İçeriğe atla
Noroxi

Yayın tarihine göre

Nisan 2026: sömürülen ve yeni ciddi CVE kayıtları

378 kayıt · 14 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 2 / 4

  • CVE-2026-34724
    34İzleyin

    Zammad has a server-side template injection leading to RCE via AI Agent

    YüksekCVSS 8,7Kavram kanıtıEPSS %0

    zammad · zammad8 Nis 2026

  • CVE-2026-35455
    21İzleyin

    immich has Stored XSS via OCR Text in 360° Panorama Viewer

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    futo · immich8 Nis 2026

  • CVE-2026-23869
    30İzleyin

    A denial of service vulnerability exists in React Server Components, affecting the following packages: react-server-dom-parcel, react-server

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    meta · react-server-dom-turbopack8 Nis 2026

  • CVE-2026-5865
    35İzleyin

    Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    google · chrome8 Nis 2026

  • CVE-2026-5173
    34İzleyin

    Exposed Dangerous Method or Function in GitLab

    YüksekCVSS 8,5Kavram kanıtıEPSS %0

    gitlab · gitlab8 Nis 2026

  • CVE-2026-1830
    41Planlayın

    Quick Playground <= 1.3.1 - Missing Authorization to Unauthenticated Arbitrary File Upload

    KritikCVSS 9,8Kavram kanıtıEPSS %8

    davidfcarr · quick playground9 Nis 2026

  • CVE-2026-5850
    40Planlayın

    Totolink A7100RU CGI cstecgi.cgi setVpnPassCfg os command injection

    YüksekCVSS 8,9İstismar yokEPSS %15

    totolink · a7100ru9 Nis 2026

  • CVE-2026-5851
    39İzleyin

    Totolink A7100RU CGI cstecgi.cgi setUPnPCfg os command injection

    YüksekCVSS 8,9İstismar yokEPSS %13

    totolink · a7100ru9 Nis 2026

  • CVE-2026-5852
    39İzleyin

    Totolink A7100RU CGI cstecgi.cgi setIptvCfg os command injection

    YüksekCVSS 8,9İstismar yokEPSS %13

    totolink · a7100ru9 Nis 2026

  • CVE-2026-5853
    39İzleyin

    Totolink A7100RU CGI cstecgi.cgi setIpv6LanCfg os command injection

    YüksekCVSS 8,9İstismar yokEPSS %13

    totolink · a7100ru9 Nis 2026

  • CVE-2026-5854
    40Planlayın

    Totolink A7100RU CGI cstecgi.cgi setWiFiEasyCfg os command injection

    YüksekCVSS 8,9İstismar yokEPSS %16

    totolink · a7100ru9 Nis 2026

  • CVE-2026-35204
    33İzleyin

    Helm has a path traversal in plugin metadata version enables arbitrary file write outside Helm plugin directory

    YüksekCVSS 8,4Kavram kanıtıEPSS %0

    helm · helm9 Nis 2026

  • CVE-2026-4660
    30İzleyin

    Go-getter may allow to arbitrary filesystem reads through git operations

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    hashicorp · tooling9 Nis 2026

  • CVE-2026-39980
    40Planlayın

    OpenCTI affected by RCE via notifier template

    YüksekCVSS 7,2SilahlaştırılmışEPSS %1

    citeum · opencti9 Nis 2026

  • CVE-2026-39987
    97Hemen

    marimo Affected by Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypass

    KritikCVSS 9,3KEVSilahlaştırılmışEPSS %99

    coreweave · marimo9 Nis 2026

  • CVE-2026-4112
    28İzleyin

    Improper neutralization of special elements used in an SQL command (“SQL Injection”) in SonicWall SMA1000 series appliances allows a remote

    YüksekCVSS 7,2Kavram kanıtıEPSS %0

    sonicwall · sma6210 firmware9 Nis 2026

  • CVE-2026-4116
    28İzleyin

    Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/C

    YüksekCVSS 7,2İstismar yokEPSS %0

    sonicwall · sma6210 firmware9 Nis 2026

  • CVE-2026-29923
    31İzleyin

    The pstrip64.sys driver in EnTech Taiwan PowerStrip <=3.90.736 allows local users to escalate privileges to SYSTEM via a crafted IOCTL reque

