Yayın tarihine göre
Mayıs 2026: sömürülen ve yeni ciddi CVE kayıtları
351 kayıt · 22 KEV. Yayın sırasıyla.
Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.
Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.
Sayfa 2 / 4
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
29İzleyin | CVE-2026-6433Kavram kanıtı | Custom CSS JS PHP <= 2.0.7 - Unauthenticated SQL Injection to RCEunknown · custom css-js-php · CWE-94 | Yüksek7,3 | — | %0,8 | 11 May 2026 |
40Planlayın | CVE-2026-43500Silahlaştırılmış | rxrpc: Also unshare DATA/RESPONSE packets when paged frags are presentlinux · linux kernel · CWE-787 | Yüksek7,8 | — | %2,6 | 11 May 2026 |
32İzleyin | CVE-2026-4802Kavram kanıtı | Cockpit: cockpit: arbitrary command execution via crafted links in system logs uired hat · red hat enterprise linux 10 · CWE-78 | Yüksek8,0 | — | %1,1 | 11 May 2026 |
37İzleyin | CVE-2026-42607Kavram kanıtı | Grav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Featuregetgrav · grav · CWE-94 | Kritik9,1 | — | %2,2 | 11 May 2026 |
37İzleyin | CVE-2026-42613Kavram kanıtı | Grav: Privilege Escalation via Missing Server-Side Validation of groups/accessgetgrav · grav · CWE-20 | Kritik9,4 | — | %0,5 | 11 May 2026 |
23İzleyin | CVE-2026-6815Kavram kanıtı | An arbitrary file write vulnerability exists in Casdoor's Local File System storage provider.casbin · casdoor · CWE-22 | Orta5,9 | — | %0,5 | 11 May 2026 |
29İzleyin | CVE-2026-2291Kavram kanıtı | dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, whicdnsmasq · dnsmasq · CWE-190 | Yüksek7,3 | — | %0,6 | 11 May 2026 |
31İzleyin | CVE-2026-3609Kavram kanıtı | XIGNCODE3 xhunter1.sys kernel driver contains a Privilege Escalation Vulnerabilitywellbia · xigncode3 · CWE-269 | Yüksek7,8 | — | %0,1 | 11 May 2026 |
21İzleyin | CVE-2026-4893Kavram kanıtı | An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 cldnsmasq · dnsmasq · CWE-287 | Orta5,3 | — | %0,5 | 11 May 2026 |
29İzleyin | CVE-2026-5172Kavram kanıtı | A buffer overflow in dnsmasq’s extract_addresses() function allows an attacker to trigger a heap out-of-bounds read and crash by exploiting dnsmasq · dnsmasq · CWE-125 | Yüksek7,3 | — | %0,6 | 11 May 2026 |
31İzleyin | CVE-2026-2614Kavram kanıtı | Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflowlfprojects · mlflow · CWE-22 | Yüksek7,5 | — | %3,2 | 11 May 2026 |
26İzleyin | CVE-2026-28956Kavram kanıtı | A memory corruption issue was addressed with improved input validation.apple · ipados · CWE-125 | Orta6,5 | — | %0,4 | 11 May 2026 |
30İzleyin | CVE-2026-28990Kavram kanıtı | The issue was addressed with improved memory handling.apple · ipados · CWE-119 | Yüksek7,5 | — | %0,5 | 11 May 2026 |
18İzleyin | CVE-2026-28992Kavram kanıtı | A memory corruption vulnerability was addressed with improved locking.apple · ipados · CWE-362 | Orta4,7 | — | %0,1 | 11 May 2026 |
35İzleyin | CVE-2026-28995Kavram kanıtı | A logic issue was addressed with improved restrictions.apple · ipados · CWE-269 | Yüksek8,8 | — | %0,1 | 11 May 2026 |
29İzleyin | CVE-2026-43655Kavram kanıtı | An out-of-bounds read was addressed with improved bounds checking.apple · ipados · CWE-125 | Yüksek7,3 | — | %0,3 | 11 May 2026 |
32İzleyin | CVE-2026-43893Kavram kanıtı | exiftool-vendored: Argument injection via newline characters in tag namesphotostructure · exiftool-vendored.js · CWE-88 | Yüksek8,2 | — | %0,5 | 11 May 2026 |
39İzleyin | CVE-2026-43914Kavram kanıtı | Vaultwarden: Brute-force protection bypass vulnerabilitydani-garcia · vaultwarden · CWE-307 | Kritik9,8 | — | %0,4 | 11 May 2026 |
68Bu hafta | CVE-2026-45321Silahlaştırılmış | Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keystanstack · tanstack\/arktype-adapter · CWE-506 | Kritik9,6 | KEV | %1,0 | 11 May 2026 |
37İzleyin | CVE-2026-41551Kavram kanıtı | A vulnerability has been identified in ROS# (All versions < V2.2.2).siemens · ros# · CWE-23 | Kritik9,3 | — | %0,6 | 12 May 2026 |
34İzleyin | CVE-2026-5029Kavram kanıtı | RCE in Code Runner MCP Servercode runner mcp server · code runner mcp server · CWE-306 | Yüksek8,7 | — | %0,4 | 12 May 2026 |
30İzleyin | CVE-2026-8161Kavram kanıtı | multiparty vulnerable to Denial of Service via Prototype Pollution leading to Uncaught Exceptionpillarjs · multiparty · CWE-248 | Yüksek7,5 | — | %0,5 | 12 May 2026 |
