İçeriğe atla
Noroxi

Yayın tarihine göre

Mayıs 2026: sömürülen ve yeni ciddi CVE kayıtları

355 kayıt · 22 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 3 / 4

  • CVE-2026-6379
    34İzleyin

    WP Photo Album Plus < 9.1.11.001 - Unauthenticated SQL Injection via 'wppa-supersearch' Parameter

    YüksekCVSS 8,6Kavram kanıtıEPSS %0

    unknown · wp photo album plus18 May 2026

  • CVE-2026-6495
    28İzleyin

    Ajax Load More < 7.8.4 - Reflected XSS

    YüksekCVSS 7,1Kavram kanıtıEPSS %0

    unknown · ajax load more18 May 2026

  • CVE-2026-20685
    26İzleyin

    An attacker in a privileged network position may be able to leak sensitive information.

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    apple · private cloud compute18 May 2026

  • CVE-2026-45829
    40Planlayın

    A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an unauthenticated attack

    KritikCVSS 10,0Kavram kanıtıEPSS %1

    chroma · chromadb18 May 2026

  • CVE-2026-41948
    38İzleyin

    Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access

    KritikCVSS 9,3Kavram kanıtıEPSS %1

    dify · dify18 May 2026

  • CVE-2026-8836
    35İzleyin

    lwIP snmpv3 USM snmp_msg.c snmp_parse_inbound_frame stack-based overflow

    YüksekCVSS 8,9Kavram kanıtıEPSS %1

    18 May 2026

  • CVE-2026-36438
    21İzleyin

    An issue in Intelbras VIP-1230-D-G4 Version V2.800.00IB00C.0.T allows a remote attacker to obtain sensitive information via password reset f

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    18 May 2026

  • CVE-2026-8838
    37İzleyin

    Remote Code Execution via eval() Injection in amazon-redshift-python-driver

    KritikCVSS 9,3Kavram kanıtıEPSS %0

    aws · amazon redshift connector for python18 May 2026

  • CVE-2026-29962
    31İzleyin

    HSC MailInspector v5.3.3-7 contains a Local File Inclusion (LFI) vulnerability caused by improper control of user-supplied file paths.

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    hsclabs · mailinspector18 May 2026

  • CVE-2026-29963
    31İzleyin

    HSC MailInspector 5.3.3-7 has a Path Traversal vulnerability due to improper validation of user-supplied input in the /tap/dw.php endpoint.

    YüksekCVSS 7,5Kavram kanıtıEPSS %3

    hsclabs · mailinspector18 May 2026

  • CVE-2026-30950
    28İzleyin

    AutoGPT has Authenticated Session Hijacking via IDOR

    YüksekCVSS 7,1Kavram kanıtıEPSS %0

    significant-gravitas · autogpt18 May 2026

  • CVE-2026-33234
    20İzleyin

    AutoGPT: SendEmailBlock's IP blocklist bypass allows SSRF via user-controlled SMTP server

    OrtaCVSS 5,0Kavram kanıtıEPSS %0

    significant-gravitas · autogpt18 May 2026

  • CVE-2026-4885
    39İzleyin

    Piotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    piotnet · piotnet addons for elementor pro19 May 2026

  • CVE-2026-46725
    37İzleyin

    Remote Code Execution in extension "Content Element Selector" (ceselector)

    KritikCVSS 9,2Kavram kanıtıEPSS %1

    typo3 · extension "content element selector"19 May 2026

  • CVE-2026-8726
    32İzleyin

    SQL Injection in extension "News system" (news)

    YüksekCVSS 8,2Kavram kanıtıEPSS %0

    typo3 · extension "news system"19 May 2026

  • CVE-2026-4883
    39İzleyin

    Piotnet Forms <= 2.1.40 - Unauthenticated Arbitrary File Upload via Form File Upload

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    piotnet · piotnet forms19 May 2026

  • CVE-2026-42096
    34İzleyin

    Broken Access Control in Sparx Pro Cloud Server

    YüksekCVSS 8,7Kavram kanıtıEPSS %0

    sparxsystems · pro cloud server19 May 2026

  • CVE-2026-47323
    39İzleyin

    Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    apache · camel19 May 2026

  • CVE-2026-2586
    36İzleyin

    An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console.