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    9 Nis 2026

  • CVE-2026-39983
    35İzleyin

    FTP Command Injection via CRLF in basic-ftp

    YüksekCVSS 8,6Kavram kanıtıEPSS %2

    patrickjuchli · basic-ftp9 Nis 2026

  • CVE-2026-40072
    6İzleyin

    web3.py affected by SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling

    DüşükCVSS 1,7Kavram kanıtıEPSS %0

    apeworx · web3.py9 Nis 2026

  • CVE-2026-39912
    36İzleyin

    v2board / Xboard Authentication Token Exposure via loginWithMailLink

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    v2board · v2board9 Nis 2026

  • CVE-2026-24880
    30İzleyin

    Apache Tomcat: Request smuggling via invalid chunk extension

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    apache · tomcat9 Nis 2026

  • CVE-2026-25854
    24İzleyin

    Apache Tomcat: Occasionally open redirect

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    apache · tomcat9 Nis 2026

  • CVE-2026-29145
    36İzleyin

    Apache Tomcat, Apache Tomcat Native: OCSP checks sometimes soft-fail even when soft-fail is disabled

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    apache · tomcat9 Nis 2026

  • CVE-2026-29146
    33İzleyin

    Apache Tomcat: EncryptInterceptor vulnerable to padding oracle attack by default

    YüksekCVSS 7,5Kavram kanıtıEPSS %8

    apache · tomcat9 Nis 2026

  • CVE-2026-34486
    90Hemen

    Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %98

    apache · tomcat9 Nis 2026

  • CVE-2026-40151
    21İzleyin

    PraisonAI Affected by Unauthenticated Information Disclosure of Agent Instructions via /api/agents in AgentOS

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    praison · praisonai9 Nis 2026

  • CVE-2026-1115
    38İzleyin

    Stored XSS in parisneo/lollms

    KritikCVSS 9,6Kavram kanıtıEPSS %1

    lollms · lollms10 Nis 2026

  • CVE-2026-6042
    19İzleyin

    musl libc GB18030 4-byte Decoder iconv.c iconv algorithmic complexity

    OrtaCVSS 4,8Kavram kanıtıEPSS %0

    musl · libc10 Nis 2026

  • CVE-2026-29861
    39İzleyin

    PHP-MYSQL-User-Login-System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at login.php.

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    10 Nis 2026

  • CVE-2026-40217
    40Planlayın

    LiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.

    YüksekCVSS 8,8Kavram kanıtıEPSS %17

    litellm · litellm10 Nis 2026

  • CVE-2026-40175
    20İzleyin

    Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

    OrtaCVSS 4,8Kavram kanıtıEPSS %1

    axios · axios10 Nis 2026

  • CVE-2026-40021
    25İzleyin

    Apache Log4net: Silent log event loss in XmlLayout and XmlLayoutSchemaLog4J due to unescaped XML 1.0 forbidden characters

    OrtaCVSS 6,3İstismar yokEPSS %0

    apache · log4net10 Nis 2026

  • CVE-2026-5724
    25İzleyin

    Missing Authentication on Streaming gRPC Replication Endpoint

    OrtaCVSS 6,3Kavram kanıtıEPSS %0

    temporal technologies, inc. · temporal10 Nis 2026

  • CVE-2026-5053
    28İzleyin

    NoMachine External Control of File Path Arbitrary File Deletion Vulnerability

    YüksekCVSS 7,1Kavram kanıtıEPSS %0

    nomachine · nomachine10 Nis 2026

  • CVE-2026-5054
    31İzleyin

    NoMachine External Control of File Path Local Privilege Escalation Vulnerability

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    nomachine · nomachine10 Nis 2026

  • CVE-2026-5059
    40Planlayın

    aws-mcp-server AWS CLI Command Injection Remote Code Execution Vulnerability

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    aws-mcp-server · aws-mcp-server10 Nis 2026

  • CVE-2026-40242
    26İzleyin

    Arcane Unauthenticated SSRF with Conditional Response Reflection in Template Fetch Endpoint

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    getarcane · arcane10 Nis 2026

  • CVE-2026-34621
    66Bu hafta

    Acrobat Reader | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CWE-1321)

    YüksekCVSS 8,6KEVSilahlaştırılmışEPSS %7

    adobe · acrobat dc11 Nis 2026

  • CVE-2026-31413
    31İzleyin

    bpf: Fix unsound scalar forking in maybe_fork_scalars() for BPF_OR

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    linux · linux kernel12 Nis 2026