36İzleyin | CVE-2026-45091Kavram kanıtı | sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)davidalmeidac · sealed-env · CWE-200 | Kritik9,1 | — | %0,4 | 12 May 2026 |
26İzleyin | CVE-2026-8388Kavram kanıtı | Incorrect boundary conditions in the JavaScript Engine: JIT componentmozilla · firefox · CWE-119 | Orta6,5 | — | %0,4 | 12 May 2026 |
35İzleyin | CVE-2026-8389Kavram kanıtı | JIT miscompilation in the JavaScript Engine: JIT componentmozilla · firefox · CWE-119 | Yüksek8,8 | — | %0,4 | 12 May 2026 |
18İzleyin | CVE-2026-5061Kavram kanıtı | Consul-template vulnerable to sandbox path bypass in file helper via a symlink attackhashicorp · tooling · CWE-59 | Orta4,7 | — | %0,1 | 12 May 2026 |
40Planlayın | CVE-2026-41293Kavram kanıtı | Apache Tomcat: HTTP/2 request headers not validatedapache · tomcat · CWE-20 | Kritik9,8 | — | %1,6 | 12 May 2026 |
39İzleyin | CVE-2026-43512Kavram kanıtı | Apache Tomcat: Digest authenticator will authenticate any unknown userapache · tomcat · CWE-592 | Kritik9,8 | — | %1,3 | 12 May 2026 |
36İzleyin | CVE-2026-43515Kavram kanıtı | Apache Tomcat: Security constraints not correctly appliedapache · tomcat · CWE-285 | Kritik9,1 | — | %1,2 | 12 May 2026 |
36İzleyin | CVE-2026-29204Kavram kanıtı | Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another user’s `addonId` webpros · whmcs · CWE-639 | Kritik9,1 | — | %0,4 | 12 May 2026 |
31İzleyin | CVE-2026-34344Kavram kanıtı | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1607 · CWE-843 | Yüksek7,8 | — | %0,3 | 12 May 2026 |
31İzleyin | CVE-2026-40369Kavram kanıtı | Windows Kernel Elevation of Privilege Vulnerabilitymicrosoft · windows 11 24h2 · CWE-822 | Yüksek7,8 | — | %0,3 | 12 May 2026 |
39İzleyin | CVE-2026-41089Kavram kanıtı | Windows Netlogon Remote Code Execution Vulnerabilitymicrosoft · windows server 2012 · CWE-121 | Kritik9,8 | — | %0,9 | 12 May 2026 |
39İzleyin | CVE-2026-41096Kavram kanıtı | Windows DNS Client Remote Code Execution Vulnerabilitymicrosoft · windows 11 23h2 · CWE-122 | Kritik9,8 | — | %0,9 | 12 May 2026 |
38İzleyin | CVE-2026-42048Kavram kanıtı | Langflow: Path Traversal in Langflow Knowledge Bases APIlangflow · langflow · CWE-22 | Kritik9,6 | — | %0,6 | 12 May 2026 |
30İzleyin | CVE-2026-42141Kavram kanıtı | Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionalityxibosignage · xibo-cms · CWE-918 | Yüksek7,7 | — | %0,4 | 12 May 2026 |
24İzleyin | CVE-2026-44166Kavram kanıtı | Pocketbase: Account pre-hijacking via OAuth2 unverfied->verified autolinking upgradepocketbase · pocketbase · CWE-287 | Orta6,1 | — | %0,3 | 12 May 2026 |
39İzleyin | CVE-2026-44277Kavram kanıtı | A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6fortinet · fortiauthenticator · CWE-284 | Kritik9,8 | — | %0,4 | 12 May 2026 |
38İzleyin | CVE-2026-44343Kavram kanıtı | WGDashboard: Critical Vulnerability in 4.3.2wgdashboard · wgdashboard · CWE-20 | Kritik9,3 | — | %2,3 | 12 May 2026 |
37İzleyin | CVE-2026-44225Kavram kanıtı | Pulpy: Incomplete filesystem sandbox in pulpy.fs bridge allows packaged web apps to read arbitrary user filesenesgkky · pulpy · CWE-22 | Kritik9,3 | — | %1,3 | 12 May 2026 |
39İzleyin | CVE-2026-45185Kavram kanıtı | Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path.exim · exim · CWE-416 | Kritik9,8 | — | %0,9 | 12 May 2026 |
34İzleyin | CVE-2026-44011Kavram kanıtı | Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behaviorcraftcms · cms · CWE-479 | Yüksek8,6 | — | %0,4 | 12 May 2026 |
28İzleyin | CVE-2026-44246Kavram kanıtı | nnU-Net: Agentic workflow injection in `.github/workflows/issue-triage.yml` of `MIC-DKFZ/nnUNet`dkfz · nnu-net · CWE-74 | Yüksek7,2 | — | %0,2 | 12 May 2026 |
35İzleyin | CVE-2026-44403Kavram kanıtı | Wing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session Serializationwftpserver · wing ftp server · CWE-94 | Yüksek8,6 | — | %2,2 | 12 May 2026 |
38İzleyin | CVE-2026-44262Kavram kanıtı | Scramble: Remote code execution via evaluation of user-controlled input in validation rulesdedoc · scramble · CWE-94 | Kritik9,4 | — | %3,8 | 12 May 2026 |
36İzleyin | CVE-2026-41901Kavram kanıtı | Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressionsthymeleaf · thymeleaf · CWE-917 | Kritik9,0 | — | %0,5 | 12 May 2026 |
27İzleyin | CVE-2026-21015Kavram kanıtı | Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique identifier.samsung · android · CWE-276 | Orta6,8 | — | %0,0 | 13 May 2026 |
