moonge
Patchstack Bug Bounty Program
20 kredili kayıt · son 12 ayda 20 · 0 tanesi CISA KEV’de
Adlar CNA kayıtlarındaki serbest metindir; aynı kişi farklı yazımlarla ayrı görünebilir. Düzeltme için bize yazın.
Bu ad yeni bir CVE'de kredilendirildiğinde haber alın
Kendi adınızsa kayıtlarınızı izlemenin en kolay yolu: yeni kayıt yayımlandığında günlük e-posta özetinde bildiririz.
Kredili kayıtlar
Araştırmacılar| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
35İzleyin | CVE-2026-89426İstismar yok | Knit Pay <= 9.6.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms Role Fieldknitpay · knit pay – cashfree, instamojo, razorpay, paypal and more · CWE-269 | Yüksek8,8 | — | %0,4 | 25 Eyl 2026 |
39İzleyin | CVE-2026-75800İstismar yok | Frontegg SAML SSO <= 1.0.1 - Unauthenticated Account Takeover via Unverified SAMLResponseunknown · frontegg saml sso · CWE-287 | Kritik9,8 | — | %0,6 | 12 Eyl 2026 |
32İzleyin | CVE-2026-14873İstismar yok | Bulk Password Reset <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Resetrubenw · bulk password reset · CWE-862 | Yüksek8,0 | — | %0,2 | 10 Eyl 2026 |
39İzleyin | CVE-2026-16259İstismar yok | Uix UserCenter <= 1.0.3 - Unauthenticated Privilege Escalationunknown · uix usercenter · CWE-269 | Kritik9,8 | — | %0,2 | 29 Ağu 2026 |
26İzleyin | CVE-2026-73402İstismar yok | WordPress WP BASE Booking plugin <= 6.3.2 - Cross Site Scripting (XSS) vulnerabilityhakan ozevin · wp base booking · CWE-79 | Orta6,5 | — | %0,2 | 20 Ağu 2026 |
39İzleyin | CVE-2026-18031İstismar yok | TabaPay Gateway <= 1.4.0 - Unauthenticated Account Takeover via Payment Callbackunknown · tabapay gateway · CWE-287 | Kritik9,8 | — | %0,4 | 19 Ağu 2026 |
39İzleyin | CVE-2026-15341İstismar yok | User Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parametersrafasashi · user session synchronizer · CWE-287 | Kritik9,8 | — | %0,5 | 14 Ağu 2026 |
39İzleyin | CVE-2026-15303İstismar yok | 6Storage Rentals <= 2.27.0 - Unauthenticated Account Takeover via 'email' Parametersixstorage · 6storage rentals · CWE-287 | Kritik9,8 | — | %0,8 | 14 Ağu 2026 |
32İzleyin | CVE-2026-18030İstismar yok | Bricksforge < 3.1.8.8 - Unauthenticated Arbitrary Password Reset via Pro Formsunknown · bricksforge · CWE-862 | Yüksek8,1 | — | %0,3 | 10 Ağu 2026 |
39İzleyin | CVE-2026-16299İstismar yok | Single Sign On For TNG < 2.2.0 - Unauthenticated Arbitrary Password Resetunknown · single sign on for tng · CWE-287 | Kritik9,8 | — | %0,4 | 10 Ağu 2026 |
39İzleyin | CVE-2026-16298İstismar yok | FoodBoxBooker < 1.0.7 - Unauthenticated Arbitrary Password Resetunknown · foodboxbooker · CWE-269 | Kritik9,8 | — | %0,4 | 10 Ağu 2026 |
32İzleyin | CVE-2026-13600İstismar yok | AutoNetTV Relay < 3.0.14 - Unauthenticated Privilege Escalation via Scheduled Sync Cronunknown · autonettv relay · CWE-287 | Yüksek8,1 | — | %0,4 | 10 Ağu 2026 |
39İzleyin | CVE-2026-16300İstismar yok | Chama < 1.0.13 - Unauthenticated Arbitrary User Password Resetunknown · chamawp · CWE-862 | Kritik9,8 | — | %0,4 | 3 Ağu 2026 |
32İzleyin | CVE-2026-12586İstismar yok | Lenxel WP <= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password Resetunknown · lenxel wp · CWE-287 | Yüksek8,1 | — | %0,2 | 2 Ağu 2026 |
35İzleyin | CVE-2026-16635İstismar yok | Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Fieldpronamic · pronamic pay · CWE-269 | Yüksek8,8 | — | %0,5 | 1 Ağu 2026 |
32İzleyin | CVE-2026-14309İstismar yok | Chat On Desk < 1.0.9 - Unauthenticated Account Takeover via Password Reset OTP Bypassunknown · chat on desk order notifications · CWE-287 | Yüksek8,1 | — | %0,3 | 1 Ağu 2026 |
40Planlayın | CVE-2026-12394Kavram kanıtı | MemberGlut < 1.1.5 - Unauthenticated Privilege Escalation to Administratorunknown · memberglut · CWE-269 | Kritik9,8 | — | %2,0 | 27 Tem 2026 |
30İzleyin | CVE-2026-12981İstismar yok | CAFEHAUS API <= 1.0.0 - Unauthenticated Arbitrary User Password Resetunknown · cafehaus api · CWE-269 | Yüksek7,5 | — | %0,5 | 24 Tem 2026 |
35İzleyin | CVE-2026-15017İstismar yok | MDJM Event Management <= 1.7.8.4 - Authenticated (Subscriber+) Privilege Escalation via 'set-permissions' and 'change_role' Handlersmdjm · mdjm event management · CWE-269 | Yüksek8,8 | — | %0,6 | 23 Tem 2026 |
