İçeriğe atla
Noroxi

Yayın tarihine göre

Mayıs 2026: sömürülen ve yeni ciddi CVE kayıtları

351 kayıt · 22 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 4 / 4

  • CVE-2026-38426
    29İzleyin

    Buffer Overflow vulnerability in arendst Tasmota v.15.3.0.3 and before allows a remote attacker to execute arbitrary code via the xdrv_10_sc

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    27 May 2026

  • CVE-2026-38427
    29İzleyin

    An issue in fetch_jpg() in xdrv_10_scripter.ino in Tasmota through 15.3.0.3 allows a remote attacker to cause heap buffer overflow.

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    27 May 2026

  • CVE-2026-30498
    25İzleyin

    A Cross-Site Request Forgery (CSRF) vulnerability was discovered in the delete.php endpoint of Jason2605 AdminPanel 4.0.

    OrtaCVSS 6,3Kavram kanıtıEPSS %0

    27 May 2026

  • CVE-2026-31266
    29İzleyin

    Craft CMS 5.9.5 and earlier contains a Missing Authorization vulnerability in the migrate endpoint (/actions/app/migrate).

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    27 May 2026

  • CVE-2026-49053
    21İzleyin

    WordPress ElementsKit Elementor addons Lite plugin <= 3.9.6 - Broken Access Control vulnerability

    OrtaCVSS 5,3İstismar yokEPSS %0

    wpmet · elementskit elementor addons lite27 May 2026

  • CVE-2026-38945
    31İzleyin

    Command injection in Raynet rvia version 12.6 Update 8 and previous versions allows adversaries to execute arbitrary code via a crafted path

    YüksekCVSS 7,8Kavram kanıtıEPSS %1

    27 May 2026

  • CVE-2025-69600
    31İzleyin

    Command injection in Raynet rvia RayVentory Scan Engine 12.6 Update 8 and previous versions allows adversaries to execute commands via getco

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    27 May 2026

  • CVE-2026-45061
    30İzleyin

    Budibase: SSRF via trivial `.tar.gz` substring bypass in Plugin URL upload (`/api/plugin`)

    YüksekCVSS 7,7İstismar yokEPSS %0

    budibase · budibase27 May 2026

  • CVE-2026-45087
    40Planlayın

    Dalfox: Unauthenticated Remote Code Execution via `found-action` in Dalfox Server Mode

    KritikCVSS 10,0SilahlaştırılmışEPSS %1

    hahwul · dalfox27 May 2026

  • CVE-2026-4390
    21İzleyin

    TeamSpeak 3 Server Connection State Management process_resend_queue use after free

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    27 May 2026

  • CVE-2026-42878
    21İzleyin

    FacturaScripts: Unauthenticated phpinfo() Disclosure via Installer Endpoint in FacturaScripts

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    neorazorx · facturascripts27 May 2026

  • CVE-2026-42879
    25İzleyin

    FacturaScripts: Authenticated Remote Code Execution (RCE) via GIF Image Upload in Product Images

    OrtaCVSS 6,3Kavram kanıtıEPSS %0

    neorazorx · facturascripts27 May 2026

  • CVE-2026-44590
    37İzleyin

    Sherlock: Command Injection via pull_request_target in validate_modified_targets.yml

    KritikCVSS 9,3Kavram kanıtıEPSS %1

    sherlock-project · sherlock27 May 2026

  • CVE-2026-49009
    12İzleyin

    Northern.tech Mender Server v4.1.0, v4.0.1 and below, and fixed in v4.1.1 and v4.0.2 allows Directory Traversal.

    DüşükCVSS 3,1Kavram kanıtıEPSS %0

    27 May 2026

  • CVE-2026-44315
    37İzleyin

    free5GC: NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions

    KritikCVSS 9,4İstismar yokEPSS %0

    free5gc · free5gc27 May 2026

  • CVE-2026-48027
    67Bu hafta

    Compromised Nx Console version 18.95.0

    KritikCVSS 9,3KEVSilahlaştırılmışEPSS %1

    nx · nx console27 May 2026

  • CVE-2026-9789
    34İzleyin

    NitroSense V3: Security Vulnerability Information

    YüksekCVSS 8,5Kavram kanıtıEPSS %0

    acer · nitrorsense v327 May 2026

  • CVE-2026-32996
    29İzleyin

    This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    veeam · backup and replication28 May 2026

  • CVE-2026-9794
    21İzleyin

    Keycloak: keycloak: information disclosure via saml ecp endpoint

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    redhat · build of keycloak28 May 2026

  • CVE-2026-9806
    25İzleyin

    Stored Cross-Site Scripting (XSS) in CTI Transmute Notification Panel via Malicious Convert Names

    OrtaCVSS 6,3Kavram kanıtıEPSS %0

    misp · cti-transmute28 May 2026

  • CVE-2026-46215
    31İzleyin

    drm: Set old handle to NULL before prime swap in change_handle

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    linux · linux kernel28 May 2026

  • CVE-2026-4408
    40Planlayın

    Samba: remote code execution in samr

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    samba · samba28 May 2026

  • CVE-2026-8697
    34İzleyin

    Improper Authentication Rate Limiting on TP-Link's Archer C64

    YüksekCVSS 8,7Kavram kanıtıEPSS %0

    tp-link · archer c64 firmware28 May 2026

  • CVE-2026-9090
    36İzleyin

    Casdoor versions 2.362.0 and earlier contain a vulnerability that allows an attacker to bypass authentication by supplying an arbitrary sign