20İzleyin | CVE-2026-21016Kavram kanıtı | Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.samsung · android · CWE-266 | Orta5,1 | — | %0,0 | 13 May 2026 |
27İzleyin | CVE-2026-21018Kavram kanıtı | Out-of-bounds write in SveService prior to SMR May-2026 Release 1 allows local privileged attackers to execute arbitrary code.samsung · android · CWE-787 | Orta6,8 | — | %0,1 | 13 May 2026 |
34İzleyin | CVE-2026-21019Kavram kanıtı | Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code wsamsung mobile · samsung mobile devices · CWE-20 | Yüksek8,6 | — | %0,1 | 13 May 2026 |
20İzleyin | CVE-2026-21020Kavram kanıtı | Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged funcsamsung · android · CWE-926 | Orta5,1 | — | %0,0 | 13 May 2026 |
26İzleyin | CVE-2026-4782Kavram kanıtı | Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameterthemefusion · avada (fusion) builder · CWE-36 | Orta6,5 | — | %0,4 | 13 May 2026 |
22İzleyin | CVE-2025-29338Kavram kanıtı | NXP moal.ko Wi-Fi driver 5.1.7.10 FW version from v17.92.1.p149.43 To v17.92.1.p149.157 was discovered to contain a buffer overflow via the CWE-120 | Orta5,6 | — | %0,1 | 13 May 2026 |
26İzleyin | CVE-2026-31156Kavram kanıtı | A path injection vulnerability exists in OpenPLC v3 (2c82b0e79c53f8c1f1458eee15fec173400d6e1a) as the binary program compiled from glue_geneopenplcproject · openplc v3 firmware · CWE-22 | Orta6,5 | — | %0,4 | 13 May 2026 |
34İzleyin | CVE-2026-34176İstismar yok | Knowledge Appliance mode iControl REST vulnerabilityf5 · big-ip access policy manager · CWE-78 | Yüksek8,5 | — | %0,8 | 13 May 2026 |
25İzleyin | CVE-2026-40701Kavram kanıtı | NGINX ngx_http_ssl_module vulnerabilityf5 · dos · CWE-416 | Orta6,3 | — | %0,6 | 13 May 2026 |
25İzleyin | CVE-2026-42926Kavram kanıtı | NGINX ngx_http_proxy_v2_module vulnerabilityf5 · nginx gateway fabric · CWE-172 | Orta6,3 | — | %0,3 | 13 May 2026 |
37İzleyin | CVE-2026-42945Kavram kanıtı | NGINX ngx_http_rewrite_module vulnerabilityf5 · dos · CWE-122 | Kritik9,2 | — | %3,3 | 13 May 2026 |
34İzleyin | CVE-2026-45033Kavram kanıtı | GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitorgithub · copilot-cli · CWE-696 | Yüksek8,5 | — | %0,3 | 13 May 2026 |
30İzleyin | CVE-2026-44575İstismar yok | Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routesvercel · next.js · CWE-288 | Yüksek7,5 | — | %0,7 | 13 May 2026 |
60Bu hafta | CVE-2026-0265Silahlaştırılmış | PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabledpaloaltonetworks · pan-os · CWE-347 | Yüksek7,2 | — | %1,0 | 13 May 2026 |
35İzleyin | CVE-2026-44578Kavram kanıtı | Next.js: Server-side request forgery in applications using WebSocket upgradesvercel · next.js · CWE-918 | Yüksek8,6 | — | %1,8 | 13 May 2026 |
30İzleyin | CVE-2026-44579Kavram kanıtı | Next.js: Denial of Service via connection exhaustion in applications using Cache Componentsvercel · next.js · CWE-770 | Yüksek7,5 | — | %0,7 | 13 May 2026 |
30İzleyin | CVE-2026-45109İstismar yok | Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routesvercel · next.js · CWE-288 | Yüksek7,5 | — | %0,7 | 13 May 2026 |
90Hemen | CVE-2026-0257Silahlaştırılmış | PAN-OS: GlobalProtect Authentication Bypass Vulnerabilitiespaloaltonetworks · pan-os · CWE-565 | Yüksek7,8 | KEV | %96,8 | 13 May 2026 |
34İzleyin | CVE-2026-42031Kavram kanıtı | CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`okfn · ckan · CWE-89 | Yüksek8,3 | — | %2,1 | 13 May 2026 |
26İzleyin | CVE-2026-42032İstismar yok | CKAN: Unauthenticated Authorization Bypass in `datastore_search_sql`okfn · ckan · CWE-863 | Orta6,7 | — | %0,4 | 13 May 2026 |
30İzleyin | CVE-2026-42582İstismar yok | Netty: HTTP/3 QPACK literal unbounded allocationnetty · netty · CWE-770 | Yüksek7,5 | — | %0,4 | 13 May 2026 |
36İzleyin | CVE-2026-44351Kavram kanıtı | fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypassnearform · fast-jwt · CWE-287 | Kritik9,1 | — | %0,3 | 13 May 2026 |
24İzleyin | CVE-2026-44376Kavram kanıtı | CubeCart: Reflected XSS in Store Search Barcubecart · v6 · CWE-79 | Orta6,1 | — | %0,6 | 13 May 2026 |
37İzleyin | CVE-2026-44381Kavram kanıtı | MISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listingsmisp-project · misp · CWE-89 | Kritik9,3 | — | %0,7 | 13 May 2026 |
23İzleyin | CVE-2026-8328İstismar yok | FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host addresspython software foundation · cpython · CWE-918 | Orta5,9 | — | %0,4 | 13 May 2026 |