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    eclipse · glassfish19 May 2026

  • CVE-2026-2587
    38İzleyin

    A critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish ga

    KritikCVSS 9,6Kavram kanıtıEPSS %0

    eclipse · glassfish19 May 2026

  • CVE-2026-47100
    34İzleyin

    Funnel Builder for WooCommerce Checkout < 3.15.0.3 Missing Authorization via AJAX

    YüksekCVSS 8,7Kavram kanıtıEPSS %0

    funnelkit · funnel builder for woocommerce checkout19 May 2026

  • CVE-2026-6009
    34İzleyin

    Jaspersoft Library Deserialisation Vulnerability

    YüksekCVSS 8,7Kavram kanıtıEPSS %0

    jaspersoft · jasperreports library community edition19 May 2026

  • CVE-2026-32740
    35İzleyin

    libheif: Heap-Buffer-Overflow Write in Grid Tile Chroma Compositing

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    struktur · libheif19 May 2026

  • CVE-2026-34234
    41Planlayın

    CtrlPanel: Unauthenticated RCE using installer script

    KritikCVSS 10,0Kavram kanıtıEPSS %4

    ctrlpanel-gg · panel19 May 2026

  • CVE-2026-45585
    27İzleyin

    Windows BitLocker Security Feature Bypass Vulnerability

    OrtaCVSS 6,8Kavram kanıtıEPSS %0

    microsoft · windows 11 24h219 May 2026

  • CVE-2026-7467
    35İzleyin

    Read More & Accordion <= 3.5.7 - Privilege Escalation via importData

    YüksekCVSS 8,8Kavram kanıtıEPSS %1

    edmonparker · read more & accordion19 May 2026

  • CVE-2026-24207
    40Planlayın

    NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass.

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    nvidia · triton inference server20 May 2026

  • CVE-2026-41091
    61Bu hafta

    Microsoft Defender Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %0

    microsoft · malware protection engine20 May 2026

  • CVE-2026-45498
    60Bu hafta

    Microsoft Defender Denial of Service Vulnerability

    YüksekCVSS 7,5KEVSilahlaştırılmışEPSS %1

    microsoft · defender antimalware platform20 May 2026

  • CVE-2026-45584
    32İzleyin

    Microsoft Defender Remote Code Execution Vulnerability

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    microsoft · malware protection engine20 May 2026

  • CVE-2026-5950
    21İzleyin

    Unbounded resend loop in BIND 9 resolver

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    isc · bind20 May 2026

  • CVE-2026-8467
    39İzleyin

    Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground

    KritikCVSS 9,5Kavram kanıtıEPSS %2

    phenixdigital · phoenix_storybook20 May 2026

  • CVE-2026-39047
    30İzleyin

    Buffer Overflow vulnerability in EPSON L14150 FL27PB allows a remote attacker to execute arbitrary code via the RAW Printing Service (JetDir

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    20 May 2026

  • CVE-2026-20223
    40Planlayın

    Cisco Secure Workload Unauthorized API Access Vulnerability

    KritikCVSS 10,0Kavram kanıtıEPSS %0

    cisco · secure workload20 May 2026

  • CVE-2026-30691
    24İzleyin

    Cross-Site Scripting (XSS) vulnerability in @cyntler/react-doc-viewer v1.17.1 allows remote attackers to execute arbitrary JavaScript via a

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    20 May 2026

  • CVE-2026-23734
    43Planlayın

    XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash

    KritikCVSS 9,3İstismar yokEPSS %18

    xwiki · xwiki-commons20 May 2026

  • CVE-2026-33137
    37İzleyin

    XWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}

    KritikCVSS 9,3Kavram kanıtıEPSS %0

    xwiki · xwiki-platform20 May 2026

  • CVE-2026-39352
    34İzleyin

    Frappe has an Arbitrary File Read via Path Traversal in render_include

    YüksekCVSS 8,7Kavram kanıtıEPSS %1

    frappe · frappe20 May 2026

  • CVE-2026-9133
    33İzleyin

    Arbitrary file read in rabbitmq-aws plugin

    YüksekCVSS 8,3Kavram kanıtıEPSS %1

    aws · rabbitmq aws20 May 2026

  • CVE-2026-9082
    74Bu hafta

    Drupal core - Highly critical - SQL injection - SA-CORE-2026-004

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %15

    drupal · drupal20 May 2026

  • CVE-2026-6279
    41Planlayın

    Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Hand

    KritikCVSS 9,8Kavram kanıtıEPSS %7

    themefusion · avada (fusion) builder21 May 2026

  • CVE-2026-48172
    70Bu hafta

    LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in the wild in May 2026.

