İçeriğe atla
Noroxi
Yayın tarihine göre

Nisan 2026: sömürülen ve yeni ciddi CVE kayıtları

378 kayıt · 14 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 4 / 4

  • CVE-2026-41459
    60Bu hafta

    Xerte Online Toolkits Path Disclosure via /setup

    OrtaCVSS 6,9SilahlaştırılmışEPSS %0

    thexerteproject · xerteonlinetoolkits22 Nis 2026

  • CVE-2026-33656
    36İzleyin

    EspoCRM vulnerable to authenticated RCE via Formula with path traversal in attachment `sourceId`, exploitable by admin user

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    espocrm · espocrm22 Nis 2026

  • CVE-2026-3844
    47Planlayın

    Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote

    KritikCVSS 9,8Kavram kanıtıEPSS %27

    cloudways · breeze cache22 Nis 2026

  • CVE-2026-29198
    39İzleyin

    In Rocket.Chat <8.3.0, <8.2.1, <8.1.2, <8.0.3, <7.13.5, <7.12.6, <7.11.6, and <7.10.9, a NoSQL injection vulnerability can lead to account t

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    rocket.chat · rocket.chat23 Nis 2026

  • CVE-2026-41176
    46Planlayın

    Rclone: Unauthenticated options/set allows runtime auth bypass, leading to sensitive operations and command execution

    KritikCVSS 9,2Kavram kanıtıEPSS %32

    rclone · rclone23 Nis 2026

  • CVE-2026-41179
    39İzleyin

    RClone: Unauthenticated operations/fsinfo allows attacker-controlled backend instantiation and local command execution

    KritikCVSS 9,2Kavram kanıtıEPSS %8

    rclone · rclone23 Nis 2026

  • CVE-2026-41679
    60Bu hafta

    Paperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass

    KritikCVSS 10,0SilahlaştırılmışEPSS %31

    paperclip · paperclipai23 Nis 2026

  • CVE-2026-4106
    21İzleyin

    HT Mega < 3.0.7 – Unauthenticated PII Disclosure

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    unknown · ht mega addons for elementor23 Nis 2026

  • CVE-2026-39440
    39İzleyin

    WordPress FunnelFormsPro plugin <= 3.8.1 - Remote Code Execution (RCE) vulnerability

    KritikCVSS 9,9Kavram kanıtıEPSS %0

    funnelforms llc · funnelformspro23 Nis 2026

  • CVE-2025-70994
    29İzleyin

    Yadea T5 Electric Bicycles (models manufactured in/after 2024) have a weak authentication mechanism in their keyless entry system.

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    23 Nis 2026

  • CVE-2026-23751
    37İzleyin

    Kofax Capture 6.0.0.0 Unauthenticated File Read/Write & SMB Coercion via .NET Remoting

    KritikCVSS 9,3Kavram kanıtıEPSS %0

    tungsten automation · tungsten capture (formerly kofax capture)23 Nis 2026

  • CVE-2026-25874
    42Planlayın

    LeRobot Unsafe Deserialization Remote Code Execution via gRPC

    KritikCVSS 9,3İstismar yokEPSS %15

    huggingface · lerobot23 Nis 2026

  • CVE-2026-41264
    60Bu hafta

    Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

    KritikCVSS 9,2SilahlaştırılmışEPSS %1

    flowiseai · flowise23 Nis 2026

  • CVE-2026-41268
    44Planlayın

    Flowise: Flowise Parameter Override Bypass Remote Command Execution

    KritikCVSS 9,8İstismar yokEPSS %17

    flowiseai · flowise23 Nis 2026

  • CVE-2026-41345
    24İzleyin

    OpenClaw < 2026.3.31 - Authorization Header Leak via Cross-Origin Redirect in Media Download

    OrtaCVSS 6,0İstismar yokEPSS %0

    openclaw · openclaw23 Nis 2026

  • CVE-2026-33317
    34İzleyin

    OP-TEE: PKCS#11 TA out-of-bounds read and memory disclosure

    YüksekCVSS 8,7Kavram kanıtıEPSS %0

    trustedfirmware · op-tee24 Nis 2026

  • CVE-2026-40466
    36İzleyin

    Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Possible bypass of CVE-2026-34197 via HTTP discovery second-stage URI

    YüksekCVSS 8,8Kavram kanıtıEPSS %4

    apache · activemq24 Nis 2026

  • CVE-2026-41044
    35İzleyin

    Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All: Authenticated user can perform RCE via DestinationView MBean exposed by Jolokia

