İçeriğe atla
Noroxi

Yayın tarihine göre

Mayıs 2026: sömürülen ve yeni ciddi CVE kayıtları

351 kayıt · 22 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 1 / 4

  • CVE-2026-7567
    40Planlayın

    Temporary Login <= 1.0.0 - Authentication Bypass to Account Takeover

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    elemntor · temporary login1 May 2026

  • CVE-2026-42778
    39İzleyin

    Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2)

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    apache · mina1 May 2026

  • CVE-2026-42779
    39İzleyin

    Apache MINA: AbstractIoBuffer.resolveClass() null-clazz Branch Skips acceptMatchers Filter — Full Object Deserialization RCE (take 2)

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    apache · mina1 May 2026

  • CVE-2026-31717
    35İzleyin

    ksmbd: validate owner of durable handle on reconnect

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    linux · linux kernel1 May 2026

  • CVE-2026-3143
    21İzleyin

    Total Upkeep <= 1.17.1 - Missing Authorization to Unauthenticated Rollback Cancellation

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    boldgrid · total upkeep – wordpress backup plugin plus restore & migrate by boldgrid1 May 2026

  • CVE-2026-31720
    31İzleyin

    usb: gadget: f_uac1_legacy: validate control request size

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    linux · linux kernel1 May 2026

  • CVE-2026-31721
    22İzleyin

    usb: gadget: f_hid: move list and spinlock inits from bind to alloc

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    linux · linux kernel1 May 2026

  • CVE-2026-42471
    33İzleyin

    Unsafe deserialization vulnerability in MixPHP Framework 2.x thru 2.2.17.

    YüksekCVSS 8,1Kavram kanıtıEPSS %1

    1 May 2026

  • CVE-2025-69606
    24İzleyin

    Cross-Site Scripting (XSS) vulnerability was discovered in the GSVoIP web panel version 2.0.90.

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    1 May 2026

  • CVE-2026-31694
    31İzleyin

    fuse: reject oversized dirents in page cache

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    linux · linux kernel1 May 2026

  • CVE-2026-4882
    39İzleyin

    User Registration Advanced Fields <= 1.6.20 - Unauthenticated Arbitrary File Upload

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    wpeverest · user registration advanced fields2 May 2026

  • CVE-2026-7458
    39İzleyin

    User Verification by PickPlugins <= 2.0.46 - Unauthenticated Authentication Bypass via OTP Verification REST API Endpoint

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    pickplugins · user verification by pickplugins2 May 2026

  • CVE-2026-5113
    28İzleyin

    Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Consent Field Hidden Input

    YüksekCVSS 7,2İstismar yokEPSS %0

    gravity forms · gravity forms2 May 2026

  • CVE-2025-14726
    26İzleyin

    Widgets for Social Photo Feed <= 1.8 - Missing Authentication to Unauthenticated Plugin Settings Access/Update via trustindex_feed_hook_instagram REST API endpo

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    trustindex · widgets for social photo feed2 May 2026

  • CVE-2026-4060
    30İzleyin

    Geo Mashup <= 1.13.18 - Unauthenticated Time-Based SQL Injection via 'sort' Parameter

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    cyberhobo · geo mashup2 May 2026

  • CVE-2026-7669
    25İzleyin

    sgl-project SGLang HuggingFace Transformer hf_transformers_utils.py get_tokenizer code injection

    OrtaCVSS 6,3Kavram kanıtıEPSS %0

    sgl-project · sglang2 May 2026

  • CVE-2026-7671
    11İzleyin

    CodeWise Tornet Scooter Mobile App TwoFactor excessive authentication

    DüşükCVSS 2,9Kavram kanıtıEPSS %0

    codewise · tornet scooter mobile app2 May 2026

  • CVE-2026-7731
    8İzleyin

    code-projects BloodBank Managing System get_state.php sql injection

    DüşükCVSS 2,1Kavram kanıtıEPSS %0

    code-projects · bloodbank managing system4 May 2026

  • CVE-2026-24072
    35İzleyin

    Apache HTTP Server: mod_rewrite elevation of privileges via ap_expr

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    apache · http server4 May 2026

  • CVE-2026-7482
    35İzleyin

    Ollama heap out-of-bounds read in GGUF tensor parsing leaks server process memory to unauthenticated remote attackers

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    ollama · ollama4 May 2026

  • CVE-2026-23918
    50Planlayın

    Apache HTTP Server: http2: double free and possible RCE on early reset

    YüksekCVSS 8,8Kavram kanıtıEPSS %49

    apache · http server4 May 2026

  • CVE-2026-33006
    19İzleyin

    Apache HTTP Server: mod_auth_digest timing attack

    OrtaCVSS 4,8Kavram kanıtıEPSS %0

    apache · http server4 May 2026

  • CVE-2026-24118
    39İzleyin

    VM2 Sandbox Breakout Through __lookupGetter__

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    vm2 project · vm24 May 2026

  • CVE-2026-0073
    35İzleyin

    In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code.