    KritikCVSS 10,0KEVSilahlaştırılmışEPSS %1

    litespeedtech · litespeed cpanel plugin21 May 2026

  • CVE-2026-45250
    31İzleyin

    Stack buffer overflow via setcred(2)

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    freebsd · freebsd21 May 2026

  • CVE-2026-5118
    39İzleyin

    Divi Form Builder <= 5.1.2 - Unauthenticated Privilege Escalation via 'role'

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    divi engine · divi form builder21 May 2026

  • CVE-2026-34926
    56Planlayın

    A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table

    OrtaCVSS 6,7KEVSilahlaştırılmışEPSS %0

    trendmicro · apex one21 May 2026

  • CVE-2026-43494
    31İzleyin

    net/rds: reset op_nents when zerocopy page pin fails

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    linux · linux kernel21 May 2026

  • CVE-2026-43499
    31İzleyin

    rtmutex: Use waiter::task instead of current in remove_waiter()

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    linux · linux kernel21 May 2026

  • CVE-2026-43501
    39İzleyin

    ipv6: rpl: reserve mac_len headroom when recompressed SRH grows

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    linux · linux kernel21 May 2026

  • CVE-2026-6826
    60Bu hafta

    Concrete 9.5.0 and below has file usage disclosure via missing permission check in Usage controller

    OrtaCVSS 6,9SilahlaştırılmışEPSS %1

    concretecms · concrete cms21 May 2026

  • CVE-2026-8135
    35İzleyin

    Concrete CMS 9.5.0 and below is vulnerable to RCE due to insecure deserialization occurring in the ExpressEntryList block controller.

    YüksekCVSS 8,9İstismar yokEPSS %0

    concretecms · concrete cms21 May 2026

  • CVE-2026-6960
    39İzleyin

    BookingPress Pro <= 5.6 - Unauthenticated Arbitrary File Upload via Signature Custom Field

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    repute infosystems · bookingpress appointment booking pro21 May 2026

  • CVE-2026-8236
    25İzleyin

    Concrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate for endpoint /ccm/system/dialogs/file/usage/{fID}

    OrtaCVSS 6,3Kavram kanıtıEPSS %0

    concretecms · concrete cms21 May 2026

  • CVE-2026-8237
    25İzleyin

    Concrete CMS 9.5.0 and below is vulnerable to IDOR in the`/ccm/frontend/conversations/message_detail` endpoint

    OrtaCVSS 6,3Kavram kanıtıEPSS %0

    concretecms · concrete cms21 May 2026

  • CVE-2026-8239
    25İzleyin

    Concrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/get_rating'

    OrtaCVSS 6,3Kavram kanıtıEPSS %0

    concretecms · concrete cms21 May 2026

  • CVE-2026-8337
    25İzleyin

    Concrete CMS 9.5.0 and below is vulnerable to IDOR in surveys when sites are running concurrent public surveys and private surveys

    OrtaCVSS 6,3Kavram kanıtıEPSS %0

    concretecms · concrete cms21 May 2026

  • CVE-2026-47101
    34İzleyin

    LiteLLM < 1.83.14 Privilege Escalation via API Key Generation

    YüksekCVSS 8,7Kavram kanıtıEPSS %1

    litellm · litellm21 May 2026

  • CVE-2026-47102
    34İzleyin

    LiteLLM < 1.83.10 Privilege Escalation via User Update

    YüksekCVSS 8,7Kavram kanıtıEPSS %0

    litellm · litellm21 May 2026

  • CVE-2026-34908
    75Bu hafta

    A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauth

    KritikCVSS 10,0KEVSilahlaştırılmışEPSS %15

    ui · unifi os server21 May 2026

  • CVE-2026-34909
    71Bu hafta

    A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the u

    KritikCVSS 10,0KEVSilahlaştırılmışEPSS %1

    ui · unifi os server21 May 2026

  • CVE-2026-34910
    84Hemen

    A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a

    KritikCVSS 10,0KEVSilahlaştırılmışEPSS %45

    ui · unifi os server21 May 2026

  • CVE-2026-46595
    40Planlayın

    Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh

    KritikCVSS 10,0Kavram kanıtıEPSS %0

    golang · crypto22 May 2026

  • CVE-2026-9018
    35İzleyin

    Easy Elements for Elementor – Addons & Website Templates <= 1.4.5 - Unauthenticated Privilege Escalation via 'custom_meta' Parameter

