HackZoneLabs News
Newsletter

CVE records

39839 records, newest first. We hold CVEs that were published recently, that are in the CISA KEV catalogue, or that an article mentions.

CVETitlePublishedTop scoreKEV
CVE-2026-124010Dixell/Copeland XWEB EVO Unauthenticated Command Injection via xwconsole.cgi12 Nov 20269.8
CVE-2026-124009Dixell/Copeland XWEB EVO OS Command Injection via backup.lua12 Nov 20268.6
CVE-2026-124008Dixell/Copeland XWEB EVO OS Command Injection via devices.lua12 Nov 20268.6
CVE-2026-124007Dixell/Copeland XWEB EVO Pre-Auth OS Command Injection via Password Field12 Nov 20269.2
CVE-2026-124006Dixell/Copeland XWEB EVO Predictable Root Password Generation12 Nov 20269.2
CVE-2026-124005Dixell/Copeland XWEB EVO Predictable Administrator Password Generation12 Nov 20269.2
CVE-2026-124004Dixell/Copeland XWEB EVO Hardcoded Administrator Backdoor Password12 Nov 20269.8
CVE-2026-68548Algernon: Case-insensitive filesystem lets unauthenticated requests bypass /admin,/repo,/data permission-prefix gate12 Nov 20269.4
CVE-2026-124003Dixell/Copeland XWEB Setuid Lua CGI Root Command Injection12 Nov 20268.5
CVE-2026-045512 Nov 20265.9
CVE-2026-124002Dixell/Copeland XWEB EVO Pre-Auth OS Command Injection via Username12 Nov 20269.8
CVE-2026-046012 Nov 20261.0
CVE-2025-004312 Nov 20267.0
CVE-2024-2196312 Nov 20266.0
CVE-2025-5450712 Nov 20265.9
CVE-2024-3634412 Nov 20266.9
CVE-2026-010112 Nov 20266.8
CVE-2026-000412 Nov 20265.7
CVE-2025-5450112 Nov 20265.9
CVE-2024-2195412 Nov 20267.0
CVE-2026-043612 Nov 20266.9
CVE-2026-18379Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepo12 Nov 20268.8
CVE-2026-127119Unverified ownership of the default EMR cluster log location in AWS SDK for pandas12 Nov 20265.9
CVE-2026-126204express-rate-limit skipFailedRequests / skipSuccessfulRequests: with the default MemoryStore, a request from an earlier window is still un-counted from the current window12 Nov 20263.7
CVE-2026-126838Rust Driver public Client Debug output exposes CSFLE KMS master-key material12 Nov 20265.7
CVE-2026-120033frr: bgpd Send Hold Timer expiry bypasses the FSM, leaving a phantom Established session or crashing bgpd with Graceful Restart12 Nov 20266.0
CVE-2026-117544Joomla Extension - jdownloads.com - IDOR allowing restricted file downloads in jDownloads < 4.1.812 Nov 20268.2
CVE-2026-126203Loofah: Mutation XSS in the HTML5 scrubbers through unescaped attribute values12 Nov 20266.1
CVE-2026-127235OpenNMS reflected cross-site scripting in the web UI via request parameters12 Nov 20266.1
CVE-2026-121619Symfony: The "private_ranges" Trusted Proxies Shortcut Trusts Clients Presenting an IPv4-Mapped, 6to4, Teredo or NAT64 Address as Reverse Proxies12 Nov 20266.3
CVE-2026-117542Joomla Extension - jdownloads.com - Authenticated path traversal in jDownloads < 4.1.812 Nov 20265.1
CVE-2026-127236OpenNMS argument injection in ad-hoc RRD graphs12 Nov 20265.4
CVE-2026-120467Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.112 Nov 20267.1
CVE-2026-120468Joomla Extension - acymailing.com - Unauthenticated disclosure of mailing list metadata in AcyMailing 1.0.0 - 11.1.112 Nov 20266.9
CVE-2026-117551Joomla Extension - jdownloads.com - RCE through file upload in jDownloads < 4.1.812 Nov 202610.0
CVE-2026-120471Joomla Extension - acymailing.com - Site modules rendered outside their access level in AcyMailing 1.0.0 - 11.1.112 Nov 20266.9
CVE-2026-120470Joomla / WordPress Extension - acymailing.com - Online version of an email readable without the visibility check in AcyMailing 1.0.0 - 11.1.112 Nov 20266.9
CVE-2026-120466Joomla / WordPress Extension - acymailing.com - Missing authorization on subscription changes in AcyMailing 1.0.0 - 11.1.112 Nov 20268.8
CVE-2026-120469Joomla / WordPress Extension - acymailing.com - Open redirect on the subscription and unsubscription endpoints in AcyMailing 1.0.0 - 11.1.112 Nov 20265.1
CVE-2026-117550Joomla Extension - jdownloads.com - Publishing of files without approval in jDownloads < 4.1.812 Nov 20267.1
CVE-2026-117543Joomla Extension - jdownloads.com - SSRF via external download URL field jDownloads < 4.1.812 Nov 20268.9
CVE-2026-127101Sssd: sssd: null pointer dereference in pam responder when protocol version negotiation is skipped12 Nov 20265.5
CVE-2026-127100Sssd: sssd: local denial of service through unchecked oauth2 json code type in pam responder12 Nov 20265.5
CVE-2026-127099Sssd: sssd: stack buffer overflow during rsa certificate-to-ssh key conversion12 Nov 20265.9
CVE-2026-118495Joomla / WordPress Extension - acymailing.com - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 - 11.1.112 Nov 20268.8
CVE-2026-12706312 Nov 20269.3
CVE-2026-127204WooCommerce PayPal Pro Payment Gateway < 4.1.1 Payment Bypass via pp_capture_order12 Nov 20268.7
CVE-2026-106475Elasticsearch data source resource proxy allows arbitrary methods and paths with the data source's credentials12 Nov 20267.1
CVE-2026-107365Unintended API access through the Google Cloud Monitoring data source resource proxy12 Nov 20265.3
CVE-2026-81843Memory exhaustion denial of service in Elasticsearch data source index patterns12 Nov 20266.5