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    google · android4 May 2026

  • CVE-2026-42796
    37İzleyin

    Arelle < 2.39.10 Unauthenticated RCE via /rest/configure

    KritikCVSS 9,2Kavram kanıtıEPSS %3

    workiva · arelle4 May 2026

  • CVE-2026-38751
    28İzleyin

    OpenSTAManager version 2.10 and earlier contains an arbitrary file upload vulnerability in the module update functionality (modules/aggiorna

    YüksekCVSS 7,2Kavram kanıtıEPSS %0

    devcode · openstamanager4 May 2026

  • CVE-2026-42154
    30İzleyin

    Prometheus: remote read endpoint allows denial of service via crafted snappy payload

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    prometheus · prometheus4 May 2026

  • CVE-2026-42228
    25İzleyin

    n8n: Hijacking of Unauthenticated Chat Execution

    OrtaCVSS 6,3Kavram kanıtıEPSS %0

    n8n · n8n4 May 2026

  • CVE-2026-42231
    37İzleyin

    n8n: Prototype Pollution in XML Webhook Body Parser Leads to RCE

    KritikCVSS 9,4Kavram kanıtıEPSS %0

    n8n · n8n4 May 2026

  • CVE-2026-42221
    39İzleyin

    nginx-ui: Unauthenticated First-Run Installer Allows Remote Initial Admin Claim

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    nginxui · nginx ui4 May 2026

  • CVE-2026-7791
    34İzleyin

    Improper privilege management in the log rotation mechanism of the Skylight Workspace Config Service in Amazon WorkSpaces for Windows before

    YüksekCVSS 8,5Kavram kanıtıEPSS %0

    amazon · workspaces4 May 2026

  • CVE-2026-3456
    30İzleyin

    GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation <= 1.2.0 - Unauthenticated SQL Injection via 'attributekey'

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    ahmadgb · geekybot — ai copilot, chatbot, woocommerce lead gen & zero-prompt content5 May 2026

  • CVE-2026-3359
    30İzleyin

    Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.42 - Unauthenticated SQL Injection via 'inputs'

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    10web · form maker by 10web – mobile-friendly drag & drop contact form builder5 May 2026

  • CVE-2026-36355
    30İzleyin

    The rtl8192cd Wi-Fi kernel driver in the Realtek rtl819x Jungle SDK (all known versions through v3.4.14B) does not perform any access contro

    YüksekCVSS 7,7Kavram kanıtıEPSS %0

    5 May 2026

  • CVE-2026-36356
    37İzleyin

    The GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1) allows unauthenticated OS command injec

    KritikCVSS 9,1Kavram kanıtıEPSS %3

    5 May 2026

  • CVE-2026-23479
    30İzleyin

    redis-server use-after-free in unblock client flow may allow remote code execution

    YüksekCVSS 7,7Kavram kanıtıEPSS %1

    redis · redis5 May 2026

  • CVE-2026-23631
    25İzleyin

    redis-server Lua use-after-free may allow remote code execution

    OrtaCVSS 6,1Kavram kanıtıEPSS %2

    redis · redis5 May 2026

  • CVE-2026-25243
    31İzleyin

    redis-server RESTORE invalid memory access may allow remote code execution

    YüksekCVSS 7,7Kavram kanıtıEPSS %3

    redis · redis5 May 2026

  • CVE-2026-27960
    40Planlayın

    OpenCTI privilege escalation and unauthenticated access via default admin account

    KritikCVSS 9,8SilahlaştırılmışEPSS %4

    citeum · opencti5 May 2026

  • CVE-2026-32699
    21İzleyin

    FacturaScripts unauthorized modification of immutable nick field via EditUser controller

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    neorazorx · facturascripts5 May 2026