40Planlayın | CVE-2026-8181Kavram kanıtı | Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeoverburstbv · burst statistics – privacy-friendly wordpress analytics (google analytics alternative) · CWE-287 | Kritik9,8 | — | %3,0 | 14 May 2026 |
39İzleyin | CVE-2026-6271Kavram kanıtı | Career Section <= 1.7 - Unauthenticated Arbitrary File Uploadshahinurislam · career section · CWE-434 | Kritik9,8 | — | %1,0 | 14 May 2026 |
21İzleyin | CVE-2026-6145Kavram kanıtı | User Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameterwpeverest · user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builder · CWE-862 | Orta5,3 | — | %0,4 | 14 May 2026 |
35İzleyin | CVE-2026-6475Kavram kanıtı | PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choicepostgresql · postgresql · CWE-61 | Yüksek8,8 | — | %0,3 | 14 May 2026 |
35İzleyin | CVE-2026-6477İstismar yok | PostgreSQL libpq lo_* functions let server superuser overwrite client stack memorypostgresql · postgresql · CWE-242 | Yüksek8,8 | — | %0,4 | 14 May 2026 |
35İzleyin | CVE-2026-42559Kavram kanıtı | RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transportmodelcontextprotocol · rust-sdk · CWE-346 | Yüksek8,8 | — | %0,2 | 14 May 2026 |
37İzleyin | CVE-2026-42281Kavram kanıtı | MagicMirror²: Unauthenticated SSRF via /cors endpointmagicmirror · magicmirror · CWE-918 | Kritik9,2 | — | %1,6 | 14 May 2026 |
40Planlayın | CVE-2026-42589Kavram kanıtı | Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injectionthecodingmachine · gotenberg · CWE-78 | Kritik9,8 | — | %3,6 | 14 May 2026 |
38İzleyin | CVE-2026-42596Kavram kanıtı | Gotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhookthecodingmachine · gotenberg · CWE-918 | Kritik9,4 | — | %1,7 | 14 May 2026 |
98Hemen | CVE-2026-20182Silahlaştırılmış | Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerabilitycisco · catalyst sd-wan manager · CWE-287 | Kritik10,0 | KEV | %91,8 | 14 May 2026 |
34İzleyin | CVE-2026-20224Kavram kanıtı | Cisco Catalyst SD-WAN Manager XML External Entity Injection Vulnerabilitycisco · catalyst sd-wan manager · CWE-20 | Yüksek8,6 | — | %1,0 | 14 May 2026 |
60Bu hafta | CVE-2026-42897Silahlaştırılmış | Microsoft Exchange Server Spoofing Vulnerabilitymicrosoft · exchange server · CWE-79 | Orta6,1 | KEV | %0,5 | 14 May 2026 |
37İzleyin | CVE-2026-22599Kavram kanıtı | Strapi Vulnerable to SQL Injection in Content Type Builderstrapi · strapi · CWE-89 | Kritik9,3 | — | %1,1 | 14 May 2026 |
8İzleyin | CVE-2026-22706Kavram kanıtı | Strapi: Password Reset Does Not Revoke Existing Refresh Sessionsstrapi · strapi · CWE-613 | Düşük2,1 | — | %0,3 | 14 May 2026 |
37İzleyin | CVE-2026-27886Kavram kanıtı | Strapi may leak sensitive data via relational filtering due to lack of query sanitizationstrapi · strapi · CWE-22 | Kritik9,2 | — | %2,5 | 14 May 2026 |
27İzleyin | CVE-2025-64526İstismar yok | Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keyingstrapi · strapi · CWE-307 | Orta6,9 | — | %0,4 | 14 May 2026 |
34İzleyin | CVE-2026-2652Kavram kanıtı | Authentication Bypass in mlflow/mlflowlfprojects · mlflow · CWE-305 | Yüksek8,6 | — | %1,4 | 14 May 2026 |
39İzleyin | CVE-2026-5229Kavram kanıtı | Receive Notifications After Form Submitting – Form Notify for Any Forms <= 1.1.10 - Unauthenticated Authentication Bypass via LINE OAuth Callbackm615926 · receive notifications after form submitting – form notify for any forms · CWE-287 | Kritik9,8 | — | %1,1 | 15 May 2026 |
67Bu hafta | CVE-2026-8398Silahlaştırılmış | A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434)disc-soft · daemon tools · CWE-506 | Kritik9,3 | KEV | %0,9 | 15 May 2026 |
32İzleyin | CVE-2026-35194Kavram kanıtı | Apache Flink: Remote code execution via SQL injection in code generationapache · flink · CWE-94 | Yüksek8,1 | — | %0,6 | 15 May 2026 |
40Planlayın | CVE-2026-46333Silahlaştırılmış | ptrace: slightly saner 'get_dumpable()' logiclinux · linux kernel · CWE-269 | Yüksek7,1 | — | %0,5 | 15 May 2026 |
38İzleyin | CVE-2026-46364Kavram kanıtı | phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptchathorsten · phpmyfaq · CWE-89 | Kritik9,3 | — | %2,1 | 15 May 2026 |
36İzleyin | CVE-2026-44551Kavram kanıtı | Open WebUI: LDAP Empty Password Authentication Bypassopenwebui · open webui · CWE-287 | Kritik9,1 | — | %1,6 | 15 May 2026 |