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    apache · activemq24 Nis 2026

  • CVE-2026-6043
    35İzleyin

    Insecure Default Configuration in P4 Server

    YüksekCVSS 8,8Kavram kanıtıEPSS %1

    perforce · helix core server (p4d)24 Nis 2026

  • CVE-2026-31635
    30İzleyin

    rxrpc: fix oversized RESPONSE authenticator length check

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    linux · linux kernel24 Nis 2026

  • CVE-2026-30368
    21İzleyin

    A client-side authorization flaw in Lightspeed Systems Classroom v5.1.2.1763770643 allows unauthenticated attackers to impersonate users by

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    lightspeed · lightspeed classroom24 Nis 2026

  • CVE-2026-40897
    35İzleyin

    Math.js: Unsafe object property setter in mathjs

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    mathjs · mathjs24 Nis 2026

  • CVE-2026-41414
    29İzleyin

    Skim: Arbitrary code execution via pull_request_target fork checkout in pr.yml

    YüksekCVSS 7,4Kavram kanıtıEPSS %0

    skim-rs · skim24 Nis 2026

  • CVE-2026-41492
    40Planlayın

    Unauthenticated Admin Token Disclosure Leading to Authentication Bypass via /debug/vars in Dgraph

    KritikCVSS 9,8Kavram kanıtıEPSS %3

    dgraph · dgraph24 Nis 2026

  • CVE-2026-41472
    21İzleyin

    CyberPanel < 2.4.5 Stored XSS via AI Scanner Dashboard

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    cyberpanel · cyberpanel24 Nis 2026

  • CVE-2026-41473
    35İzleyin

    CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    cyberpanel · cyberpanel24 Nis 2026

  • CVE-2026-6951
    32İzleyin

    Versions of the package simple-git before 3.36.0 are vulnerable to Remote Code Execution (RCE) due to an incomplete fix for [CVE-2022-25912]

    YüksekCVSS 8,2Kavram kanıtıEPSS %0

    simple-git project · simple-git25 Nis 2026

  • CVE-2026-6992
    31İzleyin

    Linksys MR9600 JNAP Action run_central2.sh BTRequestGetSmartConnectStatus os command injection

    YüksekCVSS 7,3Kavram kanıtıEPSS %8

    linksys · mr9600 firmware25 Nis 2026

  • CVE-2026-7020
    11İzleyin

    Ollama Tensor Model Transfer transfer.go digestToPath path traversal

    DüşükCVSS 2,9Kavram kanıtıEPSS %0

    ollama · ollama26 Nis 2026

  • CVE-2026-7028
    8İzleyin

    CodeAstro Online Job Portal All Jobs delete-jobs.php sql injection

    DüşükCVSS 2,0Kavram kanıtıEPSS %0

    codeastro · online job portal26 Nis 2026

  • CVE-2026-7070
    22İzleyin

    code-projects Inventory Management System Login sql injection

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    code-projects · inventory management system27 Nis 2026

  • CVE-2026-7071
    22İzleyin

    CodeAstro Online Job Portal user-cvs file information disclosure

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    codeastro · online job portal27 Nis 2026

  • CVE-2026-3008
    26İzleyin

    Vulnerability in Notepad++

    OrtaCVSS 6,6Kavram kanıtıEPSS %0

    notepad++ · notepad++27 Nis 2026

  • CVE-2026-7089
    8İzleyin

    code-projects Home Service System Appointment Booking booking.php cross site scripting

    DüşükCVSS 2,1Kavram kanıtıEPSS %0

    code-projects · home service system27 Nis 2026

  • CVE-2026-40048
    31İzleyin

    Apache Camel PQC: Unsafe Deserialization from FileBasedKeyLifecycleManager

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    apache · camel27 Nis 2026

  • CVE-2026-40453
    40Planlayın

    Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, ca

    KritikCVSS 9,9Kavram kanıtıEPSS %2

    apache · camel27 Nis 2026

  • CVE-2026-40473
    35İzleyin

    Apache Camel Mina: Unsafe Deserialization in MinaConverter.toObjectInput() via TCP/UDP

    YüksekCVSS 8,8Kavram kanıtıEPSS %1

    apache · camel27 Nis 2026

  • CVE-2026-40860
    40Planlayın

    Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    apache · camel27 Nis 2026

  • CVE-2026-33454
    37İzleyin

    Apache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection (CVE-2025-30177 Variant)

