İçeriğe atla
Noroxi

Yayın tarihine göre

Ocak 2026: sömürülen ve yeni ciddi CVE kayıtları

271 kayıt · 16 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 1 / 3

  • CVE-2026-21436
    23İzleyin

    eopkg has Path Traversal: '../filedir' vulnerability

    OrtaCVSS 5,8Kavram kanıtıEPSS %0

    getsol · eopkg1 Oca 2026

  • CVE-2026-21437
    8İzleyin

    eopkg vulnerable to package file list integrity bypass

    DüşükCVSS 2,0Kavram kanıtıEPSS %0

    getsol · eopkg1 Oca 2026

  • CVE-2025-47411
    37İzleyin

    Apache StreamPipes: Leverage of User ID for Privilege Escalation

    YüksekCVSS 8,1İstismar yokEPSS %15

    apache · streampipes1 Oca 2026

  • CVE-2025-66398
    41Planlayın

    Signal K Server has Unauthenticated State Pollution leading to Remote Code Execution (RCE)

    YüksekCVSS 8,8Kavram kanıtıEPSS %19

    signalk · signal k server1 Oca 2026

  • CVE-2025-68273
    21İzleyin

    Signal K Server Vulnerable to Unauthenticated Information Disclosure via Exposed Endpoints

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    signalk · signal k server1 Oca 2026

  • CVE-2025-14047
    21İzleyin

    WP User Frontend <= 4.2.4 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    wedevs · user frontend: ai powered frontend posting, user directory, profile, membership & user registration1 Oca 2026

  • CVE-2025-14998
    40Planlayın

    Branda – White Label & Branding, Free Login Page Customizer <= 3.4.24 - Unauthenticated Privilege Escalation via Account Takeover

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    wpmudev · branda – white label & branding, free login page customizer1 Oca 2026

  • CVE-2024-55374
    21İzleyin

    REDCap 14.3.13 allows an attacker to enumerate usernames due to an observable discrepancy between login attempts.

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    vanderbilt · redcap2 Oca 2026

  • CVE-2025-67158
    30İzleyin

    An authentication bypass in the /cgi-bin/jvsweb.cgi endpoint of Revotech I6032W-FHW v1.0.0014 - 20210517 allows attackers to access sensitiv

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    revotech · i6032w-fhw firmware2 Oca 2026

  • CVE-2025-67159
    30İzleyin

    Vatilon v1.12.37-20240124 was discovered to transmit user credentials in plaintext.

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    vatilon · pa4 firmware2 Oca 2026

  • CVE-2025-67160
    30İzleyin

    An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal.

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    vatilon · pa4 firmware2 Oca 2026

  • CVE-2026-21440
    36İzleyin

    AdonisJS Path Traversal in Multipart File Handling

    KritikCVSS 9,2Kavram kanıtıEPSS %1

    adonisjs · core2 Oca 2026

  • CVE-2026-21445
    45Planlayın

    Langflow Missing Authentication on Critical API Endpoints

    YüksekCVSS 8,8Kavram kanıtıEPSS %33

    langflow · langflow2 Oca 2026

  • CVE-2025-34171
    27İzleyin

    CasaOS <= 0.4.15 Unauthenticated File and Debug Data Exposure

    OrtaCVSS 6,9Kavram kanıtıEPSS %0

    icewhale · casaos2 Oca 2026

  • CVE-2026-21484
    21İzleyin

    AnythingLLM Vulnerable to Username Enumeration w/ Password Recovery

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    mintplexlabs · anythingllm2 Oca 2026

  • CVE-2025-14124
    34İzleyin

    Team < 5.0.11 - Unauthenticated SQLi

    YüksekCVSS 8,6Kavram kanıtıEPSS %1

    unknown · team5 Oca 2026

  • CVE-2025-5965
    36İzleyin

    RCE via the backup feature available only to user with high privilege

    YüksekCVSS 7,2İstismar yokEPSS %28

    centreon · centreon web5 Oca 2026

  • CVE-2025-67303
    30İzleyin

    An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data.