21İzleyin | CVE-2026-45397Kavram kanıtı | Open WebUI: Unauthenticated RAG Configuration Disclosureopenwebui · open webui · CWE-306 | Orta5,3 | — | %0,8 | 15 May 2026 |
34İzleyin | CVE-2026-45401Kavram kanıtı | Open WebUI: SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpointsopenwebui · open webui · CWE-918 | Yüksek8,5 | — | %0,3 | 15 May 2026 |
14İzleyin | CVE-2026-45316Kavram kanıtı | Open WebUI: Read-Only Users Can Toggle Note Pin Status via Incorrect Permission Check (Write via Read-Only Access)openwebui · open webui · CWE-863 | Düşük3,5 | — | %0,2 | 15 May 2026 |
34İzleyin | CVE-2026-6379Kavram kanıtı | WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection via 'wppa-supersearch' Parameterunknown · wp photo album plus · CWE-89 | Yüksek8,6 | — | %0,4 | 18 May 2026 |
26İzleyin | CVE-2026-20685Kavram kanıtı | An attacker in a privileged network position may be able to leak sensitive information.apple · private cloud compute · CWE-20 | Orta6,5 | — | %0,2 | 18 May 2026 |
- CVE-2026-643329İzleyin
Custom CSS JS PHP <= 2.0.7 - Unauthenticated SQL Injection to RCE
YüksekCVSS 7,3Kavram kanıtıEPSS %0unknown · custom css-js-php11 May 2026
- CVE-2026-4350040Planlayın
rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
YüksekCVSS 7,8SilahlaştırılmışEPSS %2linux · linux kernel11 May 2026
- CVE-2026-480232İzleyin
Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui
YüksekCVSS 8,0Kavram kanıtıEPSS %1red hat · red hat enterprise linux 1011 May 2026
- CVE-2026-4260737İzleyin
Grav: Remote Code Execution (RCE) via Malicious Plugin ZIP Upload in Direct Install Feature
KritikCVSS 9,1Kavram kanıtıEPSS %2getgrav · grav11 May 2026
- CVE-2026-4261337İzleyin
Grav: Privilege Escalation via Missing Server-Side Validation of groups/access
KritikCVSS 9,4Kavram kanıtıEPSS %0getgrav · grav11 May 2026
- CVE-2026-681523İzleyin
An arbitrary file write vulnerability exists in Casdoor's Local File System storage provider.
OrtaCVSS 5,9Kavram kanıtıEPSS %0casbin · casdoor11 May 2026
- CVE-2026-229129İzleyin
dnsmasqs extract_name() function can be abused to cause a heap buffer overflow, allowing an attacker to inject false DNS cache entries, whic
YüksekCVSS 7,3Kavram kanıtıEPSS %0dnsmasq · dnsmasq11 May 2026
- CVE-2026-360931İzleyin
XIGNCODE3 xhunter1.sys kernel driver contains a Privilege Escalation Vulnerability
YüksekCVSS 7,8Kavram kanıtıEPSS %0wellbia · xigncode311 May 2026
- CVE-2026-489321İzleyin
An information disclosure vulnerability in dnsmasq allows remote attackers to bypass source checks via a crafted DNS packet with RFC 7871 cl
OrtaCVSS 5,3Kavram kanıtıEPSS %0dnsmasq · dnsmasq11 May 2026
- CVE-2026-517229İzleyin
A buffer overflow in dnsmasq’s extract_addresses() function allows an attacker to trigger a heap out-of-bounds read and crash by exploiting
YüksekCVSS 7,3Kavram kanıtıEPSS %0dnsmasq · dnsmasq11 May 2026
- CVE-2026-261431İzleyin
Arbitrary File Read via Prompt Tag Source Validation Bypass in mlflow/mlflow
YüksekCVSS 7,5Kavram kanıtıEPSS %3lfprojects · mlflow11 May 2026
- CVE-2026-2895626İzleyin
A memory corruption issue was addressed with improved input validation.
OrtaCVSS 6,5Kavram kanıtıEPSS %0apple · ipados11 May 2026
- CVE-2026-2899030İzleyin
The issue was addressed with improved memory handling.
YüksekCVSS 7,5Kavram kanıtıEPSS %0apple · ipados11 May 2026
- CVE-2026-2899218İzleyin
A memory corruption vulnerability was addressed with improved locking.
OrtaCVSS 4,7Kavram kanıtıEPSS %0apple · ipados11 May 2026
- CVE-2026-2899535İzleyin
A logic issue was addressed with improved restrictions.
YüksekCVSS 8,8Kavram kanıtıEPSS %0apple · ipados11 May 2026
- CVE-2026-4365529İzleyin
An out-of-bounds read was addressed with improved bounds checking.
YüksekCVSS 7,3Kavram kanıtıEPSS %0apple · ipados11 May 2026
- CVE-2026-4389332İzleyin
exiftool-vendored: Argument injection via newline characters in tag names
YüksekCVSS 8,2Kavram kanıtıEPSS %0photostructure · exiftool-vendored.js11 May 2026
- CVE-2026-4391439İzleyin
Vaultwarden: Brute-force protection bypass vulnerability
KritikCVSS 9,8Kavram kanıtıEPSS %0dani-garcia · vaultwarden11 May 2026
- CVE-2026-4532168Bu hafta
Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys
KritikCVSS 9,6KEVSilahlaştırılmışEPSS %1tanstack · tanstack\/arktype-adapter11 May 2026
- CVE-2026-4155137İzleyin
A vulnerability has been identified in ROS# (All versions < V2.2.2).