    KritikCVSS 9,4Kavram kanıtıEPSS %1

    apache · camel27 Nis 2026

  • CVE-2026-40022
    32İzleyin

    Apache Camel Platform HTTP Main: Authentication Bypass on Non-Root Context Paths in camel main runtime

    YüksekCVSS 8,2Kavram kanıtıEPSS %0

    apache · camel27 Nis 2026

  • CVE-2026-40858
    35İzleyin

    Apache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation Repository

    YüksekCVSS 8,8Kavram kanıtıEPSS %1

    apache · camel27 Nis 2026

  • CVE-2026-27172
    35İzleyin

    Apache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV store

    YüksekCVSS 8,8Kavram kanıtıEPSS %1

    apache · camel27 Nis 2026

  • CVE-2026-33453
    43Planlayın

    Apache Camel: CoAP URI Query Parameter to Exchange Header Injection in camel-coap Allows Single-Packet Pre-Auth Remote Code Execution

    KritikCVSS 10,0Kavram kanıtıEPSS %9

    apache · camel27 Nis 2026

  • CVE-2026-41462
    37İzleyin

    ProjeQtor < 12.4.4 Unauthenticated SQL Injection via Login

    KritikCVSS 9,3Kavram kanıtıEPSS %0

    projeqtor · projeqtor27 Nis 2026

  • CVE-2026-38934
    35İzleyin

    Cross Site Request Forgery vulnerability in diskoverdata diskover-community v.2.3.5.

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    27 Nis 2026

  • CVE-2025-54505
    8İzleyin

    A transient execution vulnerability within AMD CPUs may allow a local user-privileged attacker to leak data via the floating point divisor u

    DüşükCVSS 2,0Kavram kanıtıEPSS %0

    amd · amd epyc™ 7001 series processors27 Nis 2026

  • CVE-2026-29971
    24İzleyin

    A reflected cross-site scripting (XSS) vulnerability exists in WebFileSys version before 2.32.0 and fixed in v.2.32.0.

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    27 Nis 2026

  • CVE-2025-69428
    30İzleyin

    An issue in Pro-Bit before v1.77.4 allows unauthenticated attackers to directly access sensitive directory and its subdirectories.

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    27 Nis 2026

  • CVE-2024-46636
    37İzleyin

    NASA Earth Observing System Data and Information System (EOSDIS) MODAPS v8.1 was discovered to contain a SQL injection vulnerability in the

    KritikCVSS 9,4Kavram kanıtıEPSS %0

    27 Nis 2026

  • CVE-2026-7222
    8İzleyin

    code-projects Coaching Management System Complaint Form complaint.php cross site scripting

    DüşükCVSS 2,0Kavram kanıtıEPSS %0

    code-projects · coaching management system28 Nis 2026

  • CVE-2026-7228
    22İzleyin

    SourceCodester Pizzafy Ecommerce System ajax.php get_cart_count sql injection

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    sourcecodester · pizzafy ecommerce system28 Nis 2026

  • CVE-2026-7229
    8İzleyin

    code-projects Coaching Management System POST reply.php sql injection

    DüşükCVSS 2,1Kavram kanıtıEPSS %0

    code-projects · coaching management system28 Nis 2026

  • CVE-2026-27760
    60Bu hafta

    OpenCATS PHP Code Injection via installer AJAX endpoint

    KritikCVSS 9,2SilahlaştırılmışEPSS %32

    opencats · opencats28 Nis 2026

  • CVE-2025-67223
    30İzleyin

    The Aranda File Server (AFS) component in Aranda Software Aranda Service Desk before 8.3.12 stores daily activity logs with predictable name

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    28 Nis 2026

  • CVE-2026-37750
    24İzleyin

    A reflected Cross-Site Scripting (XSS) vulnerability in School Management System by mahmoudai1 allows unauthenticated remote attackers to ex

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    28 Nis 2026

  • CVE-2026-42167
    34İzleyin

    mod_sql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of US

    YüksekCVSS 8,1Kavram kanıtıEPSS %7

    proftpd · proftpd28 Nis 2026

  • CVE-2026-6807
    22İzleyin

    NSA GRASSMARLIN Improper Restriction of XML External Entity Reference

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    nsa · grassmarlin28 Nis 2026

  • CVE-2026-42248
    40Planlayın

    Missing Signature Verification for Updates in Ollama

    YüksekCVSS 7,7SilahlaştırılmışEPSS %0

    ollama · ollama29 Nis 2026

  • CVE-2026-42249
    40Planlayın

    Remote Code Execution in Ollama via Update Mechanism

    YüksekCVSS 7,7SilahlaştırılmışEPSS %1

    ollama · ollama29 Nis 2026

  • CVE-2025-56534
    24İzleyin

    A cross-site scripting (XSS) vulnerability in the custom authenticator driver of opennebula v6.10.0.1 allows attackers to execute arbitrary