  • CVE-2026-6111
    8İzleyin

    FoundationAgents MetaGPT common.py decode_image server-side request forgery

    DüşükCVSS 2,1Kavram kanıtıEPSS %0

    deepwisdom · metagpt12 Nis 2026

  • CVE-2026-6118
    9İzleyin

    AstrBotDevs AstrBot MCP Endpoint tools.py add_mcp_server command injection

    DüşükCVSS 2,1Kavram kanıtıEPSS %2

    astrbotdevs · astrbot12 Nis 2026

  • CVE-2026-21003
    20İzleyin

    Improper input validation in data related to network restrictions prior to SMR Apr-2026 Release 1 allows physical attackers to bypass the re

    OrtaCVSS 5,2Kavram kanıtıEPSS %0

    samsung · android13 Nis 2026

  • CVE-2026-21006
    18İzleyin

    Improper access control in Samsung DeX prior to SMR Apr-2026 Release 1 allows physical attackers to access to hidden notification contents.

    OrtaCVSS 4,7Kavram kanıtıEPSS %0

    samsung · android13 Nis 2026

  • CVE-2026-21007
    17İzleyin

    Improper check for exceptional conditions in Device Care prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Knox Guard.

    OrtaCVSS 4,4Kavram kanıtıEPSS %0

    samsung · android13 Nis 2026

  • CVE-2026-21008
    20İzleyin

    Exposure of sensitive information in S Share prior to SMR Apr-2026 Release 1 allows adjacent attacker to access sensitive information.

    OrtaCVSS 5,1Kavram kanıtıEPSS %0

    samsung · android13 Nis 2026

  • CVE-2026-21009
    16İzleyin

    Improper check for exceptional conditions in Recents prior to SMR Apr-2026 Release 1 allows physical attacker to bypass App Pinning.

    OrtaCVSS 4,1Kavram kanıtıEPSS %0

    samsung · android13 Nis 2026

  • CVE-2026-21010
    31İzleyin

    Improper input validation in Retail Mode prior to SMR Apr-2026 Release 1 allows local attackers to trigger privileged functions.

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    samsung · android13 Nis 2026

  • CVE-2026-21011
    21İzleyin

    Incorrect privilege assignment in Bluetooth in Maintenance mode prior to SMR Apr-2026 Release 1 allows physical attackers to bypass Extend U

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    samsung · android13 Nis 2026

  • CVE-2026-21012
    27İzleyin

    External control of file name in AODManager prior to SMR Apr-2026 Release 1 allows privileged local attacker to create file with system priv

    OrtaCVSS 6,8Kavram kanıtıEPSS %0

    samsung · android13 Nis 2026

  • CVE-2026-21013
    27İzleyin

    Incorrect default permission in Galaxy Wearable prior to version 2.2.68.26 allows local attackers to access sensitive information.

    OrtaCVSS 6,9Kavram kanıtıEPSS %0

    samsung · galaxy wearable13 Nis 2026

  • CVE-2026-21014
    20İzleyin

    Improper access control in Samsung Camera prior to version 16.5.00.28 allows local attacker to access location data.

    OrtaCVSS 5,1Kavram kanıtıEPSS %0

    samsung · camera13 Nis 2026

  • CVE-2026-4810
    38İzleyin

    Remote Code Execution in Google Agent Development Kit (ADK)

    KritikCVSS 9,3Kavram kanıtıEPSS %1

    google cloud · agent development kit (adk)13 Nis 2026

  • CVE-2026-29628
    24İzleyin

    A stack overflow in the experimental/tinyobj_loader_opt.h file of tinyobjloader commit d56555b allows attackers to cause a Denial of Service

    OrtaCVSS 6,2Kavram kanıtıEPSS %0

    13 Nis 2026

  • CVE-2026-31281
    32İzleyin

    Totara LMS v19.1.5 and before is vulnerable to HTML Injection.

    YüksekCVSS 8,0Kavram kanıtıEPSS %0

    13 Nis 2026

  • CVE-2026-31282
    39İzleyin

    Totara LMS v19.1.5 and before is vulnerable to Incorrect Access Control.

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    13 Nis 2026

  • CVE-2026-31283
    39İzleyin

    In Totara LMS v19.1.5 and before, the forgot password API does not implement rate limiting for the target email address.

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    13 Nis 2026

  • CVE-2026-29955
    36İzleyin

    The `/registercrd` endpoint in KubePlus 4.14 in the kubeconfiggenerator component is vulnerable to command injection.

