İçeriğe atla
Noroxi

Yayın tarihine göre

Temmuz 2026: sömürülen ve yeni ciddi CVE kayıtları

1.301 kayıt · 21 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 1 / 14

  • CVE-2026-14191
    31İzleyin

    WinRAR / UnRAR RAR5 recovery-volume (.rev) out-of-bounds heap write in RecVolumes5::ReadHeader

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    rarlab · winrar1 Tem 2026

  • CVE-2026-13731
    28İzleyin

    WPBot <= 8.4.9 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter

    YüksekCVSS 7,2Kavram kanıtıEPSS %0

    quantumcloud · wpbot – ai chatbot for live support, lead generation, ai services1 Tem 2026

  • CVE-2026-7829
    28İzleyin

    UltraVNC repeater authenticated out-of-bounds write in rule parser via oversized token

    YüksekCVSS 7,2İstismar yokEPSS %0

    uvnc · ultravnc1 Tem 2026

  • CVE-2026-7838
    35İzleyin

    UltraVNC viewer heap buffer overflow via integer overflow in RFB connection-failure reason length

    YüksekCVSS 8,7İstismar yokEPSS %1

    uvnc · ultravnc1 Tem 2026

  • CVE-2026-11794
    32İzleyin

    Advanced Form Integration < 2.1.1 - Unauthenticated Privilege Escalation via Breakdance Form Role Mapping

    YüksekCVSS 8,1İstismar yokEPSS %0

    unknown · advanced form integration — connect forms to 200+ apps1 Tem 2026

  • CVE-2026-11387
    40Planlayın

    SMS Alert <= 3.9.5 - Unauthenticated Privilege Escalation via Arbitrary Password Reset

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    cozyvision1 · sms alert – sms & otp for woocommerce, order notifications & abandoned cart recovery1 Tem 2026

  • CVE-2026-57517
    37İzleyin

    Control Web Panel < 0.9.8.1225 Blind SQL Injection via userRes Parameter

    KritikCVSS 9,3Kavram kanıtıEPSS %0

    control web panel · control web panel1 Tem 2026

  • CVE-2026-58025
    23İzleyin

    Remote Code Execution via Unsafe Deserialization in LogItem Import

    OrtaCVSS 5,9Kavram kanıtıEPSS %0

    mediawiki · mediawiki1 Tem 2026

  • CVE-2026-8857
    1İzleyin

    Full RCE using EasyTimeline Extension

    CVSS 0,0Kavram kanıtıEPSS %2

    mediawiki · mediawiki1 Tem 2026

  • CVE-2026-20217
    30İzleyin

    ClamAV PESpin File Format Processing Out-of-Bounds Memory Corruption Vulnerability

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    clamav · clamav1 Tem 2026

  • CVE-2026-46680
    29İzleyin

    containerd user ID handling bypass allows runAsNonRoot evasion

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    linuxfoundation · containerd1 Tem 2026

  • CVE-2026-57736
    29İzleyin

    WordPress HubSpot plugin <= 11.3.51 - Sensitive Data Exposure vulnerability

    YüksekCVSS 7,4İstismar yokEPSS %0

    hubspot · hubspot1 Tem 2026

  • CVE-2026-49119
    34İzleyin

    Gradio < 6.16.0 Path Traversal via FileExplorer.preprocess()

    YüksekCVSS 8,7İstismar yokEPSS %0

    gradio project · gradio1 Tem 2026

  • CVE-2026-50160
    41Planlayın

    Mass Assignment via Onboarding Endpoint Allows Unauthenticated JWT_SECRET Overwrite

    KritikCVSS 10,0Kavram kanıtıEPSS %1

    hoppscotch · hoppscotch1 Tem 2026

  • CVE-2026-51947
    39İzleyin

    An issue in Pivotal CRM 6.6.4.08 and systems using patch-ghi-15381-cwe-502-20251225.zip (fixed in Pivotal CRM 6.6.5.10 and Patch_CWE502_2026

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    1 Tem 2026

  • CVE-2026-58457
    38İzleyin

    Shenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.csp

    KritikCVSS 9,3Kavram kanıtıEPSS %2

    shenzhen aitemi e commerce co. ltd. · m300 wi-fi repeater1 Tem 2026

  • CVE-2026-14382
    38İzleyin

    Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform

    KritikCVSS 9,6Kavram kanıtıEPSS %0

    google · chrome1 Tem 2026

  • CVE-2026-14431
    35İzleyin

    Type Confusion in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    google · chrome1 Tem 2026