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    opennebula · opennebula29 Nis 2026

  • CVE-2025-56535
    24İzleyin

    A cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via injecting a

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    opennebula · opennebula29 Nis 2026

  • CVE-2025-56536
    24İzleyin

    A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 allows attackers to execute arbitrary web scripts or HTML via inje

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    opennebula · opennebula29 Nis 2026

  • CVE-2025-56537
    24İzleyin

    A stored cross-site scripting (XSS) vulnerability in opennebula v6.10.0.1 and fixed in v.7.0 allows attackers to execute arbitrary web scrip

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    opennebula · opennebula29 Nis 2026

  • CVE-2026-41940
    97Hemen

    WebPros cPanel and WHM Authentication Bypass via Login Flow

    KritikCVSS 9,3KEVSilahlaştırılmışEPSS %98

    cpanel · cpanel29 Nis 2026

  • CVE-2026-7392
    8İzleyin

    SourceCodester Pharmacy Sales and Inventory System ajax.php delete_supplier sql injection

    DüşükCVSS 2,1Kavram kanıtıEPSS %0

    sourcecodester · pharmacy sales and inventory system29 Nis 2026

  • CVE-2026-7393
    8İzleyin

    SourceCodester Pizzafy Ecommerce System File Extension admin_class_novo.php save_menu unrestricted upload

    DüşükCVSS 2,0Kavram kanıtıEPSS %0

    sourcecodester · pizzafy ecommerce system29 Nis 2026

  • CVE-2026-7394
    8İzleyin

    SourceCodester Pizzafy Ecommerce System GET Parameter view_order.php sql injection

    DüşükCVSS 2,0Kavram kanıtıEPSS %0

    sourcecodester · pizzafy ecommerce system29 Nis 2026

  • CVE-2026-7401
    8İzleyin

    SourceCodester CET Automated Grading System with AI Predictive Analytics Registration index.php register cross site scripting

    DüşükCVSS 2,1Kavram kanıtıEPSS %0

    sourcecodester · cet automated grading system with ai predictive analytics29 Nis 2026

  • CVE-2026-42798
    16İzleyin

    Little CMS (lcms2) 2.16 through 2.18 before 2.19 has an integer overflow in ParseCube in cmscgats.c.

    OrtaCVSS 4,0İstismar yokEPSS %0

    littlecms · little cms color engine30 Nis 2026

  • CVE-2026-7270
    31İzleyin

    Local privilege escalation via execve()

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    freebsd · freebsd30 Nis 2026

  • CVE-2026-31787
    31İzleyin

    xen/privcmd: fix double free via VMA splitting

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    linux · linux kernel30 Nis 2026

  • CVE-2026-36340
    32İzleyin

    An issue in Krayin CRM v.2.1.5 and fixed in v.2.1.6 allows a remote attacker to execute arbitrary code via the compose email function

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    30 Nis 2026

  • CVE-2026-36960
    35İzleyin

    A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the U-SPEED N300 Rounter V1.0.0.

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    30 Nis 2026

  • CVE-2026-36956
    35İzleyin

    A Cross-Site Request Forgery (CSRF) vulnerability exists in the web management interface of the Dbit N300 T1 Pro wireless router V1.0.0.

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    dbitnet · dbit n300 t1 pro firmware30 Nis 2026

  • CVE-2026-36957
    30İzleyin

    Dbit N300 T1 Pro Easy Setup Wireless Wi-Fi Router V1.0.0 is vulnerable to Denial of Service via the boa web server URI handler.

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    dbitnet · dbit n300 t1 pro firmware30 Nis 2026

  • CVE-2026-36958
    30İzleyin

    A denial-of-service vulnerability exists in the U-SPEED N300 V1.0.0 wireless router.

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    u-speed · n300 firmware30 Nis 2026

  • CVE-2026-36959
    30İzleyin

    U-SPEED N300 router V1.0.0 does not implement rate limiting or account lockout protections on the /api/login endpoint.

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    u-speed · n300 firmware30 Nis 2026

  • CVE-2025-51846
    34İzleyin

    CryptPad unbounded WebSocket frame flood

    YüksekCVSS 8,7Kavram kanıtıEPSS %0

    xwiki · cryptpad30 Nis 2026