Yayın tarihine göre
Temmuz 2026: sömürülen ve yeni ciddi CVE kayıtları
1.300 kayıt · 21 KEV. Yayın sırasıyla.
Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.
Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.
Sayfa 12 / 13
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
30İzleyin | CVE-2026-12947İstismar yok | IBM App Connect Enterprise is vulnerable to Confidentiality disclosure on Discovery Connector nodesibm · app connect enterprise · CWE-532 | Yüksek7,5 | — | %0,3 | 30 Tem 2026 |
30İzleyin | CVE-2026-14519İstismar yok | IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settingsibm · app connect enterprise · CWE-22 | Yüksek7,5 | — | %0,6 | 30 Tem 2026 |
39İzleyin | CVE-2026-14522İstismar yok | IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settingsibm · app connect enterprise · CWE-78 | Kritik9,8 | — | %1,0 | 30 Tem 2026 |
35İzleyin | CVE-2026-14980İstismar yok | IBM WebSphere Application Server Liberty is affected by a cross-site request forgeryibm · websphere application server · CWE-269 | Yüksek8,8 | — | %0,4 | 30 Tem 2026 |
39İzleyin | CVE-2026-15435İstismar yok | IBM App Connect Enterprise is vulnerable to arbitrary file write vulnerabilityibm · app connect enterprise · CWE-22 | Kritik9,8 | — | %0,7 | 30 Tem 2026 |
30İzleyin | CVE-2026-16308İstismar yok | IBM Enterprise Build of Quarkus is affected by a DoS vulnerabilityibm · enterprise build of quarkus · CWE-770 | Yüksek7,5 | — | %0,5 | 30 Tem 2026 |
36İzleyin | CVE-2026-53431İstismar yok | Boruta accepts expired JWT client assertions due to missing exp claim validationmalach-it · boruta · CWE-294 | Kritik9,1 | — | %0,7 | 30 Tem 2026 |
33İzleyin | CVE-2026-65635İstismar yok | Boruta dynamic client registration allows creation of over-privileged OAuth clientsmalach-it · boruta · CWE-653 | Yüksek8,3 | — | %0,5 | 30 Tem 2026 |
34İzleyin | CVE-2026-67345İstismar yok | MaxKey 4.1.12 DefaultRedirectResolver OAuth Authorization Code Theftdromara · maxkey · CWE-183 | Yüksek8,5 | — | %0,5 | 30 Tem 2026 |
30İzleyin | CVE-2026-67346İstismar yok | Swarms 6.8.1 Server-Side Request Forgery via DNS Rebinding Bypasskyegomez · swarms · CWE-918 | Yüksek7,7 | — | %0,5 | 30 Tem 2026 |
34İzleyin | CVE-2026-67348İstismar yok | Julep Insecure Direct Object Reference via GET /executions/{execution_id}julep-ai · julep · CWE-639 | Yüksek8,6 | — | %0,4 | 30 Tem 2026 |
34İzleyin | CVE-2026-67349İstismar yok | OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypassopencost · opencost · CWE-306 | Yüksek8,7 | — | %0,4 | 30 Tem 2026 |
31İzleyin | CVE-2026-6540İstismar yok | L7 policy bypass via unnormalized HTTP path matchingtigera · calico · CWE-22 | Yüksek7,9 | — | %0,5 | 30 Tem 2026 |
30İzleyin | CVE-2026-10842İstismar yok | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerabilityibm · websphere application server · CWE-289 | Yüksek7,5 | — | %0,5 | 30 Tem 2026 |
32İzleyin | CVE-2026-15658İstismar yok | foreUP customer REST API allows unauthenticated endpoint accessforeup · foreup · CWE-639 | Yüksek8,1 | — | %0,3 | 30 Tem 2026 |
39İzleyin | CVE-2026-28323İstismar yok | SolarWinds Web Help Desk SAML Authentication Bypass Vulnerabilitysolarwinds · web help desk · CWE-287 | Kritik9,8 | — | %1,0 | 30 Tem 2026 |
30İzleyin | CVE-2026-28811İstismar yok | Apache JSPWiki: Error Handling - Reveals Error Detailsapache · jspwiki · CWE-1295 | Yüksek7,5 | — | %0,7 | 30 Tem 2026 |
