HackZoneLabs News
Newsletter

CVE records

39800 records, newest first. We hold CVEs that were published recently, that are in the CISA KEV catalogue, or that an article mentions.

CVETitlePublishedTop scoreKEV
CVE-2026-126817Mongoid stores encrypted fields in plaintext when two models share a collection13 Nov 20266.5
CVE-2026-105625Zenitel Connect web interface loads integration iframe without sandboxing or origin restriction13 Nov 20265.1
CVE-2026-129099Cudy TR3000 before 2.5.42 Root RCE via OpenVPN Configuration Import13 Nov 20268.6
CVE-2026-129100Cudy TR3000 before 2.5.42 Root RCE via OpenVPN Key Upload Injection13 Nov 20268.6
CVE-2026-129101Cudy TR3000 before 2.5.42 Authenticated RCE via vpn.set_conf Mass Assignment13 Nov 20268.6
CVE-2026-129102Cudy TR3000 before 2.5.42 Command Injection via vpn.set_conf IPsec keyexchange13 Nov 20268.6
CVE-2026-129103Cudy TR3000 before 2.5.42 Command Injection via Scheduled Reboot Time13 Nov 20268.6
CVE-2026-129104Cudy TR3000 before 2.5.42 dnsmasq Configuration Injection via net.set_dhcp13 Nov 20267.0
CVE-2026-129105Cudy TR3000 before 2.5.42 pppd Option Injection via net.set_wan L2TP Credentials13 Nov 20267.0
CVE-2026-105671Zenitel Connect login allows username enumeration via verbose error responses13 Nov 20266.9
CVE-2026-10381313 Nov 20269.1
CVE-2026-8217413 Nov 20264.3
CVE-2026-128037gittuf: Policy rules bypassed in the presence of global rules13 Nov 20266.5
CVE-2026-128036gittuf: Invalid intermediate policies trusted when the policy apply workflow is bypassed13 Nov 20262.3
CVE-2026-128035gittuf: Propagated controller policies not loaded during verification13 Nov 20265.5
CVE-2026-128034gittuf: File protection rules bypassed for filenames with special characters13 Nov 20265.5
CVE-2026-109091X.Org Server EDID DS_RANGES Out-Of-Bounds Write13 Nov 20267.8
CVE-2026-129094@utcp/http before 1.1.14 SSRF to Loopback via Host Placeholder in Call Templates13 Nov 20264.7
CVE-2026-63079RBH Integra32 5.1.11 .NET Remoting Deserialization RCE13 Nov 20269.8
CVE-2026-11154513 Nov 20268.8
CVE-2026-129092CCC Attestation SIG attested-tls-poc through commit 731ca82 TOCTOU via Handshake-Only Attestation13 Nov 20267.0
CVE-2026-125432WordPress reCAPTCHA for WooCommerce plugin <= 1.4.7 - Broken Authentication vulnerability13 Nov 20265.3
CVE-2026-119517WordPress Catna – Woo Name Your Price and Offers plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability13 Nov 20267.1
CVE-2026-124415WordPress Alex Reservations plugin <= 2.4.8 - SQL Injection vulnerability13 Nov 20269.3
CVE-2026-124410WordPress Translate and boost SEO – Automatic AI translation – wpLingua plugin <= 3.1.1 - Cross Site Scripting (XSS) vulnerability13 Nov 20267.1
CVE-2026-124965WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.16 - Cross Site Scripting (XSS) vulnerability13 Nov 20266.5
CVE-2026-124265WordPress Newsletters plugin <= 4.18.1 - SQL Injection vulnerability13 Nov 20268.5
CVE-2026-124414WordPress Broadcast Live Video plugin <= 7.3.15 - Broken Authentication vulnerability13 Nov 20265.3
CVE-2026-124418WordPress WP Job Portal plugin <= 2.7.2 - Cross Site Scripting (XSS) vulnerability13 Nov 20266.5
CVE-2026-124267WordPress Gmail SMTP plugin <= 1.2.3.23 - Broken Access Control vulnerability13 Nov 20267.5
CVE-2026-124272WordPress Salon booking system plugin <= 10.31.14 - Cross Site Scripting (XSS) vulnerability13 Nov 20267.1
CVE-2026-121776WordPress Passster plugin <= 4.3.20 - Broken Access Control vulnerability13 Nov 20266.5
CVE-2026-124260WordPress WP Photo Album Plus plugin <= 9.3.06.001 - Cross Site Scripting (XSS) vulnerability13 Nov 20267.1
CVE-2026-124420WordPress Woody ad snippets plugin <= 2.7.10 - Cross Site Scripting (XSS) vulnerability13 Nov 20267.1
CVE-2026-119512WordPress Newsletters plugin <= 4.18.2 - PHP Object Injection vulnerability13 Nov 20268.8
CVE-2026-125783WordPress Custom Post Types and Custom Fields creator – WCK plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability13 Nov 20267.1
CVE-2026-120835WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.11 - PHP Object Injection vulnerability13 Nov 20268.8
CVE-2026-124970WordPress WP BASE Booking plugin <= 6.5.2 - SQL Injection vulnerability13 Nov 20269.3
CVE-2026-125851WordPress Hotel Booking Lite theme <= 2.5.1 - Arbitrary File Upload vulnerability13 Nov 20269.9
CVE-2026-125858WordPress CleverReach® WP plugin <= 1.5.26 - Broken Access Control vulnerability13 Nov 20266.3
CVE-2026-125856WordPress Dynamic User Directory plugin <= 2.4 - Cross Site Scripting (XSS) vulnerability13 Nov 20267.1
CVE-2026-125854WordPress Unbounce Landing Pages plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability13 Nov 20267.1
CVE-2026-125855WordPress ELEX WordPress HelpDesk & Customer Ticketing System plugin <= 3.3.9 - PHP Object Injection vulnerability13 Nov 20269.8
CVE-2026-125837WordPress Make theme <= 1.10.10 - Cross Site Scripting (XSS) vulnerability13 Nov 20267.1
CVE-2026-125853WordPress Everest Backup plugin <= 2.3.14 - Broken Access Control vulnerability13 Nov 20266.5
CVE-2026-125852WordPress Realtyna Organic IDX plugin plugin <= 5.4.2 - Arbitrary File Deletion vulnerability13 Nov 20267.7
CVE-2026-103769WordPress PDF Invoices and Packing Slips For WooCommerce plugin <= 1.4.10 - PHP Object Injection vulnerability13 Nov 20267.2
CVE-2026-125452WordPress WPJAM Basic plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerability13 Nov 20267.1
CVE-2026-8217513 Nov 20263.8
CVE-2026-123975Grid Community Toolkit globus-gss-assist before 12.9 Pre-Authentication Heap Out-of-Bounds Write13 Nov 20268.7