  • CVE-2026-55794
    34İzleyin

    Craft CMS: Potential authenticated Remote Code Execution via referrer redirect

    YüksekCVSS 8,7Kavram kanıtıEPSS %0

    craftcms · cms1 Tem 2026

  • CVE-2026-10104
    17İzleyin

    Product Video Gallery for Woocommerce <= 1.5.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via custom_thumbnail Parameter

    OrtaCVSS 4,4Kavram kanıtıEPSS %0

    nikhilgadhiya · product video gallery for woocommerce2 Tem 2026

  • CVE-2026-13459
    21İzleyin

    JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter

    OrtaCVSS 5,3İstismar yokEPSS %0

    jetmonsters · jetformbuilder — dynamic blocks form builder2 Tem 2026

  • CVE-2026-5524
    40Planlayın

    Divi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter

    KritikCVSS 9,8Kavram kanıtıEPSS %3

    divi engine · divi form builder2 Tem 2026

  • CVE-2026-12166
    22İzleyin

    A NULL pointer dereference vulnerability for driver `GFAC_Sys_x64.sys` in Little Orbit GFAC allows a local attacker to cause a denial of ser

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    little orbit · gamefirst anti-cheat2 Tem 2026

  • CVE-2026-50746
    41Planlayın

    A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to ex

    KritikCVSS 10,0Kavram kanıtıEPSS %1

    ui · unifi connect application2 Tem 2026

  • CVE-2026-58455
    38İzleyin

    Dockwatch 0.6.567 Unauthenticated OS Command Injection via ajax/compose.php

    KritikCVSS 9,2Kavram kanıtıEPSS %8

    notifiarr · dockwatch2 Tem 2026

  • CVE-2026-58467
    33İzleyin

    Cockpit CMS 2.14.0 - Path Traversal Local File Inclusion via index.php

    YüksekCVSS 8,2Kavram kanıtıEPSS %1

    cockpit-hq · cockpit2 Tem 2026

  • CVE-2026-59099
    37İzleyin

    Apereo CAS 7.3.0 < 8.0.0-RC6 - AES-GCM Nonce Reuse Information Disclosure

    KritikCVSS 9,3İstismar yokEPSS %0

    apereo · cas2 Tem 2026

  • CVE-2026-54998
    35İzleyin

    Microsoft Exchange Online Elevation of Privilege Vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    microsoft · exchange online2 Tem 2026

  • CVE-2026-13768
    38İzleyin

    Gardyn IoT Hub Use of Hard-coded Credentials

    KritikCVSS 9,5Kavram kanıtıEPSS %0

    gardyn · gardyn home firmware2 Tem 2026

  • CVE-2026-54477
    20İzleyin

    Gardyn IoT Hub Improper Neutralization of HTTP Headers for Scripting Syntax

    OrtaCVSS 5,1Kavram kanıtıEPSS %0

    gardyn · gardyn home firmware2 Tem 2026

  • CVE-2026-55726
    27İzleyin

    Gardyn IoT Hub Exposure of Sensitive System Information to an Unauthorized Control Sphere

    OrtaCVSS 6,9Kavram kanıtıEPSS %0

    gardyn · gardyn home firmware2 Tem 2026

  • CVE-2026-12960
    24İzleyin

    An Improper Export of Android Application Components vulnerability in ASUS Router App allows a third-party application on the same device to

    OrtaCVSS 6,0Kavram kanıtıEPSS %0

    asus · router app2 Tem 2026

  • CVE-2026-8932
    30İzleyin

    incomplete mTLS config matching in conn reuse

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    haxx · curl3 Tem 2026

  • CVE-2026-14459
    35İzleyin

    Argument Injection in TUBITAK BILGEM's pardus-software

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    tubitak bilgem software technologies research institute · pardus-software3 Tem 2026

  • CVE-2026-14620
    18İzleyin

    webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints

    OrtaCVSS 4,7Kavram kanıtıEPSS %0

    webpack.js · webpack-dev-server3 Tem 2026

  • CVE-2026-20896
    40Planlayın

    Gitea Docker image trusts spoofable reverse-proxy headers by default

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    gitea · gitea open source git server3 Tem 2026

  • CVE-2026-22874
    38İzleyin

    Gitea webhook and migration allow-list filtering permits SSRF

    KritikCVSS 9,6Kavram kanıtıEPSS %0

    gitea · gitea open source git server3 Tem 2026

  • CVE-2026-27771
    32İzleyin

    Gitea Composer package source links use insufficient permission checks

    YüksekCVSS 8,2Kavram kanıtıEPSS %1

    gitea · gitea open source git server3 Tem 2026

  • CVE-2026-28699
    32İzleyin

    Gitea Basic Auth bypasses OAuth2 access token scopes

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    gitea · gitea open source git server3 Tem 2026

