HackZoneLabs News
Newsletter

CVE records

39888 records, newest first. We hold CVEs that were published recently, that are in the CISA KEV catalogue, or that an article mentions.

CVETitlePublishedTop scoreKEV
CVE-2026-19421Authenticated Injection12 Nov 20268.8
CVE-2026-127046MISP Modules Website Exposes External Tool API Keys in /external_tools/list Response12 Nov 20269.2
CVE-2026-124705URL Redirection to Untrusted Site in Progress Telerik UI for .NET MAUI12 Nov 20267.8
CVE-2026-127036ibi WebFOCUS - OS Command Injection Vulnerability12 Nov 20268.6
CVE-2026-13764Masterstudy - Education WordPress Theme <= 4.8.151 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation12 Nov 20268.8
CVE-2026-16135VibeBP <= 1.9.9.8.1 - Authenticated (Subscriber+) Privilege Escalation in set_email_notification_settings()12 Nov 20268.8
CVE-2026-2982WP Table Builder – Drag & Drop Table Builder <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'url'12 Nov 20265.4
CVE-2026-15309CourseCure Courses <= 1.5.1 - Authenticated (Subscriber+) Privilege Escalation to 'ajax_save_settings' Endpoint12 Nov 20268.8
CVE-2026-114369Security Issue CVE-2026-114369 - Resource exhaustion (denial of service) vulnerability in the WebSocket handshake handling of QWebSocket and QWebSocketServer impacts Qt Framework12 Nov 20262.7
CVE-2026-124704Deserialization of Untrusted Data in Progress Telerik UI for WPF12 Nov 20267.8
CVE-2026-124703Improper Control of Generation of Code in Progress Telerik UI for WPF12 Nov 20267.8
CVE-2026-126644Ansible.posix: authorized_key module follows a parent-directory symlink allowing writes outside the intended directory12 Nov 20263.9
CVE-2026-126643Aap-gateway-operator: resource-server secret exposed in plaintext in the automationcontroller custom resource12 Nov 20266.5
CVE-2026-126641Ansible-pylibssh: accepts a changed ssh host key when host_key_auto_add is enabled12 Nov 20266.5
CVE-2026-124701Deserialization of Untrusted Data in Progress Telerik UI for WinForms12 Nov 20267.8
CVE-2026-124023Apache Axis2/C: Out-of-bounds read in the Guththila XML reader wrapper12 Nov 2026
CVE-2026-123765Apache Sling XSS: xssAPI.getStyleToken() accepts markup in unquoted urls.12 Nov 2026
CVE-2026-124699Improper Control of Generation of Code in Progress Telerik UI for WinForms12 Nov 20267.8
CVE-2026-118975XML External Entity (XXE) Injection in Telerik Reporting SVG Processing12 Nov 20266.5
CVE-2026-127016MISP Modules Website: Missing Authorization on External Tool Management Endpoints12 Nov 20269.2
CVE-2026-106140Deserialization of Untrusted Data in Telerik Reporting Report Designers12 Nov 20267.3
CVE-2026-76173SQL Injection in WhatsApp for Dolibarr by Sgestion / EasySoft12 Nov 20268.8
CVE-2026-90908Azul Payara JMX/RMI Remote Authentication Bypass Leading to Remote Code Execution via GenericAdminAuthenticator12 Nov 20269.3
CVE-2026-110003Azul Payara Administration REST Interface Authentication Bypass via X-GlassFish-authToken Header Leading to Remote Code Execution12 Nov 20269.3
CVE-2026-126642Awx: webhook credential assignment omits use_role check, exposing another user's token12 Nov 20266.5
CVE-2026-47832OpenStack Application Credentials Logged in Cleartext to BOSH Debug Logs12 Nov 20267.3
CVE-2026-40820Authenticated SQLi in getVpnData function12 Nov 20266.9
CVE-2026-125836WordPress Simple JWT Login plugin <= 3.6.8 - Cross Site Request Forgery (CSRF) vulnerability12 Nov 20268.8
CVE-2026-126991SPARQL Injection in MISP Wikidata Lookup Module via Unescaped User Input12 Nov 20265.3
CVE-2026-118855Akaunting 3.3.0 - Stored XSS in invoice edit form through imported status12 Nov 20267.0
CVE-2026-82292NULL pointer dereference vulnerability in QDomDocument::setContent() XML parsing impacts Qt12 Nov 20261.9
CVE-2026-113408Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Git12 Nov 20263.3
CVE-2026-12591Privilege Escalation12 Nov 20269.9
CVE-2026-12507Authenticated remote code execution12 Nov 20269.1
CVE-2026-87772Unauthenticated Polkit Privilege Escalation in TÜBİTAK BİLGEM's Pardus About12 Nov 20267.8
CVE-2026-8331TimePictra ermote code execution via file upload12 Nov 20268.8
CVE-2026-8332TimePictra root password hardcoded in installation files12 Nov 20268.8
CVE-2026-8333TimePictra Stored Cross-site Scripting12 Nov 20269.4
CVE-2026-118597Akaunting 3.3.0 - Stored XSS in custom invoice payment terms12 Nov 20267.2
CVE-2026-76792User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP Login Verification12 Nov 20268.1
CVE-2026-124817Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification12 Nov 20265.3
CVE-2026-124815Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions12 Nov 202610.0
CVE-2026-124814Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticated Arbitrary File Upload via 'type' Parameter12 Nov 20269.8
CVE-2026-124665Order Tracking < 3.6.2 - Unauthenticated Customer and Sales Rep Order History Disclosure via IDOR12 Nov 20265.3
CVE-2026-124653Mine CloudVod < 2.6.6 - Unauthenticated Cloud Storage Credential Disclosure12 Nov 20266.5
CVE-2026-124652Mine CloudVod < 2.6.6 - Subscriber+ Order Information Disclosure via IDOR12 Nov 20264.3
CVE-2026-124648TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Wishlist Item Deletion via Share Key12 Nov 20265.3
CVE-2026-124647TI WooCommerce Wishlist < 2.0.7 - Unauthenticated SQLi via tinv_wishlistkey Cookie12 Nov 20268.6
CVE-2026-123092WP Remote Users Sync < 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync Action12 Nov 20267.5
CVE-2026-123044ContentPen < 1.1.1 - Unauthenticated Stored XSS via API Key Disclosure12 Nov 20267.5