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    comfy · comfyui-manager5 Oca 2026

  • CVE-2025-15029
    43Planlayın

    An unauthenticated user is able to introduce SQL Injection using the Awie export module

    KritikCVSS 9,8İstismar yokEPSS %12

    centreon · awie5 Oca 2026

  • CVE-2025-66376
    60Bu hafta

    Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import d

    OrtaCVSS 6,1KEVSilahlaştırılmışEPSS %20

    synacor · zimbra collaboration suite5 Oca 2026

  • CVE-2025-64424
    38İzleyin

    Colify has command injection vulnerability in project git source

    KritikCVSS 9,4Kavram kanıtıEPSS %2

    coollabs · coolify5 Oca 2026

  • CVE-2025-64425
    34İzleyin

    Coolify has host header injection in forgot password

    YüksekCVSS 8,5İstismar yokEPSS %0

    coollabs · coolify5 Oca 2026

  • CVE-2025-68428
    37İzleyin

    jsPDF has Local File Inclusion/Path Traversal vulnerability

    KritikCVSS 9,2Kavram kanıtıEPSS %2

    parall · jspdf5 Oca 2026

  • CVE-2025-68455
    34İzleyin

    Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

    YüksekCVSS 8,6İstismar yokEPSS %0

    craftcms · craft cms5 Oca 2026

  • CVE-2025-13652
    26İzleyin

    CBX Bookmark & Favorite <= 2.0.4 - Authenticated (Subscriber+) SQL Injection via `orderby` Parameter

    OrtaCVSS 6,5Kavram kanıtıEPSS %1

    manchumahara · cbx bookmark & favorite6 Oca 2026

  • CVE-2025-15001
    39İzleyin

    FS Registration Password <= 1.0.1 - Unauthenticated Privilege Escalation via Account Takeover

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    fsylum · fs registration password6 Oca 2026

  • CVE-2025-69336
    17İzleyin

    WordPress Ultimate Store Kit Elementor Addons plugin <= 2.9.4 - Broken Access Control vulnerability

    OrtaCVSS 4,3İstismar yokEPSS %0

    bdthemes · ultimate store kit elementor addons6 Oca 2026

  • CVE-2025-15471
    39İzleyin

    TRENDnet TEW-713RE formFSrvX os command injection

    YüksekCVSS 8,9İstismar yokEPSS %13

    trendnet · tew-713re firmware7 Oca 2026

  • CVE-2025-12030
    17İzleyin

    ACF to REST API <= 3.3.4 - Insecure Direct Object Reference to Authenticated (Contributor+) ACF Field/Option Modification

    OrtaCVSS 4,3Kavram kanıtıEPSS %0

    airesvsg · acf to rest api7 Oca 2026

  • CVE-2025-13418
    25İzleyin

    Responsive Pricing Table <= 5.1.12 - Authenticated (Author+) Stored Cross-Site Scripting

    OrtaCVSS 6,4Kavram kanıtıEPSS %0

    spwebguy · responsive pricing table7 Oca 2026

  • CVE-2025-13801
    31İzleyin

    Yoco Payments <= 3.9.0 - Unauthenticated Arbitrary File Read

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    yocoadmin · yoco payments7 Oca 2026

  • CVE-2026-0628
    41Planlayın

    Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install

    YüksekCVSS 8,8Kavram kanıtıEPSS %20

    google · chrome7 Oca 2026

  • CVE-2025-66838
    26İzleyin

    In Aris v10.0.23.0.3587512 and before, the file upload functionality does not enforce any rate limiting or throttling, allowing users to upl

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    softwareag · aris7 Oca 2026

  • CVE-2025-15472
    36İzleyin

    TRENDnet TEW-811DRU httpd  uapply.cgi setDeviceURL  os command injection

    YüksekCVSS 7,3İstismar yokEPSS %22

    trendnet · tew-811dru firmware7 Oca 2026

  • CVE-2025-15474
    21İzleyin

    AuntyFey Smart Combination Lock BLE Connection Flood DoS

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    auntyfey · auntyfey smart combination lock7 Oca 2026

  • CVE-2025-69080
    32İzleyin

    WordPress Gecko theme <= 1.9.8 - Local File Inclusion vulnerability

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    janstudio · gecko7 Oca 2026

  • CVE-2026-0650
    37İzleyin

    OpenFlagr <= 1.1.18 Authentication Bypass via Prefix Whitelist Path Normalization

    KritikCVSS 9,3Kavram kanıtıEPSS %1

    openflagr · flagr7 Oca 2026

  • CVE-2025-66837
    27İzleyin

    A file upload vulnerability in ARIS 10.0.23.0.3587512 allows attackers to execute arbitrary code via uploading a crafted PDF file/Malware

    OrtaCVSS 6,8Kavram kanıtıEPSS %0

    softwareag · aris7 Oca 2026

  • CVE-2025-12543
    38İzleyin

    Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf

    KritikCVSS 9,6Kavram kanıtıEPSS %1

    redhat · build of apache camel7 Oca 2026

  • CVE-2026-21851
    21İzleyin

    MONAI has Path Traversal (Zip Slip) in NGC Private Bundle Download

    OrtaCVSS 5,3İstismar yokEPSS %0

    project-monai · monai7 Oca 2026

  • CVE-2026-21857
    33İzleyin

    Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read

    YüksekCVSS 8,3Kavram kanıtıEPSS %0

    redaxo · redaxo7 Oca 2026

  • CVE-2017-20215
    39İzleyin

    FLIR Thermal Camera FC-S/PT firmware version 8.0.0.64 Authenticated OS Command Injection

