HackZoneLabs News
Newsletter

CVE records

39770 records, newest first. We hold CVEs that were published recently, that are in the CISA KEV catalogue, or that an article mentions.

CVETitlePublishedTop scoreKEV
CVE-2026-129445D-Link DIR-850L Console Login consolepwd hard-coded credentials15 Nov 20269.3
CVE-2026-82663Give - Peer-to-Peer <= 2.9.5 - Authorization Bypass to Team Modification and Media Upload15 Nov 20267.5
CVE-2026-82568Give - Peer-to-Peer <= 2.9.3 - Unauthenticated SQL Injection via 'sort' Parameter15 Nov 20267.5
CVE-2026-129349Apache Shiro: DefaultLdapRealm accepts any password when authentication caching is enabled15 Nov 20269.1
CVE-2026-129444D-Link DSL-6740C FTP Daemon ftpd_conf.php hard-coded credentials15 Nov 202610.0
CVE-2026-129443itsourcecode Airline Reservation System manage_user.php sql injection15 Nov 20266.5
CVE-2026-127048Lazy Blocks < 3.0.0 - Unauthenticated RCE15 Nov 2026
CVE-2026-124673Burst Statistics < 3.7.5 - Unauthenticated Draft and Private Post Title Disclosure via Forged Page View15 Nov 2026
CVE-2026-124671Burst Statistics < 3.7.5 - Unauthenticated Analytics Disclosure Beyond Shared Report Date Range15 Nov 2026
CVE-2026-123707WPGraphQL < 2.27.1 - Contributor+ Custom Post Status Content Disclosure15 Nov 2026
CVE-2026-114452Kadence Memberships 3.2.17 - 4.0.5 - Subscriber+ Stripe Client Secret Disclosure and Payment Method Manipulation via IDOR15 Nov 2026
CVE-2026-114451Kadence Memberships < 4.0.6 - Unauthenticated Table Collation Downgrade via 'rcp-action' Parameter15 Nov 2026
CVE-2026-110989RegistrationMagic 5.2.3.1 - 6.1.0.3 - Unauthenticated Non-Admin User Profile Modification via Form Submission15 Nov 2026
CVE-2026-110987RegistrationMagic < 6.1.0.4 - Reflected XSS via 'rm_tr' and 'rm_ur' Parameters15 Nov 2026
CVE-2026-110984RegistrationMagic < 6.1.0.4 - Admin+ SQLi via 'rm_fromdate' and 'rm_dateupto' Parameters15 Nov 2026
CVE-2026-110960Auth Armor <= 1.0.3 - Unauthenticated Account Takeover15 Nov 2026
CVE-2026-103361Payment Gateway via Valitor for WooCommerce < 1.9.41 - Unauthenticated Payment Bypass via a Shipped Default Verification Code15 Nov 2026
CVE-2026-116559A2Reviews <= 1.2.3 - Unauthenticated Plugin Data Modification and Disclosure15 Nov 2026
CVE-2026-129360Linux Foundation Magma Obsidian REST operator.go authentication spoofing15 Nov 20267.5
CVE-2026-129359Linux Foundation Magma interceptors.go hard-coded credentials15 Nov 20267.5
CVE-2026-129358Linux Foundation Magma NMS routes.ts handleReact cross site scripting15 Nov 20264.8
CVE-2026-129357Linux Foundation Magma Host Middleware middleware.ts hostOrgMiddleware authorization15 Nov 20266.5
CVE-2026-129454Zr.Admin.NET commit 85cff6a through eb9228a IDOR via Workflow Instance Endpoint15 Nov 20267.1
CVE-2026-129455Zr.Admin.NET commit e6ceaf4 through eb9228a IDOR via front/article API15 Nov 20265.4
CVE-2026-129464Zr.Admin.NET commit 0ee1ab8 through eb9228a Path Traversal via DownloadFile15 Nov 20268.8
CVE-2026-129465Zr.Admin.NET commit af07ffc through eb9228a IDOR via /system/user/profile15 Nov 20268.8
CVE-2026-129466Zr.Admin.NET commit 1845017 through eb9228a Missing Authorization via /system/Tasks/get15 Nov 20265.3
CVE-2026-129356vllm-project vllm Common Prefix single_type_kv_cache_manager.py race condition15 Nov 20265.0
CVE-2026-129355sigoden dufs WebDAV COPY Operation server.rs authorization15 Nov 20266.9
CVE-2026-129354D-Link DIR-600L HNAP cgibin hnap_main stack-based overflow15 Nov 202610.0
CVE-2026-129353D-Link DIR-600L authentication.cgi authenticationcgi_main stack-based overflow14 Nov 202610.0
CVE-2026-129352TRENDnet TEW-657BRM upgrade_flash.cgi stack-based overflow14 Nov 20269.4
CVE-2026-129351TRENDnet TEW-657BRM mini_httpd setup.cgi sprintf out-of-bounds write14 Nov 202610.0
CVE-2015-10149Dancer versions before 1.3400 for Perl pass unvalidated session ids from the session cookie to the session engine14 Nov 2026
CVE-2026-129456frr: bgpd use-after-free of Tunnel Encapsulation sub-TLVs after a malformed attribute length from a peer14 Nov 20267.7
CVE-2026-129447Kroki before 0.36.0 Reflected XSS via DBML Table URLs14 Nov 20266.1
CVE-2026-129267sergix44 XBackBone MediaController.php getRawById cross site scripting14 Nov 20265.1
CVE-2026-129264sox_ng VOC Decoder voc.c read_samples_voc out-of-bounds write14 Nov 20266.5
CVE-2026-129262Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System ws.asmx DiyFileUpload unrestricted upload14 Nov 20267.5
CVE-2026-129261Kingston FURY CTRL RGB Control Software IOCTL NTIOLib_X64.sys exposed ioctl with insufficient access control14 Nov 20269.3
CVE-2026-129260Mereithhh VanBlog Custom local.provider.ts fs.readFileSync path traversal14 Nov 20266.6
CVE-2026-116753Multi Step for Contact Form 7 <= 2.9.1 - Unauthenticated Stored Cross-Site Scripting via Multipart Field Name14 Nov 20267.2
CVE-2026-127115BuddyForms <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'title' Attribute of [bf_login_form] Shortcode14 Nov 20265.4
CVE-2026-120687Lightbox & Modal Popup WordPress Plugin <= 2.8.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Image Alt Attribute in .wp-caption Containers14 Nov 20267.2
CVE-2026-110531FV Player 8 <= 8.1.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Popup' Shortcode Attribute via Profile Video14 Nov 20266.4
CVE-2026-129259Mereithhh VanBlog Image Upload Endpoint access.ts cross site scripting14 Nov 20265.1
CVE-2026-129258Tenda AC18 Firmware Upgrade upgrade data authenticity14 Nov 20269.4
CVE-2011-10042HTTP::Session versions before 0.43 for Perl allow memcached command injection via unfiltered session ids in HTTP::Session::Store::Memcached14 Nov 2026
CVE-2026-19907Shipo 1.6 - 1.8.0 - Authentication Bypass to Administrator14 Nov 20269.8
CVE-2026-18053MemberDash <= 1.8.7 - Authenticated (Subscriber+) Privilege Escalation to Administrator via Edit Profile 'id' Parameter14 Nov 20268.8