KritikCVSS 9,3Kavram kanıtıEPSS %0siemens · ros#12 May 2026
- CVE-2026-502934İzleyin
RCE in Code Runner MCP Server
YüksekCVSS 8,7Kavram kanıtıEPSS %0code runner mcp server · code runner mcp server12 May 2026
- CVE-2026-816130İzleyin
multiparty vulnerable to Denial of Service via Prototype Pollution leading to Uncaught Exception
YüksekCVSS 7,5Kavram kanıtıEPSS %0pillarjs · multiparty12 May 2026
- CVE-2026-4509136İzleyin
sealed-env: TOTP secret embedded in unseal token payload (enterprise mode)
KritikCVSS 9,1Kavram kanıtıEPSS %0davidalmeidac · sealed-env12 May 2026
- CVE-2026-838826İzleyin
Incorrect boundary conditions in the JavaScript Engine: JIT component
OrtaCVSS 6,5Kavram kanıtıEPSS %0mozilla · firefox12 May 2026
- CVE-2026-838935İzleyin
JIT miscompilation in the JavaScript Engine: JIT component
YüksekCVSS 8,8Kavram kanıtıEPSS %0mozilla · firefox12 May 2026
- CVE-2026-506118İzleyin
Consul-template vulnerable to sandbox path bypass in file helper via a symlink attack
OrtaCVSS 4,7Kavram kanıtıEPSS %0hashicorp · tooling12 May 2026
- CVE-2026-4129340Planlayın
Apache Tomcat: HTTP/2 request headers not validated
KritikCVSS 9,8Kavram kanıtıEPSS %1apache · tomcat12 May 2026
- CVE-2026-4351239İzleyin
Apache Tomcat: Digest authenticator will authenticate any unknown user
KritikCVSS 9,8Kavram kanıtıEPSS %1apache · tomcat12 May 2026
- CVE-2026-4351536İzleyin
Apache Tomcat: Security constraints not correctly applied
KritikCVSS 9,1Kavram kanıtıEPSS %1apache · tomcat12 May 2026
- CVE-2026-2920436İzleyin
Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another user’s `addonId`
KritikCVSS 9,1Kavram kanıtıEPSS %0webpros · whmcs12 May 2026
- CVE-2026-3434431İzleyin
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
YüksekCVSS 7,8Kavram kanıtıEPSS %0microsoft · windows 10 160712 May 2026
- CVE-2026-4036931İzleyin
Windows Kernel Elevation of Privilege Vulnerability
YüksekCVSS 7,8Kavram kanıtıEPSS %0microsoft · windows 11 24h212 May 2026
- CVE-2026-4108939İzleyin
Windows Netlogon Remote Code Execution Vulnerability
KritikCVSS 9,8Kavram kanıtıEPSS %0microsoft · windows server 201212 May 2026
- CVE-2026-4109639İzleyin
Windows DNS Client Remote Code Execution Vulnerability
KritikCVSS 9,8Kavram kanıtıEPSS %0microsoft · windows 11 23h212 May 2026
- CVE-2026-4204838İzleyin
Langflow: Path Traversal in Langflow Knowledge Bases API
KritikCVSS 9,6Kavram kanıtıEPSS %0langflow · langflow12 May 2026
- CVE-2026-4214130İzleyin
Xibo: Authenticated Server-Side Request Forgery (SSRF) in Library Upload via URL functionality
YüksekCVSS 7,7Kavram kanıtıEPSS %0xibosignage · xibo-cms12 May 2026
- CVE-2026-4416624İzleyin
Pocketbase: Account pre-hijacking via OAuth2 unverfied->verified autolinking upgrade
OrtaCVSS 6,1Kavram kanıtıEPSS %0pocketbase · pocketbase12 May 2026
- CVE-2026-4427739İzleyin
A improper access control vulnerability in Fortinet FortiAuthenticator 8.0.2, FortiAuthenticator 8.0.0, FortiAuthenticator 6.6.0 through 6.6
KritikCVSS 9,8Kavram kanıtıEPSS %0fortinet · fortiauthenticator12 May 2026
- CVE-2026-4434338İzleyin
WGDashboard: Critical Vulnerability in 4.3.2
KritikCVSS 9,3Kavram kanıtıEPSS %2wgdashboard · wgdashboard12 May 2026
- CVE-2026-4422537İzleyin
Pulpy: Incomplete filesystem sandbox in pulpy.fs bridge allows packaged web apps to read arbitrary user files
KritikCVSS 9,3Kavram kanıtıEPSS %1enesgkky · pulpy12 May 2026
- CVE-2026-4518539İzleyin
Exim before 4.99.3, in certain GnuTLS configurations, has a remotely reachable use-after-free in the BDAT body parsing path.
KritikCVSS 9,8Kavram kanıtıEPSS %0exim · exim12 May 2026
- CVE-2026-4401134İzleyin
Craft CMS: Potential authenticated Remote Code Execution via malicious attached Behavior
YüksekCVSS 8,6Kavram kanıtıEPSS %0craftcms · cms12 May 2026
- CVE-2026-4424628İzleyin
nnU-Net: Agentic workflow injection in `.github/workflows/issue-triage.yml` of `MIC-DKFZ/nnUNet`
YüksekCVSS 7,2Kavram kanıtıEPSS %0dkfz · nnu-net12 May 2026
- CVE-2026-4440335İzleyin
Wing FTP Server < 8.1.3 Authenticated Remote Code Execution via Session Serialization
YüksekCVSS 8,6Kavram kanıtıEPSS %2wftpserver · wing ftp server12 May 2026
- CVE-2026-4426238İzleyin
Scramble: Remote code execution via evaluation of user-controlled input in validation rules
KritikCVSS 9,4Kavram kanıtıEPSS %3dedoc · scramble12 May 2026
- CVE-2026-4190136İzleyin
Thymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressions
KritikCVSS 9,0Kavram kanıtıEPSS %0thymeleaf · thymeleaf12 May 2026
- CVE-2026-2101527İzleyin
Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allows local attacker to access unique identifier.
OrtaCVSS 6,8Kavram kanıtıEPSS %0samsung · android13 May 2026
- CVE-2026-2101620İzleyin
Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.