  • CVE-2026-35397
    30İzleyin

    jupyter-server path traversal allows access to sibling directories sharing root_dir name prefix

    YüksekCVSS 7,6Kavram kanıtıEPSS %0

    jupyter · jupyter server5 May 2026

  • CVE-2026-40280
    32İzleyin

    Gotenberg SSRF via case-insensitive URL scheme bypass in webhook and downloadFrom deny-lists

    YüksekCVSS 7,8Kavram kanıtıEPSS %2

    thecodingmachine · gotenberg5 May 2026

  • CVE-2026-36358
    21İzleyin

    Cross Site Scripting vulnerability in Juzaweb CMS v.5.0.0 allows a remote attacker via execute arbitrary code via a crafted script to the Ad

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    6 May 2026

  • CVE-2026-43074
    31İzleyin

    eventpoll: defer struct eventpoll free to RCU grace period

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    linux · linux kernel6 May 2026

  • CVE-2026-20169
    25İzleyin

    Cisco IoT Field Network Director Command Injection Vulnerability

    OrtaCVSS 6,4Kavram kanıtıEPSS %0

    cisco · iot field network director6 May 2026

  • CVE-2026-23870
    30İzleyin

    A denial of service vulnerability could be triggered by sending specially crafted HTTP requests to server function endpoints, this could lea

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    facebook · react-server-dom-parcel6 May 2026

  • CVE-2026-0300
    77Bu hafta

    PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal

    KritikCVSS 9,3KEVSilahlaştırılmışEPSS %31

    paloaltonetworks · pan-os6 May 2026

  • CVE-2026-34473
    31İzleyin

    Unauthenticated DoS in ZTE H8102E, H168N, H167A, H199A, H288A, H198A, H267A, H267N, H268A, H388X, H196A, H369A, H268N, H208N, H367N, H181A,

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    6 May 2026

  • CVE-2026-34474
    31İzleyin

    Sensitive data exposure leading to admin/WLAN credential leak in ZTE ZXHN H298A 1.1 and H108N 2.6.

    YüksekCVSS 7,5Kavram kanıtıEPSS %2

    6 May 2026

  • CVE-2026-7899
    35İzleyin

    Out of bounds read and write in V8 in Google Chrome prior to 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sand

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    google · chrome6 May 2026

  • CVE-2026-40281
    37İzleyin

    Gotenberg vulnerable to argument injection via newlines in ExifTool metadata values

    KritikCVSS 9,1Kavram kanıtıEPSS %2

    thecodingmachine · gotenberg6 May 2026

  • CVE-2026-40003
    27İzleyin

    USB-based arbitrary memory write vulnerability in ZTE ZX297520V3 soc BootROM

    OrtaCVSS 6,8Kavram kanıtıEPSS %0

    zte · zx297520v3 firmware6 May 2026

  • CVE-2026-40982
    36İzleyin

    Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module.

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    vmware · spring cloud config7 May 2026

  • CVE-2026-41640
    36İzleyin

    NocoBase Vulnerable to SQL Injection via String Concatenation in Recursive Eager Loading

    YüksekCVSS 8,8Kavram kanıtıEPSS %2

    nocobase · nocobase7 May 2026

  • CVE-2026-41641
    29İzleyin

    NocoBase Vulnerable to SQL Validation Bypass via `sqlCollection:update` Missing `checkSQL` Call

    YüksekCVSS 7,2Kavram kanıtıEPSS %2

    nocobase · nocobase7 May 2026

  • CVE-2026-6508
    39İzleyin

    RCE in TUBITAK BILGEM's Liderahenk

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    tubitak bilgem software technologies research institute · liderahenk7 May 2026

  • CVE-2026-8080
    27İzleyin

    MISP core - Stored XSS in MISP template (old engine) element attribute type

    OrtaCVSS 6,8Kavram kanıtıEPSS %0

    misp-project · misp7 May 2026

  • CVE-2026-41490
    33İzleyin

    Dagster Vulnerable to SQL Injection via Dynamic Partition Keys in Database I/O Manager Integrations

    YüksekCVSS 8,3Kavram kanıtıEPSS %0

    dagster-io · dagster7 May 2026

  • CVE-2026-36341
    21İzleyin

    Cross-Site Scripting (XSS) vulnerability exists in Webkul Krayin CRM v2.1.5.

