HackZoneLabs News
Newsletter

CVE records

39918 records, newest first. We hold CVEs that were published recently, that are in the CISA KEV catalogue, or that an article mentions.

CVETitlePublishedTop scoreKEV
CVE-2026-12690911 Nov 20269.6
CVE-2026-12687811 Nov 20264.3
CVE-2026-12691911 Nov 20268.8
CVE-2026-12691211 Nov 20269.6
CVE-2026-12687011 Nov 20264.7
CVE-2026-12688711 Nov 20268.8
CVE-2026-12688611 Nov 20268.8
CVE-2026-12685911 Nov 20269.6
CVE-2026-12688911 Nov 20268.8
CVE-2026-12686411 Nov 20268.8
CVE-2026-12691111 Nov 20268.8
CVE-2026-12684611 Nov 20269.6
CVE-2026-12687911 Nov 20268.8
CVE-2026-12689511 Nov 20268.8
CVE-2026-12688511 Nov 20269.6
CVE-2026-125637Konflux-ci: unvalidated hostname fields enable caddyfile config injection in the konflux ui proxy generator, allowing an unauthenticated route to be spliced ahead of the forward_auth/impersonate authorization chain11 Nov 20267.2
CVE-2026-68549ClickMigrate has Path Traversal in "revision -m" argument11 Nov 20263.3
CVE-2026-68540fulgur: Quadratic style-list reprocessing during containing-block resolution for absolutely-positioned pseudo-elements causes denial of servicefulgur:11 Nov 20267.5
CVE-2026-68539fulgur: Unbounded string-set value accumulation causes memory/CPU exhaustion (denial of service)11 Nov 20267.5
CVE-2026-68538fulgur: Unbounded counters() expansion in generated content causes memory/CPU exhaustion (denial of service)11 Nov 20267.5
CVE-2026-68512Paaster: No rate limiting on account login, combined with a public username-enumeration/salt endpoint, enables offline credential-stuffing11 Nov 20266.3
CVE-2026-11152111 Nov 20267.0
CVE-2026-68511Paaster: TOCTOU race condition defeats the 'burn after reading' guarantee on view-once pastes11 Nov 20266.3
CVE-2026-67449Portabase: Unauthenticated path traversal in TUS webhook overwrites AES-256-GCM master key11 Nov 20269.8
CVE-2026-65971Livewire PowerGrid: SQL Injection through the public `sortDirection` Livewire property in the `naturalSort` order-by path11 Nov 20267.6
CVE-2026-67547taOS: Authenticated Non-Admin Host Code Execution via Skill Runtime11 Nov 20268.8
CVE-2026-67548taOS: Non-Admin Users Can Access System Settings and Update Actions11 Nov 20268.3
CVE-2026-67546Heym: Command execution via POST /api/mcp/fetch-tools stdio transport: supplied command is spawned before MCP validation11 Nov 20268.8
CVE-2026-67545Heym: Server-Side Request Forgery (SSRF) in HTTP Workflow Node11 Nov 20267.4
CVE-2026-67544Heym: Playwright Custom Code Backend RCE via `playwrightCode` Field11 Nov 20268.8
CVE-2026-67543Heym Unsandboxed skill code execution: skills run via a local backend subprocess without the Docker isolation that Python tools mandate11 Nov 20268.8
CVE-2026-67542Heym: SSRF via POST /api/mcp/fetch-tools: any authenticated user reaches local/private URLs through the SSE and streamable-HTTP transports11 Nov 20267.1
CVE-2026-67541Heym: Missing role gate in team-member management lets any member add/remove members, exposing team-shared credentials11 Nov 20268.1
CVE-2026-67540Heym - Horizontal IDOR: get-by-id on workflow/node templates skips the visibility check the list path enforces11 Nov 20266.5
CVE-2026-12622911 Nov 20269.1
CVE-2026-12626211 Nov 20269.3
CVE-2026-12152811 Nov 20267.7
CVE-2026-12625911 Nov 20269.0
CVE-2026-12626311 Nov 20269.4
CVE-2026-12625511 Nov 20267.4
CVE-2026-12625611 Nov 20267.4
CVE-2026-12152711 Nov 20266.3
CVE-2026-12625411 Nov 20269.6
CVE-2026-12625811 Nov 20267.1
CVE-2026-12625711 Nov 20269.0
CVE-2026-12152611 Nov 20265.8
CVE-2026-12625311 Nov 20269.3
CVE-2026-12625211 Nov 20268.3
CVE-2026-12625111 Nov 20269.1
CVE-2026-12625011 Nov 20268.2