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    themewant · easy elements for elementor – addons & website templates22 May 2026

  • CVE-2026-7798
    21İzleyin

    FluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    techjewel · fluentcrm – email newsletter, automation, email marketing, email campaigns, optins, leads, and crm solution22 May 2026

  • CVE-2026-8679
    31İzleyin

    AudioIgniter Music Player <= 2.0.2 - Unauthenticated Insecure Direct Object Reference to 'audioigniter_playlist_id' Parameter

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    cssigniterteam · audioigniter music player22 May 2026

  • CVE-2026-9277
    36İzleyin

    shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

    KritikCVSS 9,2Kavram kanıtıEPSS %0

    22 May 2026

  • CVE-2026-8347
    9İzleyin

    Concrete CMS 9.5.0 and below is vulnerable to IDOR + wrong-authorization-level in Express association Reorder dialog

    DüşükCVSS 2,3Kavram kanıtıEPSS %0

    concretecms · concrete cms22 May 2026

  • CVE-2026-9256
    37İzleyin

    NGINX ngx_http_rewrite_module vulnerability

    KritikCVSS 9,2Kavram kanıtıEPSS %2

    f5 · nginx open source22 May 2026

  • CVE-2026-39821
    38İzleyin

    Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna

    KritikCVSS 9,6İstismar yokEPSS %0

    golang · net22 May 2026

  • CVE-2026-33712
    40Planlayın

    TypeBot: Unauthenticated SSRF via isolated-vm fetch in preview chat endpoint bypasses SSRF controls

    KritikCVSS 10,0Kavram kanıtıEPSS %0

    baptistearno · typebot.io22 May 2026

  • CVE-2026-34207
    30İzleyin

    TypeBot: SSRF Protection Bypass via DNS-Resolved Hostnames in Webhook / HTTP Request Validation

    YüksekCVSS 7,6Kavram kanıtıEPSS %0

    baptistearno · typebot.io22 May 2026

  • CVE-2026-36226
    24İzleyin

    Cross Site Scripting vulnerability in Advantech WebAccess/SCADA 8.0-2015.08.16 allows a remote attacker to obtain sensitive information via

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    22 May 2026

  • CVE-2026-36227
    26İzleyin

    Directory Traversal vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and execute arbitrary cod

    OrtaCVSS 6,5Kavram kanıtıEPSS %1

    22 May 2026

  • CVE-2026-36228
    29İzleyin

    Buffer Overflow vulnerability in Easy Chat Server 3.1 allows a remote attacker to obtain sensitive information and execute arbitrary code vi

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    22 May 2026

  • CVE-2026-5817
    35İzleyin

    Docker Model Runner container-to-host code execution via unsandboxed trust_remote_code in Python inference backends

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    docker · docker desktop22 May 2026

  • CVE-2026-5843
    35İzleyin

    Docker Model Runner container-to-host code execution via MLX-LM model_file importlib loading

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    docker · docker desktop22 May 2026

  • CVE-2026-40864
    17İzleyin

    JupyterHub: Cross-origin form POSTs bypass XSRF

    OrtaCVSS 4,3Kavram kanıtıEPSS %0

    jupyter · jupyterhub22 May 2026

  • CVE-2026-45659
    66Bu hafta

    Microsoft SharePoint Remote Code Execution Vulnerability

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %2

    microsoft · sharepoint server22 May 2026

  • CVE-2026-43503
    40Planlayın

    net: skbuff: propagate shared-frag marker through frag-transfer helpers

    YüksekCVSS 8,8SilahlaştırılmışEPSS %1

    linux · linux kernel23 May 2026

  • CVE-2026-46300
    40Planlayın

    net: skbuff: preserve shared-frag marker during coalescing

    YüksekCVSS 7,8SilahlaştırılmışEPSS %2

    linux · linux kernel23 May 2026

  • CVE-2026-9370
    11İzleyin

    ulisesbocchio jasypt-spring-boot Password Hash SimpleGCMConfig.java getSecretKeySaltGenerator hash predictable salt