    YüksekCVSS 8,7İstismar yokEPSS %15

    flir systems, inc. · flir thermal camera fc-s/pt7 Oca 2026

  • CVE-2017-20216
    41Planlayın

    FLIR Thermal Camera PT-Series firmware version 8.0.0.64 Unauthenticated Remote Command Injection

    KritikCVSS 9,3İstismar yokEPSS %12

    flir systems, inc. · flir thermal camera pt-series7 Oca 2026

  • CVE-2026-21858
    63Bu hafta

    n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling

    KritikCVSS 10,0Kavram kanıtıEPSS %78

    n8n · n8n7 Oca 2026

  • CVE-2026-21859
    21İzleyin

    Mailpit Proxy Endpoint is Vulnerable to Server-Side Request Forgery (SSRF)

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    axllent · mailpit7 Oca 2026

  • CVE-2026-21869
    39İzleyin

    llama.cpp has Out-of-bounds Write in llama-server

    KritikCVSS 9,8İstismar yokEPSS %0

    ggml · llama.cpp7 Oca 2026

  • CVE-2026-21875
    40Planlayın

    ClipBucket v5 Vulnerable to Blind SQL Injection through Channel Comments

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    oxygenz · clipbucket7 Oca 2026

  • CVE-2026-21877
    41Planlayın

    n8n is vulnerable to Remote Code Execution via Arbitrary File Write

    KritikCVSS 9,9Kavram kanıtıEPSS %5

    n8n · n8n7 Oca 2026

  • CVE-2025-68705
    37İzleyin

    RustFS Path Traversal Vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %7

    rustfs · rustfs7 Oca 2026

  • CVE-2026-22187
    27İzleyin

    Bio-Formats <= 8.3.0 Memoizer Unsafe Deserialization via .bfmemo Cache Files

    OrtaCVSS 6,8Kavram kanıtıEPSS %0

    openmicroscopy · bio-formats7 Oca 2026

  • CVE-2026-21876
    26İzleyin

    OWASP CRS has multipart bypass using multiple content-type parts

    OrtaCVSS 5,3Kavram kanıtıEPSS %17

    owasp · owasp modsecurity core rule set8 Oca 2026

  • CVE-2026-21891
    40Planlayın

    ZimaOS has Authentication Bypass via System-Level Username

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    zimaspace · zimaos8 Oca 2026

  • CVE-2026-22241
    30İzleyin

    Open eClass has Unrestricted File Upload that Leads to Remote Code Execution (RCE)

    YüksekCVSS 7,3Kavram kanıtıEPSS %3

    openeclass · openeclass8 Oca 2026

  • CVE-2025-61246
    39İzleyin

    indieka900 online-shopping-system-php 1.0 is vulnerable to SQL Injection in master/review_action.php via the proId parameter.

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    indieka900 · online shopping system8 Oca 2026

  • CVE-2025-65518
    30İzleyin

    Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition.

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    webpros · plesk obsidian8 Oca 2026

  • CVE-2025-65731
    27İzleyin

    An issue was discovered in D-Link Router DIR-605L (Hardware version F1; Firmware version: V6.02CN02) allowing an attacker with physical acce

    OrtaCVSS 6,8Kavram kanıtıEPSS %0

    dlink · dir-605l firmware8 Oca 2026

  • CVE-2025-67325
    39İzleyin

    Unrestricted file upload in the hotel review feature in QloApps versions 1.7.0 and earlier allows remote unauthenticated attackers to achiev

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    webkul · qloapps8 Oca 2026

  • CVE-2025-59470
    36İzleyin

    This vulnerability allows a Backup Operator to perform remote code execution (RCE) as the postgres user by sending a malicious interval or o

    KritikCVSS 9,0Kavram kanıtıEPSS %1

    veeam · veeam backup & replication8 Oca 2026

  • CVE-2026-0732
    11İzleyin

    D-Link DI-8200G upgrade_filter.asp command injection

    DüşükCVSS 2,1İstismar yokEPSS %11

    dlink · di-8200g firmware8 Oca 2026

  • CVE-2025-14736
    39İzleyin

    Frontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Field

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    shabti · frontend admin by dynamiapps9 Oca 2026

