5.0 Missing Authorization via authorizations_full.php13 Nov 20268.8
CVE-2026-126460OpenEMR before 8.5.0 Persistent SQL Injection via ERA File Reprocessing13 Nov 20267.1
CVE-2026-126461OpenEMR before 8.5.0 Missing Authorization via user_settings.php Global Override13 Nov 20267.1
CVE-2026-126462OpenEMR before 8.5.0 Stored XSS via Eye Exam Next Visit Orders13 Nov 20265.4
CVE-2026-126463OpenEMR before 8.5.0 SQL Injection via billing parser, reports, Zend modules13 Nov 20267.1
CVE-2026-126464OpenEMR before 8.5.0 SSRF via Patient Portal PDF Generation13 Nov 20265.3
CVE-2026-126465OpenEMR before 8.5.0 SQL Injection via OnsiteActivityView _BitwiseAnd Criteria13 Nov 20267.1
CVE-2026-126466OpenEMR before 8.5.0 Missing Authorization in Patient Create and Search Endpoints13 Nov 20268.8
CVE-2026-126467OpenEMR before 8.5.0 Mass Assignment via Observation Form save.php13 Nov 20267.1
CVE-2026-126468OpenEMR before 8.5.0 Missing Authorization on Reports and Reminder Endpoints13 Nov 20268.8
CVE-2026-126469OpenEMR before 8.5.0 Missing Authorization in custom/ Export and Chart-Tracker Scripts13 Nov 20268.8
CVE-2026-126470OpenEMR before 8.5.0 IDOR in Carecoordination CCDA/CCR/QRDA Document Actions13 Nov 20268.8
CVE-2026-126471OpenEMR before 8.5.0 Missing Authorization via print_referral.php and trend_form.php13 Nov 20267.1
CVE-2026-126472OpenEMR before 8.5.0 Missing Authorization in ccdaservice/ccda_gateway.php C-CDA Disclosure13 Nov 20268.8