    DüşükCVSS 2,9İstismar yokEPSS %0

    ulisesbocchio · jasypt-spring-boot24 May 2026

  • CVE-2026-9490
    27İzleyin

    Acer Care Center creates a Named Pipe with a weak Security Descriptor

    OrtaCVSS 6,8Kavram kanıtıEPSS %0

    acer · care center25 May 2026

  • CVE-2026-48842
    32İzleyin

    Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_re

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    roundcube · webmail25 May 2026

  • CVE-2026-48849
    17İzleyin

    In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stor

    OrtaCVSS 4,4Kavram kanıtıEPSS %0

    roundcube · webmail25 May 2026

  • CVE-2026-45247
    68Bu hafta

    Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection

    KritikCVSS 9,3KEVSilahlaştırılmışEPSS %2

    mirasvit · full page cache warmer26 May 2026

  • CVE-2026-46368
    36İzleyin

    luci-app-https-dns-proxy Authenticated Command Injection via setInitAction

    YüksekCVSS 8,7Kavram kanıtıEPSS %7

    mossdef-org · luci-app-https-dns-proxy26 May 2026

  • CVE-2026-4480
    40Planlayın

    Samba: samba: remote code execution in printing subsystem via unescaped job description

    KritikCVSS 9,0Kavram kanıtıEPSS %13

    samba · samba26 May 2026

  • CVE-2026-40564
    26İzleyin

    Apache Flink Kubernetes Operator: Server-Side Request Forgery and local file access in Kubernetes Operator

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    apache · flink kubernetes operator26 May 2026

  • CVE-2026-30894
    27İzleyin

    Joomla! Core - [20260503] - XSS in com_contenthistory

    OrtaCVSS 6,9İstismar yokEPSS %0

    joomla · joomla\!26 May 2026

  • CVE-2026-44680
    30İzleyin

    MikroORM: SQL injection via runtime-controlled identifiers and JSON-path keys

    YüksekCVSS 7,6Kavram kanıtıEPSS %1

    mikro-orm · mikro-orm26 May 2026

  • CVE-2026-44706
    34İzleyin

    Chatwoot: SQL Injection in Conversation/Contact Filter API via Custom Attribute Values

    YüksekCVSS 8,5Kavram kanıtıEPSS %0

    chatwoot · chatwoot26 May 2026

  • CVE-2026-44707
    27İzleyin

    Chatwoot: Pre-Account Takeover via OAuth on Unconfirmed Accounts

    OrtaCVSS 6,8İstismar yokEPSS %0

    chatwoot · chatwoot26 May 2026

  • CVE-2026-9560
    37İzleyin

    Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands w

    KritikCVSS 9,4Kavram kanıtıEPSS %0

    openvpn · connect26 May 2026

  • CVE-2026-36239
    17İzleyin

    PbootCMS v.3.2.11 contains a code injection vulnerability in its site configuration functionality

    OrtaCVSS 4,3Kavram kanıtıEPSS %0

    26 May 2026

  • CVE-2026-44788
    26İzleyin

    SharpCompress: Directory traversal via directory entries in WriteToDirectory (zip slip variant)

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    adamhathcock · sharpcompress26 May 2026

  • CVE-2026-45298
    34İzleyin

    Dozzle: Pre-auth SSRF with response-body reflection via POST /api/notifications/test-webhook (default no-auth deploy)

    YüksekCVSS 8,6Kavram kanıtıEPSS %1

    amirraminfar · dozzle26 May 2026

  • CVE-2026-48710
    60Bu hafta

    Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

    OrtaCVSS 6,5KEVSilahlaştırılmışEPSS %7

    encode · starlette26 May 2026

  • CVE-2026-48962
    29İzleyin

    IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    pmqs · io::compress27 May 2026

  • CVE-2026-3001
    24İzleyin

    Gutenverse <= 3.4.6 - Reflected Cross-Site Scripting via 's' Parameter

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    jegstudio · gutenverse – wordpress blocks, page builder & site editor27 May 2026

  • CVE-2026-8832
    35İzleyin

    WPCode <= 2.3.5 - Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPost

    YüksekCVSS 8,8Kavram kanıtıEPSS %1

    smub · wpcode – insert headers and footers + custom code snippets – wordpress code manager27 May 2026

  • CVE-2026-8054
    40Planlayın

    Unauthenticated SQL Injection in dotCMS Publish Audit API

    KritikCVSS 10,0Kavram kanıtıEPSS %1

    dotcms · dotcms core27 May 2026