İçeriğe atla
Noroxi

Yayın tarihine göre

Nisan 2026: sömürülen ve yeni ciddi CVE kayıtları

362 kayıt · 14 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 1 / 4

  • CVE-2026-5281
    65Bu hafta

    Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execut

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %0

    google · chrome1 Nis 2026

  • CVE-2026-29014
    38İzleyin

    MetInfo CMS Unauthenticated PHP Code Injection RCE

    KritikCVSS 9,3Kavram kanıtıEPSS %4

    metinfo · metinfo1 Nis 2026

  • CVE-2026-29598
    21İzleyin

    Multiple stored cross-site scripting (XSS) vulnerabilities in the submit_add_user.asp endpoint of DDSN Interactive Acora CMS v10.7.1 allow a

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    1 Nis 2026

  • CVE-2026-34159
    39İzleyin

    llama.cpp: Unauthenticated RCE via GRAPH_COMPUTE buffer=0 bypass in llama.cpp RPC backend

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    ggml · llama.cpp1 Nis 2026

  • CVE-2026-5032
    31İzleyin

    W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header

    YüksekCVSS 7,5Kavram kanıtıEPSS %2

    boldgrid · w3 total cache2 Nis 2026

  • CVE-2026-23416
    22İzleyin

    mm/mseal: update VMA end correctly on merge

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    linux · linux kernel2 Nis 2026

  • CVE-2026-4282
    29İzleyin

    Keycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flaw

    YüksekCVSS 7,4Kavram kanıtıEPSS %0

    redhat · build of keycloak2 Nis 2026

  • CVE-2026-29782
    28İzleyin

    OpenSTAManager: Remote Code Execution via Insecure Deserialization in OAuth2

    YüksekCVSS 7,2Kavram kanıtıEPSS %0

    devcode · openstamanager2 Nis 2026

  • CVE-2026-2699
    40Planlayın

    EAR vulnerability in Progress ShareFile Storage Zones Controller (SZC)

    KritikCVSS 9,8Kavram kanıtıEPSS %3

    progress · sharefile storage zones controller2 Nis 2026

  • CVE-2026-33641
    31İzleyin

    Glances Vulnerable to Command Injection via Dynamic Configuration Values

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    nicolargo · glances2 Nis 2026

  • CVE-2026-5339
    11İzleyin

    Tenda G103 Setting gpon.lua action_set_net_settings command injection

    DüşükCVSS 2,0İstismar yokEPSS %10

    tenda · g103 firmware2 Nis 2026

  • CVE-2026-23415
    31İzleyin

    futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    linux · linux kernel2 Nis 2026

  • CVE-2026-30332
    30İzleyin

    A Time-of-Check to Time-of-Use (TOCTOU) race condition vulnerability in Balena Etcher for Windows prior to v2.1.4 allows attackers to escala

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    2 Nis 2026

  • CVE-2026-33691
    30İzleyin

    OWASP CRS: Whitespace padding in filenames bypasses file upload extension checks

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    owasp · owasp modsecurity core rule set2 Nis 2026

  • CVE-2026-25212
    39İzleyin

    An issue was discovered in Percona PMM before 3.7.

    KritikCVSS 9,9Kavram kanıtıEPSS %0

    percona · monitoring and management2 Nis 2026

  • CVE-2026-34523
    21İzleyin

    SillyTavern: Path traversal allows file existence oracle

    OrtaCVSS 5,3İstismar yokEPSS %0

    sillytavern · sillytavern2 Nis 2026

  • CVE-2026-34828
    28İzleyin

    listmonk: Active sessions remain valid after password reset and password change

    YüksekCVSS 7,1Kavram kanıtıEPSS %0

    nadh · listmonk2 Nis 2026

  • CVE-2026-34835
    26İzleyin

    Rack: `Rack::Request` accepts invalid Host characters, enabling host allowlist bypass.