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    7 May 2026

  • CVE-2026-6973
    59Planlayın

    An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with admin

    YüksekCVSS 7,2KEVSilahlaştırılmışEPSS %2

    ivanti · endpoint manager mobile7 May 2026

  • CVE-2026-41653
    28İzleyin

    BentoPDF: Stored XSS via Markdown Editor Leading to Persistent File Exfiltration

    YüksekCVSS 7,0Kavram kanıtıEPSS %0

    alam00000 · bentopdf7 May 2026

  • CVE-2026-42826
    30İzleyin

    Azure DevOps Information Disclosure Vulnerability

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    microsoft · azure devops7 May 2026

  • CVE-2026-42880
    38İzleyin

    ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction

    KritikCVSS 9,6Kavram kanıtıEPSS %0

    argoproj · argo cd7 May 2026

  • CVE-2026-41900
    40Planlayın

    OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment

    KritikCVSS 10,0Kavram kanıtıEPSS %1

    th30d4y · openlearnx8 May 2026

  • CVE-2026-42203
    34İzleyin

    LiteLLM: Server-Side Template Injection in /prompts/test endpoint

    YüksekCVSS 8,6Kavram kanıtıEPSS %0

    litellm · litellm8 May 2026

  • CVE-2026-42208
    69Bu hafta

    LiteLLM: SQL injection in Proxy API key verification

    KritikCVSS 9,3KEVSilahlaştırılmışEPSS %5

    litellm · litellm8 May 2026

  • CVE-2026-42271
    92Hemen

    LiteLLM: Authenticated command execution via MCP stdio test endpoints

    YüksekCVSS 8,7KEVSilahlaştırılmışEPSS %92

    litellm · litellm8 May 2026

  • CVE-2023-42343
    24İzleyin

    A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type.

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    8 May 2026

  • CVE-2023-42344
    30İzleyin

    Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on

    YüksekCVSS 7,3Kavram kanıtıEPSS %2

    8 May 2026

  • CVE-2023-47268
    21İzleyin

    In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host whe

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    prusa3d · prusaslicer8 May 2026

  • CVE-2024-27686
    30İzleyin

    Mikrotik RouterOS (x86) 6.40.5 through 6.49.10 (fixed in 7) allows a remote attacker to cause a denial of service (device crash) via crafted

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    8 May 2026

  • CVE-2024-30167
    25İzleyin

    /cgi-bin/time.cgi in Atlona AT-OME-MS42 Matrix Switcher 1.1.2 allow remote authenticated users to execute arbitrary commands as root via a P

    OrtaCVSS 6,3Kavram kanıtıEPSS %1

    8 May 2026

  • CVE-2024-33288
    29İzleyin

    Prison Management System Using PHP v1.0 was discovered to contain a SQL injection vulnerability via the username on the Admin login page.

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    8 May 2026

  • CVE-2024-33722
    25İzleyin

    SOPlanning 1.52.00 is vulnerable to SQL Injection by an authenticated user via projets.php with statut[].

    OrtaCVSS 6,3Kavram kanıtıEPSS %0

    8 May 2026

  • CVE-2024-33724
    21İzleyin

    SOPlanning 1.52.00 is vulnerable to Cross Site Scripting (XSS) via the groupe_id parameter to process/groupe_save.php.

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    8 May 2026

  • CVE-2024-45257
    30İzleyin

    A Command Injection issue in the payload build page in BYOB (Build Your Own Botnet) 2.0 allows attackers to execute arbitrary commands on th

    YüksekCVSS 7,3SilahlaştırılmışEPSS %3

    8 May 2026

  • CVE-2024-46507
    30İzleyin

    A SSTI (server side template injection) vulnerability in the custom template export function in yeti-platform yeti before 2.1.12 allows atta

    YüksekCVSS 7,3Kavram kanıtıEPSS %3

    yeti-platform · yeti8 May 2026

  • CVE-2024-51092
    38İzleyin

    LibreNMS before 24.10.0 allows a remote attacker to execute arbitrary code via OS command injection involving AboutController.php's index(),

    KritikCVSS 9,1SilahlaştırılmışEPSS %7

    librenms · librenms8 May 2026

  • CVE-2024-53326
    29İzleyin

    LINQPad before 5.52.01 Pro edition is vulnerable to Unsafe Deserialization in LINQPad.AutoRefManager::PopulateFromCache(), leading to code e

    YüksekCVSS 7,3SilahlaştırılmışEPSS %0

    8 May 2026

  • CVE-2025-67886
    25İzleyin

    Bitrix24 through 25.100.300 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload

    OrtaCVSS 6,3Kavram kanıtıEPSS %1

    8 May 2026

  • CVE-2025-67887
    39İzleyin

    1C-Bitrix through 25.100.500 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    8 May 2026

  • CVE-2025-67888
    30İzleyin

    An issue was discovered in Control Web Panel (CWP) before 0.9.8.1209.