  • CVE-2025-14893
    25İzleyin

    IndieWeb <= 4.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via 'Telephone' Parameter

    OrtaCVSS 6,4Kavram kanıtıEPSS %0

    indieweb · indieweb9 Oca 2026

  • CVE-2025-69194
    39İzleyin

    Wget2: arbitrary file write via metalink path traversal in gnu wget2

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    gnu · wget29 Oca 2026

  • CVE-2025-14172
    26İzleyin

    WP Page Permalink Extension <= 1.5.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Rewrite Rules Flush

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    infosatech · wp page permalink extension9 Oca 2026

  • CVE-2025-14598
    39İzleyin

    BeeS Software Solutions BET Portal contains an SQL injection vulnerability in the login functionality of affected sites.

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    cloudilyaerp · bet e-portal9 Oca 2026

  • CVE-2025-15495
    8İzleyin

    BiggiDroid Simple PHP CMS editsite.php unrestricted upload

    DüşükCVSS 2,0Kavram kanıtıEPSS %0

    biggidroid · simple php cms9 Oca 2026

  • CVE-2025-66744
    30İzleyin

    In Yonyou YonBIP v3 and before, the LoginWithV8 interface in the series data application service system is vulnerable to path traversal, all

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    9 Oca 2026

  • CVE-2025-70161
    47Planlayın

    EDIMAX BR-6208AC V2_1.02 is vulnerable to Command Injection.

    KritikCVSS 9,8İstismar yokEPSS %27

    edimax · br-6208ac firmware9 Oca 2026

  • CVE-2025-67070
    32İzleyin

    A vulnerability exists in Intelbras CFTV IP NVD 9032 R Ftd V2.800.00IB00C.0.T, which allows an unauthenticated attacker to bypass the multi-

    YüksekCVSS 8,2Kavram kanıtıEPSS %0

    9 Oca 2026

  • CVE-2026-22024
    25İzleyin

    CryptoLib Memory Leak in KMC Encrypt Function Leads to Resource Exhaustion

    OrtaCVSS 6,3Kavram kanıtıEPSS %0

    nasa · cryptolib9 Oca 2026

  • CVE-2025-59057
    30İzleyin

    React Router has XSS Vulnerability

    YüksekCVSS 7,6Kavram kanıtıEPSS %0

    shopify · react-router9 Oca 2026

  • CVE-2025-61686
    41Planlayın

    React Router has Path Traversal in File Session Storage

    KritikCVSS 9,1Kavram kanıtıEPSS %17

    shopify · react-router\/node9 Oca 2026

  • CVE-2026-22594
    32İzleyin

    Ghost has Staff 2FA bypass

    YüksekCVSS 8,1SilahlaştırılmışEPSS %1

    ghost · ghost9 Oca 2026

  • CVE-2026-22610
    34İzleyin

    Angular has XSS Vulnerability via Unsanitized SVG Script Attributes

    YüksekCVSS 8,5Kavram kanıtıEPSS %0

    angular · angular10 Oca 2026

  • CVE-2026-22704
    21İzleyin

    HAXcms Has Stored XSS Vulnerability that May Lead to Account Takeover

    OrtaCVSS 5,4Kavram kanıtıEPSS %1

    psu · haxcms-nodejs10 Oca 2026

  • CVE-2026-22777
    30İzleyin

    ComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    comfy · comfyui-manager10 Oca 2026

  • CVE-2025-15503
    23İzleyin

    Sangfor Operation and Maintenance Management System common.jsp unrestricted upload

    OrtaCVSS 5,5Kavram kanıtıEPSS %2

    sangfor · operation and maintenance security management system10 Oca 2026

  • CVE-2026-0842
    8İzleyin

    Flycatcher Toys smART Sketcher Bluetooth Low Energy missing authentication

    DüşükCVSS 2,1Kavram kanıtıEPSS %0

    flycatcher toys · smart sketcher11 Oca 2026

  • CVE-2025-68493
    46Planlayın

    Apache Struts, Apache Struts: XXE vulnerability in outdated XWork component

    YüksekCVSS 8,1Kavram kanıtıEPSS %45

    apache · struts11 Oca 2026

  • CVE-2025-52694
    51Planlayın

    Execution of arbitrary SQL commands

    KritikCVSS 9,8Kavram kanıtıEPSS %39

    advantech · iot edge linux docker11 Oca 2026

  • CVE-2025-63314
    40Planlayın

    A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to arbitrarily reset the

    KritikCVSS 10,0Kavram kanıtıEPSS %0

    ddsn · cm3 acora cms12 Oca 2026

  • CVE-2025-68472
    42Planlayın

    MindsDB has improper sanitation of filepath that leads to information disclosure and DOS