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    rack · rack2 Nis 2026

  • CVE-2026-35414
    32İzleyin

    OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    openbsd · openssh2 Nis 2026

  • CVE-2026-34838
    39İzleyin

    Group-Office: Authenticated Remote Code Execution via PHP Insecure Deserialization in `AbstractSettingsCollection`

    KritikCVSS 9,9Kavram kanıtıEPSS %0

    intermesh · group-office2 Nis 2026

  • CVE-2026-34847
    24İzleyin

    hoppscotch: Open redirect via `/enter?redirect=`

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    hoppscotch · hoppscotch2 Nis 2026

  • CVE-2026-30251
    24İzleyin

    A reflected cross-site scripting (XSS) vulnerability in the login_newpwd.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 allo

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    interzen · zenshare suite2 Nis 2026

  • CVE-2026-30252
    24İzleyin

    Multiple reflected cross-site scripting (XSS) vulnerabilities in the login.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 al

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    interzen · zencrm2 Nis 2026

  • CVE-2026-35535
    31İzleyin

    In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop before running the mailer

    YüksekCVSS 7,8İstismar yokEPSS %0

    sudo project · sudo2 Nis 2026

  • CVE-2026-4350
    32İzleyin

    Perfmatters <= 2.5.9.1 - Authenticated (Subscriber+) Arbitrary File Deletion via 'delete' Parameter

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    perfmatters · perfmatters3 Nis 2026

  • CVE-2026-0545
    40Planlayın

    Missing Authentication for Critical Function in mlflow/mlflow

    KritikCVSS 9,8Kavram kanıtıEPSS %4

    lfprojects · mlflow3 Nis 2026

  • CVE-2026-31402
    39İzleyin

    nfsd: fix heap overflow in NFSv4.0 LOCK replay cache

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    linux · linux kernel3 Nis 2026

  • CVE-2025-10681
    35İzleyin

    Gardyn Mobile Application and Device Firmware Use Hard-coded Credentials

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    gardyn · mobile application3 Nis 2026

  • CVE-2026-25197
    37İzleyin

    Gardyn Cloud API Authorization Bypass Through User-Controlled Key

    KritikCVSS 9,3Kavram kanıtıEPSS %0

    mygardyn · cloud api3 Nis 2026

  • CVE-2026-28766
    36İzleyin

    Gardyn Cloud API Missing Authentication for Critical Function

    KritikCVSS 9,2Kavram kanıtıEPSS %0

    mygardyn · cloud api3 Nis 2026

  • CVE-2026-28767
    27İzleyin

    Gardyn Cloud API Missing Authentication for Critical Function

    OrtaCVSS 6,9Kavram kanıtıEPSS %0

    mygardyn · cloud api3 Nis 2026

  • CVE-2026-32646
    34İzleyin

    Gardyn Cloud API Missing Authentication for Critical Function

    YüksekCVSS 8,7Kavram kanıtıEPSS %0

    mygardyn · cloud api3 Nis 2026

  • CVE-2026-32662
    27İzleyin

    Gardyn Cloud API Active Debug Code

    OrtaCVSS 6,9Kavram kanıtıEPSS %0

    mygardyn · cloud api3 Nis 2026

  • CVE-2026-27833
    31İzleyin

    Piwigo: Unauthenticated Information Disclosure via pwg.history.search API

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    piwigo · piwigo3 Nis 2026

  • CVE-2026-28797
    34İzleyin

    RAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" Component

    YüksekCVSS 8,7Kavram kanıtıEPSS %0

    infiniflow · ragflow3 Nis 2026

  • CVE-2026-34980
    24İzleyin

    OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    openprinting · cups3 Nis 2026

  • CVE-2026-34990
    20İzleyin

    OpenPrinting CUPS: Local print admin token disclosure using temporary printers

    OrtaCVSS 5,0Kavram kanıtıEPSS %0

    openprinting · cups3 Nis 2026

  • CVE-2026-35616
    72Bu hafta

    A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unau

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %9

    fortinet · forticlientems3 Nis 2026

  • CVE-2026-2600
    25İzleyin

    ElementsKit Elementor Addons and Templates <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Simple Tab Widget

    OrtaCVSS 6,4Kavram kanıtıEPSS %0

    roxnor · elementskit elementor addons – advanced widgets & templates addons for elementor4 Nis 2026

  • CVE-2026-5530
    21İzleyin

    Ollama Model Pull API download.go server-side request forgery

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    4 Nis 2026

  • CVE-2026-5555
    22İzleyin

    code-projects Concert Ticket Reservation System Parameter login.php sql injection

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    code-projects · concert ticket reservation system5 Nis 2026