39İzleyin | CVE-2026-12492İstismar yok | Happy Coders OTP Login for WooCommerce < 2.8 - Unauthenticated Account Takeover via hcotp_auto_login_userunknown · happy coders otp login for woocommerce · CWE-287 | Kritik9,8 | — | %0,4 | 16 Tem 2026 |
- CVE-2026-8942635İzleyin
Knit Pay <= 9.6.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms Role Field
YüksekCVSS 8,8İstismar yokEPSS %0knitpay · knit pay – cashfree, instamojo, razorpay, paypal and more25 Eyl 2026
- CVE-2026-7580039İzleyin
Frontegg SAML SSO <= 1.0.1 - Unauthenticated Account Takeover via Unverified SAMLResponse
KritikCVSS 9,8İstismar yokEPSS %0unknown · frontegg saml sso12 Eyl 2026
- CVE-2026-1487332İzleyin
Bulk Password Reset <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset
YüksekCVSS 8,0İstismar yokEPSS %0rubenw · bulk password reset10 Eyl 2026
- CVE-2026-1625939İzleyin
Uix UserCenter <= 1.0.3 - Unauthenticated Privilege Escalation
KritikCVSS 9,8İstismar yokEPSS %0unknown · uix usercenter29 Ağu 2026
- CVE-2026-7340226İzleyin
WordPress WP BASE Booking plugin <= 6.3.2 - Cross Site Scripting (XSS) vulnerability
OrtaCVSS 6,5İstismar yokEPSS %0hakan ozevin · wp base booking20 Ağu 2026
- CVE-2026-1803139İzleyin
TabaPay Gateway <= 1.4.0 - Unauthenticated Account Takeover via Payment Callback
KritikCVSS 9,8İstismar yokEPSS %0unknown · tabapay gateway19 Ağu 2026
- CVE-2026-1534139İzleyin
User Session Synchronizer <= 1.4.0 - Unauthenticated Authentication Bypass to Account Takeover via 'ussync-key', 'ussync-token', and 'ussync-ref' Parameters
KritikCVSS 9,8İstismar yokEPSS %0rafasashi · user session synchronizer14 Ağu 2026
- CVE-2026-1530339İzleyin
6Storage Rentals <= 2.27.0 - Unauthenticated Account Takeover via 'email' Parameter
KritikCVSS 9,8İstismar yokEPSS %0sixstorage · 6storage rentals14 Ağu 2026
- CVE-2026-1803032İzleyin
Bricksforge < 3.1.8.8 - Unauthenticated Arbitrary Password Reset via Pro Forms
YüksekCVSS 8,1İstismar yokEPSS %0unknown · bricksforge10 Ağu 2026
- CVE-2026-1629939İzleyin
Single Sign On For TNG < 2.2.0 - Unauthenticated Arbitrary Password Reset
KritikCVSS 9,8İstismar yokEPSS %0unknown · single sign on for tng10 Ağu 2026
- CVE-2026-1629839İzleyin
FoodBoxBooker < 1.0.7 - Unauthenticated Arbitrary Password Reset
KritikCVSS 9,8İstismar yokEPSS %0unknown · foodboxbooker10 Ağu 2026
- CVE-2026-1360032İzleyin
AutoNetTV Relay < 3.0.14 - Unauthenticated Privilege Escalation via Scheduled Sync Cron
YüksekCVSS 8,1İstismar yokEPSS %0unknown · autonettv relay10 Ağu 2026
- CVE-2026-1630039İzleyin
Chama < 1.0.13 - Unauthenticated Arbitrary User Password Reset
KritikCVSS 9,8İstismar yokEPSS %0unknown · chamawp3 Ağu 2026
- CVE-2026-1258632İzleyin
Lenxel WP <= 1.0.31 - Unauthenticated Account Takeover via Arbitrary Password Reset
YüksekCVSS 8,1İstismar yokEPSS %0unknown · lenxel wp2 Ağu 2026
- CVE-2026-1663535İzleyin
Pronamic Pay <= 10.1.0 - Authenticated (Subscriber+) Privilege Escalation via Gravity Forms 'Update user role' Field
YüksekCVSS 8,8İstismar yokEPSS %0pronamic · pronamic pay1 Ağu 2026
- CVE-2026-1430932İzleyin
Chat On Desk < 1.0.9 - Unauthenticated Account Takeover via Password Reset OTP Bypass
YüksekCVSS 8,1İstismar yokEPSS %0unknown · chat on desk order notifications1 Ağu 2026
- CVE-2026-1239440Planlayın
MemberGlut < 1.1.5 - Unauthenticated Privilege Escalation to Administrator
KritikCVSS 9,8Kavram kanıtıEPSS %2unknown · memberglut27 Tem 2026
- CVE-2026-1298130İzleyin
CAFEHAUS API <= 1.0.0 - Unauthenticated Arbitrary User Password Reset
YüksekCVSS 7,5İstismar yokEPSS %0unknown · cafehaus api24 Tem 2026
- CVE-2026-1501735İzleyin
MDJM Event Management <= 1.7.8.4 - Authenticated (Subscriber+) Privilege Escalation via 'set-permissions' and 'change_role' Handlers
YüksekCVSS 8,8İstismar yokEPSS %0mdjm · mdjm event management23 Tem 2026
- CVE-2026-1249239İzleyin
Happy Coders OTP Login for WooCommerce < 2.8 - Unauthenticated Account Takeover via hcotp_auto_login_user
KritikCVSS 9,8İstismar yokEPSS %0unknown · happy coders otp login for woocommerce16 Tem 2026