  • CVE-2026-58289
    34İzleyin

    Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

    YüksekCVSS 8,3Kavram kanıtıEPSS %1

    microsoft · edge chromium3 Tem 2026

  • CVE-2026-58424
    35İzleyin

    Permanent Fork PR Workflow Approval Gate Bypass

    YüksekCVSS 8,9Kavram kanıtıEPSS %0

    gitea · gitea open source git server3 Tem 2026

  • CVE-2026-54424
    33İzleyin

    An Incorrect Use of Privileged APIs vulnerability in Unity Parsec on Windows hosts leads to a potential Elevation of Privilege.

    YüksekCVSS 8,4Kavram kanıtıEPSS %0

    unity · parsec3 Tem 2026

  • CVE-2026-14628
    22İzleyin

    NousResearch hermes-agent Live Webhook Endpoint base.py extract_media path traversal

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    nousresearch · hermes-agent4 Tem 2026

  • CVE-2026-53359
    35İzleyin

    KVM: x86: Fix shadow paging use-after-free due to unexpected role

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    linux · linux kernel4 Tem 2026

  • CVE-2026-53360
    35İzleyin

    KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    linux · linux kernel4 Tem 2026

  • CVE-2026-53361
    28İzleyin

    af_unix: Set gc_in_progress to true in unix_gc().

    YüksekCVSS 7,1Kavram kanıtıEPSS %0

    linux · linux kernel4 Tem 2026

  • CVE-2026-53362
    61Bu hafta

    ipv6: account for fraggap on the paged allocation path

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %0

    linux · linux kernel4 Tem 2026

  • CVE-2026-59509
    36İzleyin

    Unauthenticated arbitrary MongoDB collection read in cve-search

    KritikCVSS 9,2Kavram kanıtıEPSS %1

    cve-search · cve-search5 Tem 2026

  • CVE-2026-14762
    22İzleyin

    code-projects Hotel and Tourism Reservation Room Management rooms.php sql injection

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    code-projects · hotel and tourism reservation5 Tem 2026

  • CVE-2026-14802
    23İzleyin

    react create-react-app react-dev-utils openBrowser.js startBrowserProcess os command injection

    OrtaCVSS 5,5Kavram kanıtıEPSS %2

    react · create-react-app6 Tem 2026

  • CVE-2026-40047
    37İzleyin

    Apache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer

    KritikCVSS 9,1Kavram kanıtıEPSS %2

    apache · camel6 Tem 2026

  • CVE-2026-40859
    32İzleyin

    Apache Camel: Camel-Vertx-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-42527
    32İzleyin

    Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-43865
    32İzleyin

    Apache Camel: Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-43866
    29İzleyin

    Apache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-43867
    39İzleyin

    Apache Camel: Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilt

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-46453
    21İzleyin

    Apache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clien

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-46454
    39İzleyin

    Apache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inje

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-46455
    39İzleyin

    Apache Camel: Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired t

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-46456
    39İzleyin

    Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inje

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-46457
    30İzleyin

    Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publis

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-46584
    14İzleyin

    Apache Camel Mail: The mail producer applied attacker-supplied message headers as JavaMail session properties, allowing an attacker to influence SMTP parameters

    DüşükCVSS 3,7Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-46585
    30İzleyin

    Apache Camel Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN_LUCENE_DOCS) that bypass the HTTP header filter, allowing an HTTP cl

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-46590
    35İzleyin

    Apache Camel: Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream an

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-46591
    32İzleyin

    Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allow

    YüksekCVSS 8,2Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-46592
    30İzleyin

    Apache Camel: Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filt

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-46726
    30İzleyin

    Apache Camel Vertx Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a HeaderFilterStrategy

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-48203
    36İzleyin

    Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an H

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-48204
    39İzleyin

    Apache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to sw

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-48205
    36İzleyin

    Apache Camel DNS: The dns.* and term Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to infl

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-48206
    21İzleyin

    Apache Camel JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to drive arbitrary JIRA issue op

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-49086
    26İzleyin

    Apache Camel Dapr: Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and topic into producer-direction routing headers, allowing an actor who can pu

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-49097
    26İzleyin

    Apache Camel: Camel-IRC: The irc.sendTo (and other irc.*) Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter, allowing a

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-49098
    21İzleyin

    Apache Camel: Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP he

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-49099
    21İzleyin

    Apache Camel Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to influence internal behaviour