    YüksekCVSS 8,8Kavram kanıtıEPSS %2

    cloudark · kubeplus13 Nis 2026

  • CVE-2026-6182
    22İzleyin

    code-projects Simple Content Management System login.php sql injection

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    code-projects · simple content management system13 Nis 2026

  • CVE-2026-6183
    22İzleyin

    code-projects Simple Content Management System index.php sql injection

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    code-projects · simple content management system13 Nis 2026

  • CVE-2026-31048
    39İzleyin

    An issue in the <code>pickle</code> protocol of Pyro v3.x allows attackers to execute arbitrary code via supplying a crafted pickled string

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    13 Nis 2026

  • CVE-2026-33534
    18İzleyin

    EspoCRM has authenticated SSRF via internal-host validation bypass using alternative IPv4 notation

    OrtaCVSS 4,3Kavram kanıtıEPSS %1

    espocrm · espocrm13 Nis 2026

  • CVE-2026-33657
    21İzleyin

    EspoCRM: Stored HTML injection in email notifications about stream notes via unescaped post field

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    espocrm · espocrm13 Nis 2026

  • CVE-2026-6184
    7İzleyin

    code-projects Simple Content Management System welcome.php cross site scripting

    DüşükCVSS 1,9Kavram kanıtıEPSS %0

    code-projects · simple content management system13 Nis 2026

  • CVE-2026-31280
    26İzleyin

    An issue in the Bluetooth RFCOMM service of Parani M10 Motorcycle Intercom v2.1.3 allows unauthorized attackers to cause a Denial of Service

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    13 Nis 2026

  • CVE-2026-33555
    23İzleyin

    An issue was discovered in HAProxy before 3.3.6.

    OrtaCVSS 5,8Kavram kanıtıEPSS %0

    haproxy · haproxy13 Nis 2026

  • CVE-2026-6195
    39İzleyin

    Totolink A7100RU CGI cstecgi.cgi setPasswordCfg os command injection

    YüksekCVSS 8,9İstismar yokEPSS %13

    totolink · a7100ru13 Nis 2026

  • CVE-2026-6203
    24İzleyin

    User Registration & Membership <= 5.1.4 - Unauthenticated Open Redirect via 'redirect_to_on_logout' Parameter

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    wpeverest · user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builder13 Nis 2026

  • CVE-2026-6201
    8İzleyin

    CodeAstro Online Job Portal Delete Job Posting job-delete.php access control

    DüşükCVSS 2,1Kavram kanıtıEPSS %0

    codeastro · online job portal13 Nis 2026

  • CVE-2026-4352
    30İzleyin

    JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via '_cct_search' Parameter

    YüksekCVSS 7,5İstismar yokEPSS %0

    crocoblock · jetengine13 Nis 2026

  • CVE-2026-4786
    28İzleyin

    Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()

    YüksekCVSS 7,0İstismar yokEPSS %0

    python software foundation · cpython13 Nis 2026

  • CVE-2026-6227
    28İzleyin

    BackWPup <= 5.6.6 - Authenticated (Administrator+) Local File Inclusion via 'block_name' Parameter

    YüksekCVSS 7,2Kavram kanıtıEPSS %1

    wp_media · backwpup – wordpress backup & restore plugin13 Nis 2026

  • CVE-2026-31908
    36İzleyin

    Apache APISIX: forward auth plugin allows header injection

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    apache · apisix14 Nis 2026

  • CVE-2025-69993
    24İzleyin

    Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting (XSS) via the bindPopup() method.

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    leafletjs · leaflet14 Nis 2026

  • CVE-2026-2332
    36İzleyin

    HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

    KritikCVSS 9,1Kavram kanıtıEPSS %1

    eclipse · jetty14 Nis 2026

  • CVE-2026-38526
    40Planlayın

    An authenticated arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint of Webkul Krayin CRM v2.2.x allows attackers to e

    KritikCVSS 9,9Kavram kanıtıEPSS %4

    14 Nis 2026

  • CVE-2026-38532
    32İzleyin

    A Broken Object-Level Authorization (BOLA) in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenti

    YüksekCVSS 8,1İstismar yokEPSS %0

    webkul · krayin crm14 Nis 2026

  • CVE-2026-32223
    27İzleyin

    Windows USB Printing Stack (usbprint.sys) Elevation of Privilege Vulnerability

    OrtaCVSS 6,8Kavram kanıtıEPSS %0

    microsoft · windows 11 24h214 Nis 2026

  • CVE-2026-33824
    92Hemen

    Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %77

    microsoft · windows 10 160714 Nis 2026

  • CVE-2026-33825
    63Bu hafta

    Microsoft Defender Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %6

    microsoft · defender antimalware platform14 Nis 2026

  • CVE-2026-33826
    32İzleyin

    Windows Active Directory Remote Code Execution Vulnerability

    YüksekCVSS 8,0Kavram kanıtıEPSS %0

    microsoft · windows server 201214 Nis 2026

  • CVE-2026-30480
    26İzleyin

    A Local File Inclusion (LFI) vulnerability in the NFSen module (nfsen.inc.php) of LibreNMS 22.11.0-23-gd091788f2 allows authenticated attack