39İzleyin | CVE-2026-28812İstismar yok | Apache JSPWiki: UserManager does not sanity-check user database at startupapache · jspwiki · CWE-290 | Kritik9,8 | — | %0,6 | 30 Tem 2026 |
35İzleyin | CVE-2026-28813İstismar yok | Apache JSPWiki: JSPWiki vulnerable to JSON hijackingapache · jspwiki · CWE-352 | Yüksek8,8 | — | %0,2 | 30 Tem 2026 |
30İzleyin | CVE-2026-28814İstismar yok | Apache JSPWiki: Pre-Authentication Arbitrary Wiki Markup Renderingapache · jspwiki · CWE-306 | Yüksek7,5 | — | %0,6 | 30 Tem 2026 |
24İzleyin | CVE-2026-44613Kavram kanıtı | Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handlingapache · zeppelin · CWE-352 | Orta6,1 | — | %0,3 | 30 Tem 2026 |
39İzleyin | CVE-2026-4978İstismar yok | SQLi in UMAI Vision's Traffic Analysis Systemumai vision · traffic analysis system · CWE-89 | Kritik9,8 | — | %0,4 | 30 Tem 2026 |
39İzleyin | CVE-2026-52680Kavram kanıtı | Apache Kyuubi: REST batch multipart upload path traversal allows controlled file writeapache · kyuubi · CWE-22 | Kritik9,8 | — | %1,1 | 30 Tem 2026 |
33İzleyin | CVE-2026-57862İstismar yok | Kanboard 1.2.52 and prior SSRF Filter Bypass via Hexadecimal IP Notationkanboard · kanboard · CWE-918 | Yüksek8,4 | — | %0,4 | 30 Tem 2026 |
35İzleyin | CVE-2026-58222Kavram kanıtı | Samba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributesred hat · red hat enterprise linux 10 · CWE-90 | Yüksek8,8 | — | %0,8 | 30 Tem 2026 |
30İzleyin | CVE-2026-18381İstismar yok | Project-koku/koku-metrics-operator: koku-metrics-operator: operator service-account token exfiltration via user-controlled prometheus service_addressredhat · cost management metrics operator · CWE-918 | Yüksek7,6 | — | %0,3 | 30 Tem 2026 |
28İzleyin | CVE-2026-11771İstismar yok | OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentiopenvpn · openvpn · CWE-121 | Yüksek7,0 | — | %0,3 | 30 Tem 2026 |
33İzleyin | CVE-2026-11885İstismar yok | Power System update in Buffer Copyibm · power system s1122 \(9824-22a\) firmware · CWE-120 | Yüksek8,4 | — | %0,1 | 30 Tem 2026 |
28İzleyin | CVE-2026-12932İstismar yok | A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackersopenvpn · openvpn · CWE-401 | Yüksek7,1 | — | %0,4 | 30 Tem 2026 |
39İzleyin | CVE-2026-12940Kavram kanıtı | Langflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpointslangflow · langflow · CWE-78 | Kritik9,8 | — | %0,9 | 30 Tem 2026 |
28İzleyin | CVE-2026-12945İstismar yok | Langflow is affected by exposed credentials due to multiple unauthenticated and insufficiently authorized API endpointslangflow · langflow · CWE-639 | Yüksek7,1 | — | %0,3 | 30 Tem 2026 |
34İzleyin | CVE-2026-54722İstismar yok | dssrf: there a critical security bug with remove_at_symbol_in_stringhackingrepo · dssrf-js · CWE-76 | Yüksek8,7 | — | %0,5 | 30 Tem 2026 |
30İzleyin | CVE-2026-62663İstismar yok | Banks: Arbitrary File Read via Path Traversal in Media Filters (image/audio/video/document)masci · banks · CWE-22 | Yüksek7,5 | — | %0,5 | 30 Tem 2026 |
30İzleyin | CVE-2026-9322İstismar yok | IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilitiesibm · websphere application server · CWE-400 | Yüksek7,5 | — | %0,5 | 30 Tem 2026 |