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    casdoor · casdoor28 May 2026

  • CVE-2026-45332
    30İzleyin

    Automad Broken Access Control: unauthenticated exposure of administrator bcrypt password hashes and TOTP secrets via public API endpoint

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    marcantondahmen · automad28 May 2026

  • CVE-2026-47761
    21İzleyin

    TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` injection

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    tiny · tinymce28 May 2026

  • CVE-2026-46817
    69Bu hafta

    Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %0

    oracle · e-business suite28 May 2026

  • CVE-2026-9645
    39İzleyin

    ScadaBR Authenticated Remote Code Execution

    KritikCVSS 9,9Kavram kanıtıEPSS %0

    scadabr · scadabr28 May 2026

  • CVE-2026-44848
    37İzleyin

    Portainer: Missing authorization on Docker plugin endpoints allows host RCE

    KritikCVSS 9,4Kavram kanıtıEPSS %0

    portainer · portainer28 May 2026

  • CVE-2026-44881
    34İzleyin

    Portainer: Arbitrary File Read via Git Symlink Injection in Stack Auto-Update

    YüksekCVSS 8,5Kavram kanıtıEPSS %0

    portainer · portainer28 May 2026

  • CVE-2026-44883
    30İzleyin

    Portainer: JWT accepted in URL query leaks tokens to logs and referers

    YüksekCVSS 7,7İstismar yokEPSS %0

    portainer · portainer28 May 2026

  • CVE-2026-8809
    39İzleyin

    Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    hwk-fr · advanced custom fields: extended28 May 2026

  • CVE-2026-9973
    35İzleyin

    Out of bounds write in V8 in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    google · chrome28 May 2026

  • CVE-2026-9997
    33İzleyin

    Use after free in Input in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to poten

    YüksekCVSS 8,3Kavram kanıtıEPSS %0

    google · chrome28 May 2026

  • CVE-2026-9998
    33İzleyin

    Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to pote

    YüksekCVSS 8,3Kavram kanıtıEPSS %0

    google · chrome28 May 2026

  • CVE-2026-9999
    35İzleyin

    Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code in

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    google · chrome28 May 2026

  • CVE-2026-8732
    40Planlayın

    WP Maps Pro <= 6.1.0 - Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX Action

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    flippercode · wp maps pro29 May 2026

  • CVE-2025-11262
    28İzleyin

    Link Whisper Free <= 0.9.0 - Unauthenticated Stored Cross-Site Scripting

    YüksekCVSS 7,2Kavram kanıtıEPSS %0

    linkwhspr · link whisper free29 May 2026

  • CVE-2026-9558
    39İzleyin

    A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine.

    KritikCVSS 9,9Kavram kanıtıEPSS %0

    29 May 2026

  • CVE-2026-9809
    30İzleyin

    A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7.

    YüksekCVSS 7,6Kavram kanıtıEPSS %0

    29 May 2026

  • CVE-2026-9811
    21İzleyin

    A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7.

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    29 May 2026

  • CVE-2026-46376
    37İzleyin

    FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface

    KritikCVSS 9,3Kavram kanıtıEPSS %0

    sangoma · freepbx29 May 2026

  • CVE-2026-39292
    29İzleyin

    Falco Solutions PHPPageBuilder v0.31.0 contains an unrestricted file upload vulnerability in the pagemanager/pagebuilder module that allows

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    29 May 2026

  • CVE-2026-44648
    30İzleyin

    SillyTavern: Existing sessions are not invalidated after password change, allowing session reuse and account takeover

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    sillytavern · sillytavern29 May 2026

  • CVE-2026-46372
    34İzleyin

    SillyTavern: SSRF in SearXNG Search Proxy via Unvalidated baseUrl

    YüksekCVSS 8,5Kavram kanıtıEPSS %1

    sillytavern · sillytavern29 May 2026

  • CVE-2026-10110
    22İzleyin

    code-projects Student Details Management System index.php sql injection

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    code-projects · student details management system30 May 2026

  • CVE-2026-7459
    30İzleyin

    Simple History – Track, Log, and Audit WordPress Changes <= 5.26.0 - Authenticated (Subscriber+) Account Takeover via Missing Authorization on Event Reaction En

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    eskapism · simple history – track, log, and audit wordpress changes30 May 2026

  • CVE-2026-7465
    35İzleyin

    Spectra Gutenberg Blocks <= 2.19.25 - Authenticated (Contributor+) Remote Code Execution via Arbitrary PHP Function Call via Block Attributes

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    brainstormforce · spectra gutenberg blocks – website builder for the block editor30 May 2026

  • CVE-2026-46242
    32İzleyin

    eventpoll: fix ep_remove struct eventpoll / struct file UAF

    YüksekCVSS 7,8Kavram kanıtıEPSS %4

    linux · linux kernel30 May 2026

  • CVE-2026-10170
    8İzleyin

    code-projects Visitor Management System phone_0.php sql injection

    DüşükCVSS 2,1Kavram kanıtıEPSS %0

    code-projects · visitor management system31 May 2026

  • CVE-2026-10187
    37İzleyin

    Totolink N300RH Web Management wireless.so setWiFiBasicConfig stack-based overflow

    YüksekCVSS 8,9Kavram kanıtıEPSS %7

    totolink · n300rh31 May 2026