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    14 Nis 2026

  • CVE-2025-61624
    56Planlayın

    An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fortinet FortiOS 7.6.0 through 7

    OrtaCVSS 6,5KEVSilahlaştırılmışEPSS %1

    fortinet · fortios14 Nis 2026

  • CVE-2026-39808
    97Hemen

    A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 th

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %93

    fortinet · fortisandbox14 Nis 2026

  • CVE-2026-39813
    46Planlayın

    A path traversal: '../filedir' vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8 may allow attack

    KritikCVSS 9,8Kavram kanıtıEPSS %22

    fortinet · fortisandbox14 Nis 2026

  • CVE-2026-33715
    28İzleyin

    Chamilo LMS has Unauthenticated SSRF and Open Email Relay via install.ajax.php test_mailer action

    YüksekCVSS 7,2Kavram kanıtıEPSS %0

    chamilo · chamilo lms14 Nis 2026

  • CVE-2026-34160
    34İzleyin

    Chamilo LMS: Unauthenticated SSRF via PENS Plugin allows attacker to probe internal network and reach cloud metadata services

    YüksekCVSS 8,6Kavram kanıtıEPSS %0

    chamilo · chamilo lms14 Nis 2026

  • CVE-2026-22692
    27İzleyin

    October CMS: Twig Sandbox Bypass via Collection Methods

    OrtaCVSS 6,8Kavram kanıtıEPSS %0

    octobercms · october14 Nis 2026

  • CVE-2026-27305
    42Planlayın

    ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

    YüksekCVSS 8,6İstismar yokEPSS %26

    adobe · coldfusion14 Nis 2026

  • CVE-2026-33146
    17İzleyin

    Docmost's Public Share Search Exposes Metadata of Restricted Children

    OrtaCVSS 4,3Kavram kanıtıEPSS %0

    docmost · docmost14 Nis 2026

  • CVE-2026-33193
    18İzleyin

    Docmost vulnerable to stored XSS via MIME type spoofing

    OrtaCVSS 4,6İstismar yokEPSS %0

    docmost · docmost14 Nis 2026

  • CVE-2026-34212
    21İzleyin

    Docmost page content has stored XSS via unsanitized attachment URLs

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    docmost · docmost14 Nis 2026

  • CVE-2026-34213
    21İzleyin

    Docmost has cross-page attachment overwrite via flawed attachmentId overwrite validation

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    docmost · docmost14 Nis 2026

  • CVE-2026-35196
    36İzleyin

    Chamilo LMS has OS Command Injection via export_all_certificates action

    YüksekCVSS 8,8Kavram kanıtıEPSS %1

    chamilo · chamilo lms14 Nis 2026

  • CVE-2026-20945
    27İzleyin

    Microsoft SharePoint Server Spoofing Vulnerability

    OrtaCVSS 5,4İstismar yokEPSS %19

    microsoft · sharepoint server14 Nis 2026

  • CVE-2026-26179
    31İzleyin

    Windows Kernel Elevation of Privilege Vulnerability

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    microsoft · windows 11 23h214 Nis 2026

  • CVE-2026-27912
    32İzleyin

    Windows Kerberos Elevation of Privilege Vulnerability

    YüksekCVSS 8,0Kavram kanıtıEPSS %0

    microsoft · windows server 201214 Nis 2026

  • CVE-2026-32201
    69Bu hafta

    Microsoft SharePoint Server Spoofing Vulnerability

    OrtaCVSS 6,5KEVSilahlaştırılmışEPSS %43

    microsoft · sharepoint server14 Nis 2026

  • CVE-2026-32202
    68Bu hafta

    Windows Shell Spoofing Vulnerability

    OrtaCVSS 4,3KEVSilahlaştırılmışEPSS %70

    microsoft · windows 10 160714 Nis 2026

  • CVE-2026-33827
    32İzleyin

    Windows TCP/IP Remote Code Execution Vulnerability

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    microsoft · windows 10 160714 Nis 2026