31İzleyin | CVE-2026-10535İstismar yok | IBM® Db2® is vulnerable to buffer overflow in setgid helper db2flacc which can lead to privilege escalation and instance compromise from an unprivileged shellibm · db2 · CWE-121 | Yüksek7,8 | — | %0,1 | 30 Tem 2026 |
30İzleyin | CVE-2026-10545İstismar yok | IBM Planning Analytics Local is affected by Open Redirectibm · planning analytics local · CWE-601 | Yüksek7,5 | — | %0,3 | 30 Tem 2026 |
39İzleyin | CVE-2026-12118Kavram kanıtı | IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted dataibm · webmethods integration · CWE-502 | Kritik9,8 | — | %0,8 | 30 Tem 2026 |
30İzleyin | CVE-2026-12733İstismar yok | IBM DataPower Gateway affected by denial of serviceibm · datapower gateway · CWE-770 | Yüksek7,5 | — | %0,5 | 30 Tem 2026 |
30İzleyin | CVE-2026-12942İstismar yok | Langflow is affected by path traversal due to multiple unauthenticated and insufficiently authorized API endpointslangflow · langflow · CWE-22 | Yüksek7,5 | — | %0,6 | 30 Tem 2026 |
39İzleyin | CVE-2026-12943İstismar yok | This Power Hardware Management Console update is being released to addressibm · hardware management console · CWE-78 | Kritik9,8 | — | %0,7 | 30 Tem 2026 |
39İzleyin | CVE-2026-13435İstismar yok | Python Interpreter Sandbox Bypass Leading to Sensitive Data Exposurelangflow · langflow · CWE-94 | Kritik9,9 | — | %0,5 | 30 Tem 2026 |
32İzleyin | CVE-2026-13444İstismar yok | Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently autlangflow · langflow · CWE-520 | Yüksek8,1 | — | %0,3 | 30 Tem 2026 |
39İzleyin | CVE-2026-15969İstismar yok | SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitrlmsys · sglang · CWE-502 | Kritik9,8 | — | %1,0 | 30 Tem 2026 |
39İzleyin | CVE-2026-15971İstismar yok | SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPER_SERVER_PORT islmsys · sglang · CWE-95 | Kritik9,8 | — | %0,7 | 30 Tem 2026 |
39İzleyin | CVE-2026-15976İstismar yok | SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /update_weilmsys · sglang · CWE-502 | Kritik9,8 | — | %0,6 | 30 Tem 2026 |
30İzleyin | CVE-2026-15977İstismar yok | SGLang contains a credential leakage vulnerability in the /server_info endpoint, which will return API keys and SSL keyfile information whenlmsys · sglang · CWE-522 | Yüksek7,5 | — | %0,4 | 30 Tem 2026 |
30İzleyin | CVE-2026-15978İstismar yok | SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a lmsys · sglang · CWE-306 | Yüksek7,5 | — | %0,5 | 30 Tem 2026 |
34İzleyin | CVE-2026-18140İstismar yok | Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated serversamazon · aws-smithy-json · CWE-674 | Yüksek8,7 | — | %0,4 | 30 Tem 2026 |
37İzleyin | CVE-2026-48499İstismar yok | Activepieces: Cross-tenant data exposure and code injection via the Code piece sandbox cacheactivepieces · activepieces · CWE-200 | Kritik9,3 | — | %0,4 | 30 Tem 2026 |
30İzleyin | CVE-2026-61536İstismar yok | Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCEmasci · banks · CWE-94 | Yüksek7,5 | — | %0,5 | 30 Tem 2026 |
60Bu hafta | CVE-2026-66066Silahlaştırılmış | Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processingrails · rails · CWE-1188 | Kritik9,5 | — | %27,8 | 30 Tem 2026 |
33İzleyin | CVE-2026-66415İstismar yok | Leantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import()leantime · leantime · CWE-918 | Yüksek8,4 | — | %0,3 | 30 Tem 2026 |
34İzleyin | CVE-2026-66416İstismar yok | Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middlewareleantime · leantime · CWE-352 | Yüksek8,6 | — | %0,2 | 30 Tem 2026 |