    YüksekCVSS 7,3SilahlaştırılmışEPSS %3

    8 May 2026

  • CVE-2025-69599
    39İzleyin

    RayVentory Scan Engine through 12.6 Update 8 allows attackers to gain privileges if they control the value of the PATH environment variable.

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    8 May 2026

  • CVE-2026-8069
    34İzleyin

    PredatorSense V3: Local Privilege Escalation (LPE) vulnerability

    YüksekCVSS 8,5Kavram kanıtıEPSS %0

    acer · nitrosense8 May 2026

  • CVE-2026-43284
    63Bu hafta

    xfrm: esp: avoid in-place decrypt on shared skb frags

    YüksekCVSS 8,8SilahlaştırılmışEPSS %94

    linux · linux kernel8 May 2026

  • CVE-2025-55449
    29İzleyin

    AstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Response_and_Bot_Operations_Tool as the hardcoded private key used to sign a JWT.

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    astrbot · astrbot8 May 2026

  • CVE-2025-69690
    36İzleyin

    Netgate pfSense CE 2.7.2 allows code execution by using the module installer with a backup file with a serialized PHP object containing the

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    pfsense · pfsense8 May 2026

  • CVE-2026-39816
    30İzleyin

    Apache NiFi: Missing Execute Code Required Permission on TinkerpopClientService

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    apache · nifi8 May 2026

  • CVE-2026-44338
    29İzleyin

    PraisonAI ships and generates a legacy API server with authentication disabled by default, allowing unauthenticated workflow execution

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    praison · praisonai8 May 2026

  • CVE-2026-38361
    31İzleyin

    Multiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2.

    YüksekCVSS 7,5Kavram kanıtıEPSS %2

    fohrloop · dash-uploader8 May 2026

  • CVE-2026-41575
    24İzleyin

    th30d4y/IP: DOM-Based Cross-Site Scripting (XSS) Vulnerability

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    th30d4y · w4nn4d13\/ip8 May 2026

  • CVE-2026-38360
    41Planlayın

    Directory Traversal vulnerability in fohrloop dash-uploader v.0.1.0 through v.0.7.0a2 allows a remote attacker to execute arbitrary code via

    KritikCVSS 9,8Kavram kanıtıEPSS %6

    8 May 2026

  • CVE-2026-41432
    32İzleyin

    New API: Stripe Webhook Signature Bypass via Empty Secret Enables Unlimited Quota Fraud

    YüksekCVSS 8,2Kavram kanıtıEPSS %0

    newapi · new api8 May 2026

  • CVE-2026-42298
    39İzleyin

    Postiz: Arbitrary Code Execution and Token Exfiltration in pr-docker-build.yml via untrusted Dockerfile.dev

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    gitroom · postiz8 May 2026

  • CVE-2026-44656
    18İzleyin

    Vim: OS Command Injection via 'path' completion

    OrtaCVSS 4,6Kavram kanıtıEPSS %0

    vim · vim8 May 2026

  • CVE-2026-6664
    30İzleyin

    PgBouncer integer overflow in PgBouncer network packet parsing

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    pgbouncer · pgbouncer8 May 2026

  • CVE-2026-6666
    30İzleyin

    PgBouncer crash in kill_pool_logins_server_error

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    pgbouncer · pgbouncer8 May 2026

  • CVE-2026-42461
    34İzleyin

    Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)

    YüksekCVSS 8,7Kavram kanıtıEPSS %1

    getarcane · arcane9 May 2026

  • CVE-2026-42569
    37İzleyin

    phpvms: /importer authorization bypass causing full database wipe

    KritikCVSS 9,4Kavram kanıtıEPSS %1

    phpvms · phpvms9 May 2026

  • CVE-2026-8196
    11İzleyin

    JeecgBoot mLogin Endpoint LoginController.java authorization

    DüşükCVSS 2,9Kavram kanıtıEPSS %0

    9 May 2026