    KritikCVSS 9,1Kavram kanıtıEPSS %20

    mindsdb · mindsdb12 Oca 2026

  • CVE-2026-22200
    56Planlayın

    osTicket (1.18.x < 1.18.3, 1.17.x < 1.17.7) PDF Export Arbitrary File Read

    YüksekCVSS 8,7SilahlaştırılmışEPSS %73

    enhancesoft · osticket12 Oca 2026

  • CVE-2026-22252
    40Planlayın

    LibreChat MCP Stdio Remote Command Execution

    KritikCVSS 9,9İstismar yokEPSS %4

    librechat · librechat12 Oca 2026

  • CVE-2026-22785
    37İzleyin

    orval MCP client is vulnerable to a code injection attack.

    KritikCVSS 9,3Kavram kanıtıEPSS %0

    orval · orval12 Oca 2026

  • CVE-2025-66802
    39İzleyin

    Sourcecodester Covid-19 Contact Tracing System 1.0 is vulnerable to RCE (Remote Code Execution).

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    covid-19 contact tracing system project · covid-19 contact tracing system12 Oca 2026

  • CVE-2021-41074
    21İzleyin

    A CSRF issue in index.php in QloApps hotel eCommerce 1.5.1 allows an attacker to change the admin's email address via a crafted HTML documen

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    webkul · qloapps12 Oca 2026

  • CVE-2025-12420
    53Planlayın

    Unauthenticated Privilege Escalation in ServiceNow AI Platform

    KritikCVSS 9,3Kavram kanıtıEPSS %53

    servicenow · now assist ai agents12 Oca 2026

  • CVE-2025-67146
    37İzleyin

    Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in (1) member_search.php,

    KritikCVSS 9,4Kavram kanıtıEPSS %0

    abhishekmali21 · gym management system12 Oca 2026

  • CVE-2026-22794
    35İzleyin

    Account Takeover Vulnerability in Appsmith

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    appsmith · appsmith12 Oca 2026

  • CVE-2026-22804
    18İzleyin

    Termix has a Stored XSS in File Manager leading to Local File Inclusion (LFI) in Electron and Session Hijacking in Browser

    OrtaCVSS 4,7Kavram kanıtıEPSS %0

    termix · termix12 Oca 2026

  • CVE-2026-22812
    40Planlayın

    OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution

    YüksekCVSS 8,8Kavram kanıtıEPSS %16

    anoma · opencode12 Oca 2026

  • CVE-2025-66177
    35İzleyin

    There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models.

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    hikvision · ds-96xxxni-hx12 Oca 2026

  • CVE-2025-14001
    21İzleyin

    WP Duplicate Page <= 1.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    ninjateam · wp duplicate page13 Oca 2026

  • CVE-2025-9435
    22İzleyin

    Zohocorp ManageEngine ADManager Plus versions below 7230 are vulnerable to Path Traversal in the User Management module

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    zohocorp · manageengine admanager plus13 Oca 2026

  • CVE-2025-13444
    35İzleyin

    OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster

    OrtaCVSS 6,8İstismar yokEPSS %27

    progress · connection manager for objectscale13 Oca 2026

  • CVE-2025-13447
    35İzleyin

    OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster

    OrtaCVSS 6,8İstismar yokEPSS %27

    progress · connection manager for objectscale*13 Oca 2026

  • CVE-2025-55462
    26İzleyin

    A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in t

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    eramba · eramba13 Oca 2026

  • CVE-2026-22755
    43Planlayın

    Legacy Vivotek Camera Firmware Command Injection in upload_map.cgi

    KritikCVSS 9,3İstismar yokEPSS %20

    vivotek · affected device model numbers are fd8365, fd8365v2, fd9165, fd9171, fd9187, fd9189, fd9365, fd9371, fd9381, fd9387, fd9389, fd9391,fe9180,fe9181, fe9191, fe9381, fe9382, fe9391, fe9582, ib9365, ib935813 Oca 2026

  • CVE-2025-12548
    36İzleyin

    Github.com/che-incubator/che-code: eclipse che — unauthenticated rce and secret exfiltration via tcp/3333

    KritikCVSS 9,0SilahlaştırılmışEPSS %1

    red hat · red hat openshift dev spaces (rhosds) 3.2213 Oca 2026

  • CVE-2025-66698
    34İzleyin

    An issue in Semantic machines v5.4.8 allows attackers to bypass authentication via sending a crafted HTTP request to various API endpoints.

    YüksekCVSS 8,6Kavram kanıtıEPSS %0

    semantic-machines · veda13 Oca 2026