  • CVE-2026-5556
    8İzleyin

    badlogic pi-mono loader.ts discoverAndLoadExtensions code injection

    DüşükCVSS 2,1Kavram kanıtıEPSS %0

    badlogic · pi-mono5 Nis 2026

  • CVE-2026-5562
    23İzleyin

    provectus kafka-ui Endpoint testexecutions validateAccess code injection

    OrtaCVSS 5,5Kavram kanıtıEPSS %3

    provectus · ui5 Nis 2026

  • CVE-2026-5615
    8İzleyin

    givanz Vvvebjs File Upload Endpoint upload.php cross site scripting

    DüşükCVSS 2,1Kavram kanıtıEPSS %1

    givanz · vvvebjs6 Nis 2026

  • CVE-2026-26026
    28İzleyin

    GLPI has a Server-Side Template Injection via Double-Compilation

    YüksekCVSS 7,2Kavram kanıtıEPSS %0

    glpi-project · glpi6 Nis 2026

  • CVE-2026-34885
    34İzleyin

    WordPress Media LIbrary Assistant plugin <= 3.34 - SQL Injection vulnerability

    YüksekCVSS 8,5Kavram kanıtıEPSS %1

    david lingren · media library assistant6 Nis 2026

  • CVE-2026-34897
    26İzleyin

    WordPress Media LIbrary Assistant plugin <= 3.34 - Cross Site Scripting (XSS) vulnerability

    OrtaCVSS 6,5İstismar yokEPSS %0

    david lingren · media library assistant6 Nis 2026

  • CVE-2026-33752
    34İzleyin

    Redirect-based SSRF leading to internal network access in curl_cffi (with TLS impersonation bypass)

    YüksekCVSS 8,6Kavram kanıtıEPSS %0

    lexiforest · curl cffi6 Nis 2026

  • CVE-2026-34444
    31İzleyin

    Lupa has a Sandbox escape and RCE due to incomplete attribute_filter enforcement in getattr / setattr

    YüksekCVSS 7,9Kavram kanıtıEPSS %0

    scoder · lupa6 Nis 2026

  • CVE-2026-34588
    34İzleyin

    OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write

    YüksekCVSS 8,6İstismar yokEPSS %0

    openexr · openexr6 Nis 2026

  • CVE-2026-34753
    21İzleyin

    vLLM affected by Server-Side Request Forgery (SSRF) in `download_bytes_from_url `

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    vllm · vllm6 Nis 2026

  • CVE-2026-34940
    35İzleyin

    KubeAI has an OS Command Injection via Model URL in Ollama Engine startup probe allows arbitrary command execution in model pods

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    kubeai · kubeai6 Nis 2026

  • CVE-2026-34975
    17İzleyin

    Plunk has a CRLF Email Header Injection in raw MIME message construction allows authenticated API user to inject arbitrary email headers

    OrtaCVSS 4,3Kavram kanıtıEPSS %0

    useplunk · plunk6 Nis 2026

  • CVE-2026-34976
    40Planlayın

    Dgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization

    KritikCVSS 10,0Kavram kanıtıEPSS %1

    dgraph · dgraph6 Nis 2026

  • CVE-2026-35029
    35İzleyin

    LiteLLM affected by privilege escalation via unrestricted proxy configuration endpoint

    YüksekCVSS 8,7Kavram kanıtıEPSS %3

    litellm · litellm6 Nis 2026

  • CVE-2026-35030
    37İzleyin

    LiteLLM has an authentication bypass via OIDC userinfo cache key collision

    KritikCVSS 9,4Kavram kanıtıEPSS %0

    litellm · litellm6 Nis 2026

  • CVE-2026-35037
    28İzleyin

    Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata

    YüksekCVSS 7,2Kavram kanıtıEPSS %0

    ech0 · ech06 Nis 2026

  • CVE-2026-35045
    32İzleyin

    Tandoor Recipes Affected by Private Recipe Exposure and Unauthorized Modification

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    tandoor · recipes6 Nis 2026

  • CVE-2026-0049
    24İzleyin

    In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion.

