HackZoneLabs News
Newsletter

CVE records

39839 records, newest first. We hold CVEs that were published recently, that are in the CISA KEV catalogue, or that an article mentions.

CVETitlePublishedTop scoreKEV
CVE-2026-126473OpenEMR before 8.4.0 OAuth Authorization Bypass via Scope Canonicalization13 Nov 20269.3
CVE-2026-126474OpenEMR before 8.5.0 Reflected XSS via ACL Module module_id Parameter13 Nov 20266.1
CVE-2026-126475OpenEMR before 8.5.0 Reflected XSS via searchEleNo in Auto-Suggest Endpoint13 Nov 20266.1
CVE-2026-126476OpenEMR before 8.5.0 Reflected XSS via auto-suggest searchMode parameter13 Nov 20266.1
CVE-2026-126477OpenEMR before 8.5.0 Stored XSS via Eye Exam Defaults in eye_base.php13 Nov 20264.8
CVE-2026-126478OpenEMR before 8.5.0 SQL Injection via form_icd_codes in Syndromic Surveillance13 Nov 20267.6
CVE-2026-126479OpenEMR before 8.5.0 Missing Authorization in Module Manager Installer Actions13 Nov 20267.6
CVE-2026-126480OpenEMR before 8.5.0 SQL Injection via CCR revandapprove Parameter Names13 Nov 20268.6
CVE-2026-126481OpenEMR before 8.5.0 Path Traversal via ERA 835 File Upload13 Nov 20268.1
CVE-2026-126482OpenEMR before 8.5.0 SQL Injection via CLP01 element of X12 835 ERA upload13 Nov 20268.8
CVE-2026-126483OpenEMR before 8.5.0 SQL Injection via form_facility in ippf_statistics.php13 Nov 20267.1
CVE-2026-126484OpenEMR before 8.5.0 Stored XSS via Printed Fee Sheet Appointment Comments13 Nov 20265.4
CVE-2026-126485OpenEMR before 8.5.0 CSRF via Observation Form delete.php13 Nov 20265.3
CVE-2026-126486OpenEMR before 8.5.0 Missing Authorization via portal/import_template.php13 Nov 20267.6
CVE-2026-126487OpenEMR before 8.5.0 Global Configuration Override via user_settings.php13 Nov 20268.8
CVE-2026-126488OpenEMR before 8.5.0 SQL Injection via OnsiteDocument.Query _BitwiseAnd13 Nov 20268.3
CVE-2026-126489OpenEMR before 8.5.0 SQL Injection via IPPF Contraceptive Issue Feature13 Nov 20268.6
CVE-2026-126490OpenEMR before 8.5.0 Information Disclosure via Debug Code in fax_view.php13 Nov 20263.1
CVE-2026-126491OpenEMR before 8.5.0 SQL Injection via getByPatientDemographics in patient.inc.php13 Nov 20268.3
CVE-2026-126492OpenEMR before 8.5.0 Second-Order SQL Injection via dynamic_finder.php13 Nov 20267.1
CVE-2026-126493OpenEMR before 8.5.0 Stored XSS via OnsitePortalActivity tableArgs13 Nov 20265.4
CVE-2026-126494OpenEMR before 8.4.0 Privilege Escalation via SMART/OAuth Scope Finalization13 Nov 20267.1
CVE-2026-126936Zipline before 4.7.0 Race Condition in Invite and Quota Limits13 Nov 20266.0
CVE-2026-126937Zipline before 4.6.5 TOCTOU Race Condition via /api/setup13 Nov 20269.2
CVE-2026-126938Zipline before 4.6.4 Upload Quota Bypass via Forged Content-Range Headers13 Nov 20267.1
CVE-2026-126939Zipline before 4.6.4 Unauthenticated File Listing via page Query Parameter13 Nov 20266.9
CVE-2026-126940Zipline before 4.6.4 Rate Limit Bypass via Query String and Header13 Nov 20266.9
CVE-2026-126941Zipline through 4.6.2 Privilege Escalation via Missing Role Checks on User Endpoints13 Nov 20268.2
CVE-2026-126942Zipline before 4.6.2 Missing Authorization via POST /api/user/folders13 Nov 20265.4
CVE-2026-126943Zipline 4.2.0 before 4.6.2 OAuth2 Client Secret Leakage in Startup Logs13 Nov 20266.9
CVE-2026-126944Zipline before 4.6.1 Path Traversal via Imported Filenames in LocalDatasource13 Nov 20265.8
CVE-2026-126945Zipline before 4.5.1 Stored XSS via HighlightCode Component13 Nov 20269.3
CVE-2026-126946Zipline 4.3.0 before 4.5.0 Stored XSS via SSR Embed Meta Tags13 Nov 20265.4
CVE-2026-126947Zipline before 4.5.0 Stored Open Redirect via POST /api/user/urls13 Nov 20265.4
CVE-2026-126948Zipline before 4.5.0 IDOR via Folder PATCH and DELETE Endpoints13 Nov 20268.8
CVE-2026-126949Zipline through 4.4.0 Path Traversal File Overwrite via PATCH /api/user/files/:id13 Nov 20267.0
CVE-2026-126950Zipline through 4.4.0 Path Traversal Arbitrary File Delete via x-zipline-file-extension13 Nov 20267.0
CVE-2026-126951Zipline through 4.4.0 Authenticated Path Traversal via /api/user/files/:id/raw13 Nov 20266.9
CVE-2026-126952Zipline through 4.4.0 WebAuthn Authentication Bypass via Passkey Login13 Nov 20269.2
CVE-2026-126953Cudy TR3000 before 2.5.42 OS Command Injection via TR-098 User Username13 Nov 20269.2
CVE-2026-126954Glance 0.7.9 before 0.8.8 Stored XSS via Widget-Title-URL Header13 Nov 20264.7
CVE-2026-126955Glance 0.8.0 before 0.8.8 Page Slug Enumeration via Response Discrepancy13 Nov 20266.9
CVE-2026-127073OpsTree BuildPiper before 2.7.0 Privilege Escalation via Additional Manifest13 Nov 20269.9
CVE-2026-127074OpsTree BuildPiper before 2.7.0 Path Traversal via Dockerfile Path and Build Context13 Nov 20265.3
CVE-2026-127075OpsTree BuildPiper before 2.7.0 Path Traversal via Additional Manifest Rendering13 Nov 20267.1
CVE-2026-127076OpsTree BuildPiper before 2.7.0 Broken Access Control via git_repo API13 Nov 20267.1
CVE-2026-127077OpsTree BuildPiper before 2.7.0 Authorization Bypass via Environment Creation API13 Nov 20267.1
CVE-2026-127078OpsTree BuildPiper before 2.7.0 Authorization Bypass via project_env_id Parameter13 Nov 20267.1
CVE-2026-127079OpsTree BuildPiper before 2.7.0 OTP Brute Force via password_reset/check_otp13 Nov 20269.1
CVE-2026-127080OpsTree BuildPiper before 2.7.0 Container Escape via Unrestricted HostPath Volumes13 Nov 20269.9