OrtaCVSS 5,1Kavram kanıtıEPSS %0samsung · android13 May 2026
- CVE-2026-2101827İzleyin
Out-of-bounds write in SveService prior to SMR May-2026 Release 1 allows local privileged attackers to execute arbitrary code.
OrtaCVSS 6,8Kavram kanıtıEPSS %0samsung · android13 May 2026
- CVE-2026-2101934İzleyin
Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code w
YüksekCVSS 8,6Kavram kanıtıEPSS %0samsung mobile · samsung mobile devices13 May 2026
- CVE-2026-2102020İzleyin
Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged func
OrtaCVSS 5,1Kavram kanıtıEPSS %0samsung · android13 May 2026
- CVE-2026-478226İzleyin
Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter
OrtaCVSS 6,5Kavram kanıtıEPSS %0themefusion · avada (fusion) builder13 May 2026
- CVE-2025-2933822İzleyin
NXP moal.ko Wi-Fi driver 5.1.7.10 FW version from v17.92.1.p149.43 To v17.92.1.p149.157 was discovered to contain a buffer overflow via the
OrtaCVSS 5,6Kavram kanıtıEPSS %013 May 2026
- CVE-2026-3115626İzleyin
A path injection vulnerability exists in OpenPLC v3 (2c82b0e79c53f8c1f1458eee15fec173400d6e1a) as the binary program compiled from glue_gene
OrtaCVSS 6,5Kavram kanıtıEPSS %0openplcproject · openplc v3 firmware13 May 2026
- CVE-2026-3417634İzleyin
Knowledge Appliance mode iControl REST vulnerability
YüksekCVSS 8,5İstismar yokEPSS %0f5 · big-ip access policy manager13 May 2026
- CVE-2026-4070125İzleyin
NGINX ngx_http_ssl_module vulnerability
OrtaCVSS 6,3Kavram kanıtıEPSS %0f5 · dos13 May 2026
- CVE-2026-4292625İzleyin
NGINX ngx_http_proxy_v2_module vulnerability
OrtaCVSS 6,3Kavram kanıtıEPSS %0f5 · nginx gateway fabric13 May 2026
- CVE-2026-4294537İzleyin
NGINX ngx_http_rewrite_module vulnerability
KritikCVSS 9,2Kavram kanıtıEPSS %3f5 · dos13 May 2026
- CVE-2026-4503334İzleyin
GitHub Copilot CLI: Nested Bare Repository Can Execute Arbitrary Commands via core.fsmonitor
YüksekCVSS 8,5Kavram kanıtıEPSS %0github · copilot-cli13 May 2026
- CVE-2026-4457530İzleyin
Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
YüksekCVSS 7,5İstismar yokEPSS %0vercel · next.js13 May 2026
- CVE-2026-026560Bu hafta
PAN-OS: Authentication Bypass with Cloud Authentication Service (CAS) enabled
YüksekCVSS 7,2SilahlaştırılmışEPSS %1paloaltonetworks · pan-os13 May 2026
- CVE-2026-4457835İzleyin
Next.js: Server-side request forgery in applications using WebSocket upgrades
YüksekCVSS 8,6Kavram kanıtıEPSS %1vercel · next.js13 May 2026
- CVE-2026-4457930İzleyin
Next.js: Denial of Service via connection exhaustion in applications using Cache Components
YüksekCVSS 7,5Kavram kanıtıEPSS %0vercel · next.js13 May 2026
- CVE-2026-4510930İzleyin
Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes
YüksekCVSS 7,5İstismar yokEPSS %0vercel · next.js13 May 2026
- CVE-2026-025790Hemen
PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %96paloaltonetworks · pan-os13 May 2026
- CVE-2026-4203134İzleyin
CKAN: Unauthenticated SQL Injection and Authorization Bypass in `datastore_search_sql`
YüksekCVSS 8,3Kavram kanıtıEPSS %2okfn · ckan13 May 2026
- CVE-2026-4203226İzleyin
CKAN: Unauthenticated Authorization Bypass in `datastore_search_sql`
OrtaCVSS 6,7İstismar yokEPSS %0okfn · ckan13 May 2026
- CVE-2026-4258230İzleyin
Netty: HTTP/3 QPACK literal unbounded allocation
YüksekCVSS 7,5İstismar yokEPSS %0netty · netty13 May 2026
- CVE-2026-4435136İzleyin
fast-jwt: Empty HMAC secret accepted via async key resolver - JWT auth bypass
KritikCVSS 9,1Kavram kanıtıEPSS %0nearform · fast-jwt13 May 2026
- CVE-2026-4437624İzleyin
CubeCart: Reflected XSS in Store Search Bar
OrtaCVSS 6,1Kavram kanıtıEPSS %0cubecart · v613 May 2026
- CVE-2026-4438137İzleyin
MISP: SQL injection via unvalidated ordering parameters in event and shadow attribute listings
KritikCVSS 9,3Kavram kanıtıEPSS %0misp-project · misp13 May 2026
- CVE-2026-832823İzleyin
FTP PASV SSRF, ftpcp() does not use actual peer address, trusts server-supplied PASV host address
OrtaCVSS 5,9İstismar yokEPSS %0python software foundation · cpython13 May 2026
- CVE-2026-818140Planlayın
Burst Statistics 3.4.0 - 3.4.1.1 - Authentication Bypass to Admin Account Takeover
KritikCVSS 9,8Kavram kanıtıEPSS %3burstbv · burst statistics – privacy-friendly wordpress analytics (google analytics alternative)14 May 2026
- CVE-2026-627139İzleyin
Career Section <= 1.7 - Unauthenticated Arbitrary File Upload
KritikCVSS 9,8Kavram kanıtıEPSS %1shahinurislam · career section14 May 2026
- CVE-2026-614521İzleyin
User Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter
OrtaCVSS 5,3Kavram kanıtıEPSS %0wpeverest · user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builder14 May 2026
- CVE-2026-647535İzleyin
PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice
YüksekCVSS 8,8Kavram kanıtıEPSS %0postgresql · postgresql14 May 2026
- CVE-2026-647735İzleyin
PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory
YüksekCVSS 8,8İstismar yokEPSS %0postgresql · postgresql14 May 2026
- CVE-2026-4255935İzleyin
RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport
YüksekCVSS 8,8Kavram kanıtıEPSS %0modelcontextprotocol · rust-sdk14 May 2026
- CVE-2026-4228137İzleyin
MagicMirror²: Unauthenticated SSRF via /cors endpoint
KritikCVSS 9,2Kavram kanıtıEPSS %1magicmirror · magicmirror14 May 2026
- CVE-2026-4258940Planlayın
Gotenberg: Unauthenticated RCE via ExifTool Metadata Key Injection
KritikCVSS 9,8Kavram kanıtıEPSS %3thecodingmachine · gotenberg14 May 2026
- CVE-2026-4259638İzleyin
Gotenberg: Unauthenticated SSRF via default deny-list bypass in downloadFrom and webhook
KritikCVSS 9,4Kavram kanıtıEPSS %1thecodingmachine · gotenberg14 May 2026
- CVE-2026-2018298Hemen
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
KritikCVSS 10,0KEVSilahlaştırılmışEPSS %91cisco · catalyst sd-wan manager14 May 2026
- CVE-2026-2022434İzleyin
Cisco Catalyst SD-WAN Manager XML External Entity Injection Vulnerability
YüksekCVSS 8,6Kavram kanıtıEPSS %1cisco · catalyst sd-wan manager14 May 2026
- CVE-2026-4289760Bu hafta
Microsoft Exchange Server Spoofing Vulnerability
OrtaCVSS 6,1KEVSilahlaştırılmışEPSS %0microsoft · exchange server14 May 2026
- CVE-2026-2259937İzleyin
Strapi Vulnerable to SQL Injection in Content Type Builder
KritikCVSS 9,3Kavram kanıtıEPSS %1strapi · strapi14 May 2026
- CVE-2026-227068İzleyin
Strapi: Password Reset Does Not Revoke Existing Refresh Sessions
DüşükCVSS 2,1Kavram kanıtıEPSS %0strapi · strapi14 May 2026
- CVE-2026-2788637İzleyin
Strapi may leak sensitive data via relational filtering due to lack of query sanitization
KritikCVSS 9,2Kavram kanıtıEPSS %2strapi · strapi14 May 2026
- CVE-2025-6452627İzleyin
Strapi has a rate limit bypass on users-permissions plugin via attacker-controlled email keying
OrtaCVSS 6,9İstismar yokEPSS %0strapi · strapi14 May 2026
- CVE-2026-265234İzleyin
Authentication Bypass in mlflow/mlflow
YüksekCVSS 8,6Kavram kanıtıEPSS %1lfprojects · mlflow14 May 2026
- CVE-2026-522939İzleyin
Receive Notifications After Form Submitting – Form Notify for Any Forms <= 1.1.10 - Unauthenticated Authentication Bypass via LINE OAuth Callback
KritikCVSS 9,8Kavram kanıtıEPSS %1m615926 · receive notifications after form submitting – form notify for any forms15 May 2026
- CVE-2026-839867Bu hafta
A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12.5.0.2421 through 12.5.0.2434)
KritikCVSS 9,3KEVSilahlaştırılmışEPSS %0disc-soft · daemon tools15 May 2026
- CVE-2026-3519432İzleyin
Apache Flink: Remote code execution via SQL injection in code generation
YüksekCVSS 8,1Kavram kanıtıEPSS %0apache · flink15 May 2026
- CVE-2026-4633340Planlayın
ptrace: slightly saner 'get_dumpable()' logic
YüksekCVSS 7,1SilahlaştırılmışEPSS %0linux · linux kernel15 May 2026
- CVE-2026-4636438İzleyin
phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha
KritikCVSS 9,3Kavram kanıtıEPSS %2thorsten · phpmyfaq15 May 2026
- CVE-2026-4455136İzleyin
Open WebUI: LDAP Empty Password Authentication Bypass
KritikCVSS 9,1Kavram kanıtıEPSS %1openwebui · open webui15 May 2026
- CVE-2026-4539721İzleyin
Open WebUI: Unauthenticated RAG Configuration Disclosure
OrtaCVSS 5,3Kavram kanıtıEPSS %0openwebui · open webui15 May 2026
- CVE-2026-4540134İzleyin
Open WebUI: SSRF Bypass via HTTP Redirect Following in Web-Fetch and Image-Load Endpoints
YüksekCVSS 8,5Kavram kanıtıEPSS %0openwebui · open webui15 May 2026
- CVE-2026-4531614İzleyin
Open WebUI: Read-Only Users Can Toggle Note Pin Status via Incorrect Permission Check (Write via Read-Only Access)
DüşükCVSS 3,5Kavram kanıtıEPSS %0openwebui · open webui15 May 2026
- CVE-2026-637934İzleyin
WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection via 'wppa-supersearch' Parameter
YüksekCVSS 8,6Kavram kanıtıEPSS %0unknown · wp photo album plus18 May 2026
- CVE-2026-2068526İzleyin
An attacker in a privileged network position may be able to leak sensitive information.
OrtaCVSS 6,5Kavram kanıtıEPSS %0apple · private cloud compute18 May 2026