    OrtaCVSS 6,2Kavram kanıtıEPSS %0

    google · android6 Nis 2026

  • CVE-2025-54328
    40Planlayın

    An issue was discovered in SMS in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330

    KritikCVSS 10,0Kavram kanıtıEPSS %0

    samsung · exynos 980 firmware6 Nis 2026

  • CVE-2026-5682
    11İzleyin

    Meesho Online Shopping App com.meesho.supply endpoint risky encryption

    DüşükCVSS 2,9Kavram kanıtıEPSS %0

    meesho · online shopping app6 Nis 2026

  • CVE-2026-0740
    58Planlayın

    Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload

    KritikCVSS 9,8Kavram kanıtıEPSS %62

    saturdaydrive · ninja forms - file uploads7 Nis 2026

  • CVE-2026-5465
    35İzleyin

    Amelia <= 2.1.3 - Insecure Direct Object Reference to Authenticated (Employee+) Privilege Escalation via 'externalId' Parameter

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    ameliabooking · booking for appointments and events calendar – amelia7 Nis 2026

  • CVE-2026-34197
    70Bu hafta

    Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Authenticated users could perform RCE via Jolokia MBeans

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %15

    apache · activemq7 Nis 2026

  • CVE-2026-22666
    39İzleyin

    Dolibarr ERP/CRM < 23.0.2 Authenticated RCE via dol_eval_standard()

    YüksekCVSS 8,6Kavram kanıtıEPSS %15

    dolibarr · dolibarr erp\/crm7 Nis 2026

  • CVE-2026-22679
    43Planlayın

    Weaver E-cology 10.0 Unauthenticated RCE via dubboApi Debug Endpoint

    KritikCVSS 9,3Kavram kanıtıEPSS %20

    weaver · e-cology7 Nis 2026

  • CVE-2026-33866
    21İzleyin

    Authorization Bypass in MLflow AJAX Endpoint

    OrtaCVSS 5,3İstismar yokEPSS %0

    lfprojects · mlflow7 Nis 2026

  • CVE-2026-33033
    26İzleyin

    Potential denial-of-service vulnerability in MultiPartParser via base64-encoded file upload

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    djangoproject · django7 Nis 2026

  • CVE-2024-36057
    40Planlayın

    Koha Library before 23.05.10 fails to sanitize user-controllable filenames prior to unzipping, leading to remote code execution.

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    7 Nis 2026

  • CVE-2026-35492
    26İzleyin

    Kedro-Datasets has a path traversal vulnerability in PartitionedDataset allows arbitrary file write

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    kedro-org · kedro-plugins7 Nis 2026

  • CVE-2026-35517
    35İzleyin

    Pi-hole FTL affected by Remote Code Execution (RCE) via dns.upstreams Newline Injection

    YüksekCVSS 8,8Kavram kanıtıEPSS %1

    pi-hole · ftldns7 Nis 2026

  • CVE-2024-36058
    39İzleyin

    The Send Basket functionality in Koha Library before 23.05.10 is susceptible to Time-Based SQL Injection because it fails to sanitize the PO

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    7 Nis 2026

  • CVE-2026-22683
    35İzleyin

    Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE

    YüksekCVSS 8,7Kavram kanıtıEPSS %2

    windmill · windmill7 Nis 2026

  • CVE-2026-23696
    41Planlayın

    Windmill < 1.603.3 File Ownership Handling SQLi RCE

    KritikCVSS 9,4Kavram kanıtıEPSS %13

    windmill labs · windmill ce (community edition)7 Nis 2026

  • CVE-2026-35580
    36İzleyin

    Emissary has GitHub Actions Shell Injection via Workflow Inputs

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    nsa · emissary7 Nis 2026

  • CVE-2026-35584
    27İzleyin

    FreeScout has an Unauthenticated IDOR in Open Tracking Endpoint Allows Cross-Conversation Thread Manipulation and Enumeration

    OrtaCVSS 6,9Kavram kanıtıEPSS %0

    freescout · freescout7 Nis 2026

  • CVE-2026-35585
    31İzleyin

    File Browser has a Command Injection via Hook Runner

    YüksekCVSS 7,5Kavram kanıtıEPSS %2

    filebrowser · filebrowser7 Nis 2026

  • CVE-2026-39324
    37İzleyin

    Rack::Session::Cookie secrets: decrypt failure fallback enables secretless session forgery and Marshal deserialization

    KritikCVSS 9,3Kavram kanıtıEPSS %0

    rack · rack-session7 Nis 2026

  • CVE-2026-39339
    37İzleyin

    ChurchCRM has an API Authentication Bypass

    KritikCVSS 9,1Kavram kanıtıEPSS %1

    churchcrm · churchcrm7 Nis 2026

  • CVE-2025-14857
    21İzleyin

    Semtech LR11xx Memory Write Access Control Bypass

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    semtech · lr11107 Nis 2026

  • CVE-2025-56015
    30İzleyin

    In GenieACS 1.2.13, an unauthenticated access vulnerability exists in the NBI API endpoint.