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-49365
    21İzleyin

    Apache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP respo

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-53913
    39İzleyin

    Apache Camel Keycloak: KeycloakSecurityPolicy verifies the bearer access token only inside its role and permission checks, so in the default configuration the t

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    apache · camel6 Tem 2026

  • CVE-2026-55993
    30İzleyin

    Apache Camel Atmosphere Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy, al

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-55994
    30İzleyin

    Apache Camel Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy, allowing injection

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-56139
    21İzleyin

    Apache Camel Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body,

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-46587
    29İzleyin

    Apache Camel: Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-46588
    29İzleyin

    Apache Camel: CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-49042
    29İzleyin

    Apache Camel: langchain4j-tools: filter tool argument headers against declared parameters

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    apache · camel6 Tem 2026

  • CVE-2026-43825
    33İzleyin

    Apache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserialization in SvmDoccatModel

    YüksekCVSS 7,3İstismar yokEPSS %13

    apache · opennlp6 Tem 2026

  • CVE-2026-13753
    30İzleyin

    Certain HP DeskJet All in One – Potential Information Disclosure

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    hp inc · hp deskjet 2820 aio printer6 Tem 2026

  • CVE-2026-11405
    39İzleyin

    Hidden backdoor authentication mechanism in multiple versions of Tenda firmware allows admin access to web management interface

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    tenda · firmware6 Tem 2026

  • CVE-2026-34038
    40Planlayın

    Coolify authenticated remote command injection leading to RCE and secret exfiltration

    KritikCVSS 9,9Kavram kanıtıEPSS %2

    coollabsio · coolify6 Tem 2026

  • CVE-2026-53647
    27İzleyin

    FOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get_info endpoint

    OrtaCVSS 6,9Kavram kanıtıEPSS %0

    fossbilling · fossbilling6 Tem 2026

  • CVE-2026-34048
    39İzleyin

    Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servers

    KritikCVSS 9,9Kavram kanıtıEPSS %0

    coollabsio · coolify7 Tem 2026

  • CVE-2026-12277
    34İzleyin

    Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Deletion via Saved File Metadata Path Traversal

    YüksekCVSS 8,7Kavram kanıtıEPSS %0

    unknown · frontend file manager plugin7 Tem 2026

  • CVE-2026-33264
    39İzleyin

    Apache Airflow: DAG author RCE on webserver via unrestricted import_string() in BaseSerialization.deserialize()

    KritikCVSS 9,8İstismar yokEPSS %1

    apache · airflow7 Tem 2026

  • CVE-2026-12352
    23İzleyin

    Incorrect Authorization

    OrtaCVSS 5,9Kavram kanıtıEPSS %0

    digi international · portserver ts 1/2/47 Tem 2026

  • CVE-2026-12948
    19İzleyin

    Stored Cross-Site Scripting (XSS)

    OrtaCVSS 4,8Kavram kanıtıEPSS %0

    digi international · digi portserver ts7 Tem 2026

  • CVE-2026-23697
    34İzleyin

    Vtiger CRM < 8.4.0 Authenticated File Upload RCE via Documents Module

    YüksekCVSS 8,7Kavram kanıtıEPSS %0

    vtiger · vtiger crm7 Tem 2026

  • CVE-2026-23698
    34İzleyin

    Vtiger CRM 8.4.0 Authenticated RCE via Module Import File Upload

    YüksekCVSS 8,6Kavram kanıtıEPSS %1

    vtiger · vtiger crm7 Tem 2026

  • CVE-2026-57851
    34İzleyin

    MSI KernCoreLib64.sys Privilege Escalation via IOCTL Handlers

    YüksekCVSS 8,5Kavram kanıtıEPSS %0

    micro-star international (msi) · kerncorelib64.sys7 Tem 2026

  • CVE-2026-55592
    15İzleyin

    Dashy: XSS in workspace url parameter

    DüşükCVSS 3,9Kavram kanıtıEPSS %0

    lissy93 · dashy7 Tem 2026

  • CVE-2026-57239
    31İzleyin

    Foxit PDF Editor/Reader Local Privilege Escalation

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    foxit · pdf editor8 Tem 2026

  • CVE-2026-41042
    36İzleyin

    Apache Gravitino: Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server vi

    KritikCVSS 9,1Kavram kanıtıEPSS %1

    apache software foundation · apache gravitino8 Tem 2026

  • CVE-2026-6854
    30İzleyin

    My Calendar <= 3.7.8 - Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    joedolson · my calendar – accessible event manager8 Tem 2026