HackZoneLabs News
Newsletter

CVE records

39839 records, newest first. We hold CVEs that were published recently, that are in the CISA KEV catalogue, or that an article mentions.

CVETitlePublishedTop scoreKEV
CVE-2026-127081OpsTree BuildPiper before 2.7.0 Authorization Bypass via Pipeline Stage project_env_id13 Nov 20265.3
CVE-2026-127082Huginn before 2026.11.09 Information Exposure via JqAgent jq env Builtin13 Nov 20268.3
CVE-2026-127083Huginn from 2026.09.09 before 2026.11.09 SSRF via OUTBOUND_PROXY Bypass13 Nov 20266.4
CVE-2026-127084Teable before 2026-10-12T12-45-53Z.3331 Stored XSS via Attachment Uploads13 Nov 20268.5
CVE-2026-127085Ryot before 10.5.6 Authorization Bypass via deployRemoveEntitiesFromCollectionJob13 Nov 20265.3
CVE-2026-127086Ryot before 10.5.6 Authorization Bypass via createOrUpdateCollection updateId13 Nov 20266.3
CVE-2026-127087Ryot before 10.5.6 Authorization Bypass via revokeAccessLink GraphQL Mutation13 Nov 20263.1
CVE-2026-1270882FAuth before 9.0.1 Password Reset Poisoning via Host Header13 Nov 20268.6
CVE-2026-127090Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, SSH Public Key Cross-User Authentication Bypass13 Nov 20268.8
CVE-2026-127091Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1, VFS Mount Policy Bypass via Non-Canonical Paths13 Nov 20267.6
CVE-2026-127092BuildAdmin 1.0.1 through 2.3.9 Stored XSS via X-Rewrite-URL in Admin Log13 Nov 20266.1
CVE-2026-127093Rustrak before 0.26.0 SSRF via Alert Integration Test routing_override.url13 Nov 20265.5
CVE-2026-127094Pagelayer 2.1.7 before 2.2.1 Missing Authorization via Abilities API13 Nov 20267.6
CVE-2026-128014FrankenPHP 1.8.0 before 1.13.2 Out-of-Bounds Write via Bundled Brotli Decoder13 Nov 20269.2
CVE-2026-128015FrankenPHP before 1.13.4 Use-After-Free via putenv() During Request Shutdown13 Nov 20268.3
CVE-2026-128016FrankenPHP before 1.13.4 Use-After-Free of SplTempFileObject Streams in Worker Mode13 Nov 20268.3
CVE-2026-128017FrankenPHP before 1.13.4 Double Free in Worker Mode via Non-Form POST13 Nov 20266.3
CVE-2026-128018FrankenPHP before 1.13.4 Pending Worker Request Denial of Service13 Nov 20266.3
CVE-2026-128019FrankenPHP before 1.13.4 Information Disclosure via Per-Request Environment Variable Leak13 Nov 20266.3
CVE-2026-128020FrankenPHP before 1.13.2 Denial of Service via Cyclic Array Conversion13 Nov 20268.2
CVE-2026-128021FrankenPHP before 1.13.2 Information Disclosure via libxml Error State in Worker Mode13 Nov 20266.3
CVE-2026-128022FrankenPHP before 1.13.2 Denial of Service via Queued Disconnected Requests13 Nov 20266.9
CVE-2026-128023FrankenPHP before 1.13.0 Authentication Bypass via Dot-Form Header Name Aliasing13 Nov 20269.1
CVE-2026-128024FrankenPHP before 1.13.0 Denial of Service via goArray Nil Type Assertion13 Nov 20268.2
CVE-2026-128025FrankenPHP before 1.13.0 CGI Path-Split Boundary Bypass via splitPos13 Nov 20266.9
CVE-2026-128026FrankenPHP 1.5.0 before 1.13.0 Cross-Request Environment Leakage via putenv13 Nov 20266.9
CVE-2026-128027FrankenPHP before 1.1.11 Delayed Propagation of Base Image Security Fixes13 Nov 20269.8
CVE-2026-128028OpenMage magento-lts before 20.18.2 Stored XSS via Product Custom Option SVG Upload13 Nov 20264.7
CVE-2026-128029OpenMage magento-lts before 20.18.2 Stored XSS via Dataflow Import Row Errors13 Nov 20264.7
CVE-2026-128030OpenMage magento-lts before 20.18.2 Insufficient Session Expiration After API User Deactivation13 Nov 20267.4
CVE-2026-128031OpenMage magento-lts before 20.18.2 Incorrect Authorization in Admin Controllers ACL13 Nov 20265.1
CVE-2026-128032OpenMage magento-lts before 20.18.2 Payment Bypass via Free Payment Method13 Nov 20265.9
CVE-2026-128033OpenMage magento-lts before 20.18.2 Information Disclosure via Order-Status RSS Feed13 Nov 20265.3
CVE-2026-128040OpenMage magento-lts before 20.18.2 Stored XSS via Admin Dataflow, Tax, OAuth, PayPal Fields13 Nov 20268.4
CVE-2026-128041OpenMage magento-lts before 20.18.2 Stored XSS via RSS Review Feed13 Nov 20268.8
CVE-2026-128042OpenMage magento-lts before 20.19.0 Race Condition in Coupon Usage Limits13 Nov 20266.3
CVE-2026-128043OpenMage magento-lts before 20.19.0 CSRF via PayPal Cancel Return Handlers13 Nov 20263.1
CVE-2026-128044OpenMage magento-lts before 20.18.2 OAuth Callback URL Allowlist Bypass13 Nov 20268.7
CVE-2026-128045OpenMage Magento-LTS before 20.18.2 Authorization Bypass via Forgeable RSS Order Key13 Nov 20266.9
CVE-2026-128046OpenMage magento-lts 20.17.0 before 20.18.2 Unrestricted File Upload RCE via Custom Options13 Nov 20269.2
CVE-2026-128047OpenMage magento-lts before 20.18.2 Account Takeover via Predictable Confirmation Key13 Nov 20269.2
CVE-2026-128048OpenMage magento-lts before 20.18.2 Information Disclosure via Email Template getConfig13 Nov 20266.9
CVE-2026-128049OpenMage Magento LTS before 20.18.2 CSRF via OAuth Authorization Confirm13 Nov 20269.4
CVE-2026-128051OpenMage magento-lts before 20.18.2 Stored XSS via Product Name in MSRP Popup13 Nov 20264.8
CVE-2026-128052OpenMage magento-lts before 20.19.0 Block Whitelist Bypass via {{layout}} Directive13 Nov 20265.1
CVE-2026-128053OpenMage magento-lts before 20.18.2 Reflected XSS via Error Pages SCRIPT_NAME13 Nov 20264.7
CVE-2026-128237Scapy before 2.8.0 Denial of Service via Quadratic BER OID Decoding13 Nov 20266.9
CVE-2026-128238Scapy before 2.8.0 Uncontrolled Recursion DoS via BER SEQUENCE Decoder13 Nov 20266.9
CVE-2026-128239GPAC through 26.07.0 NULL Pointer Dereference via MPEG-4 Form Handlers13 Nov 20266.8
CVE-2026-128240GPAC through 26.07.0 Use-After-Free in gf_sg_proto_del During Scene Teardown13 Nov 20266.8