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    genieacs · genieacs7 Nis 2026

  • CVE-2025-69515
    36İzleyin

    An issue in JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to force the infotainment system into accepting falsifie

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    7 Nis 2026

  • CVE-2026-39363
    33İzleyin

    Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket

    YüksekCVSS 8,2Kavram kanıtıEPSS %2

    vitejs · vite7 Nis 2026

  • CVE-2026-39364
    32İzleyin

    Vite has a `server.fs.deny` bypass with queries

    YüksekCVSS 8,2Kavram kanıtıEPSS %1

    vitejs · vite7 Nis 2026

  • CVE-2026-39365
    25İzleyin

    Vite has a Path Traversal in Optimized Deps `.map` Handling

    OrtaCVSS 6,3Kavram kanıtıEPSS %0

    vitejs · vite7 Nis 2026

  • CVE-2026-39371
    32İzleyin

    RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    redwoodjs · redwoodsdk7 Nis 2026

  • CVE-2026-39376
    30İzleyin

    FastFeedParser has an infinite redirect loop DoS via meta-refresh chain

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    kagi · fastfeedparser7 Nis 2026

  • CVE-2026-39382
    37İzleyin

    dbt has a Command Injection in Reusable Workflow via Unsanitized comment-body Output

    KritikCVSS 9,3Kavram kanıtıEPSS %0

    dbt-labs · dbt-core7 Nis 2026

  • CVE-2026-4631
    42Planlayın

    Cockpit: cockpit: unauthenticated remote code execution due to ssh command-line argument injection

    KritikCVSS 9,8Kavram kanıtıEPSS %9

    red hat · red hat enterprise linux 107 Nis 2026

  • CVE-2026-33439
    40Planlayın

    Pre-Authentication Remote Code Execution via `jato.clientSession` Deserialization in OpenAM

    KritikCVSS 9,3Kavram kanıtıEPSS %8

    openidentityplatform · openam7 Nis 2026

  • CVE-2026-4406
    18İzleyin

    Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter

    OrtaCVSS 4,7Kavram kanıtıEPSS %0

    gravity forms · gravity forms7 Nis 2026

  • CVE-2026-3296
    40Planlayın

    Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    wpeverest · everest forms – contact form, payment form, quiz, survey & custom form builder7 Nis 2026

  • CVE-2026-39636
    26İzleyin

    WordPress Livemesh Addons for Elementor plugin <= 9.0 - Cross Site Scripting (XSS) vulnerability

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    livemesh · livemesh addons for elementor8 Nis 2026

  • CVE-2026-39676
    21İzleyin

    WordPress Download Manager plugin <= 3.3.52 - Broken Access Control vulnerability

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    shahjada · download manager8 Nis 2026

  • CVE-2026-3396
    31İzleyin

    WCAPF – WooCommerce Ajax Product Filter <= 4.2.3 - Unauthenticated Time-Based SQL Injection

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    shamimmoeen · wcapf – ajax product filter for woocommerce8 Nis 2026

  • CVE-2026-33229
    34İzleyin

    XWiki Platform affected by remote code execution with script right through unprotected Velocity scripting API

    YüksekCVSS 8,6Kavram kanıtıEPSS %1

    xwiki · xwiki8 Nis 2026

  • CVE-2026-2942
    39İzleyin

    ProSolution WP Client <= 1.9.9 - Unauthenticated Arbitrary File Upload via proSol_fileUploadProcess

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    prosolution · prosolution wp client8 Nis 2026

  • CVE-2026-34724
    34İzleyin

    Zammad has a server-side template injection leading to RCE via AI Agent

    YüksekCVSS 8,7Kavram kanıtıEPSS %0

    zammad · zammad8 Nis 2026

  • CVE-2026-35455
    21İzleyin

    immich has Stored XSS via OCR Text in 360° Panorama Viewer

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    futo · immich8 Nis 2026

  • CVE-2026-23869
    30İzleyin

    A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    meta · react-server-dom-turbopack8 Nis 2026