34İzleyin | CVE-2026-11536İstismar yok | IBM WebSphere Application Server is affected by a remote code execution vulnerabilityibm · websphere application server · CWE-502 | Yüksek8,5 | — | %0,5 | 30 Tem 2026 |
39İzleyin | CVE-2026-12946İstismar yok | Remote Code Execution in CUGA Component CodeAgentlangflow · langflow · CWE-94 | Kritik9,9 | — | %0,6 | 30 Tem 2026 |
35İzleyin | CVE-2026-67206Kavram kanıtı | Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Uploadwolfcms · wolfcms · CWE-434 | Yüksek8,7 | — | %2,1 | 30 Tem 2026 |
34İzleyin | CVE-2026-67207İstismar yok | Wolf CMS 0.8.3.1 Authorization Bypass via BackupRestoreControllerwolfcms · wolfcms · CWE-697 | Yüksek8,7 | — | %0,5 | 30 Tem 2026 |
38İzleyin | CVE-2026-67208Kavram kanıtı | Juggle 1.6.0 Unauthenticated RCE via Exposed H2 Consolesomta · juggle · CWE-306 | Kritik9,3 | — | %4,2 | 30 Tem 2026 |
30İzleyin | CVE-2026-67527İstismar yok | OpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH parameter "fileLinks"opf · openproject · CWE-862 | Yüksek7,6 | — | %0,4 | 30 Tem 2026 |
37İzleyin | CVE-2026-67594İstismar yok | Spikster Missing Authentication via API Route Groupyolanmees · spikster · CWE-306 | Kritik9,3 | — | %0,8 | 30 Tem 2026 |
39İzleyin | CVE-2026-35847İstismar yok | An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php fileCWE-77 | Kritik9,8 | — | %0,6 | 30 Tem 2026 |
36İzleyin | CVE-2026-52539İstismar yok | Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret.CWE-798 | Kritik9,1 | — | %0,5 | 30 Tem 2026 |
28İzleyin | CVE-2026-54715İstismar yok | GoAccess: Heap Out-of-Bounds Write in parse_browser()allinurl · goaccess · CWE-122 | Yüksek7,1 | — | %0,4 | 30 Tem 2026 |
34İzleyin | CVE-2026-55768İstismar yok | GoAccess WebSocket Server: Signed 32 bit truncation of the 64 bit frame length causes a remote pre-authentication denial of serviceallinurl · goaccess · CWE-681 | Yüksek8,7 | — | %0,4 | 30 Tem 2026 |
37İzleyin | CVE-2026-66418Kavram kanıtı | OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Fieldtugcantopaloglu · openclaw agent dashboard · CWE-79 | Kritik9,3 | — | %0,6 | 30 Tem 2026 |
40Planlayın | CVE-2026-66803İstismar yok | Azure Cosmos DB Remote Code Execution Vulnerabilitymicrosoft · azure cosmos db · CWE-284 | Kritik10,0 | — | %0,9 | 30 Tem 2026 |
30İzleyin | CVE-2026-68500İstismar yok | Sylius Mollie Plugin: Payment status forgery via the payment webhooksylius · mollieplugin · CWE-639 | Yüksek7,5 | — | %0,6 | 30 Tem 2026 |
39İzleyin | CVE-2026-68502İstismar yok | LazyOwn: Unauthenticated Socket.IO `input` Event Reaches LazyOwn Command Dispatcher — Unauthenticated RCEgrisuno · lazyown · CWE-306 | Kritik9,8 | — | %0,9 | 30 Tem 2026 |
39İzleyin | CVE-2026-68503İstismar yok | LazyOwn: Default C2 Operator Credentials Enable Administrative Access to C2 Dashboardgrisuno · lazyown · CWE-1392 | Kritik9,8 | — | %0,7 | 30 Tem 2026 |
34İzleyin | CVE-2026-12562İstismar yok | Toptech Systems RCU II+ and Multiload II+ Missing Authentication for Critical Functiontoptech systems · rcu ii+ · CWE-306 | Yüksek8,7 | — | %0,4 | 30 Tem 2026 |
32İzleyin | CVE-2026-18064İstismar yok | NASA Core Flight System (cFS) Health & Safety (HS) Application NULL Pointer Dereferencenasa · core flight system (cfs) health & safety (hs) application · CWE-476 | Yüksek8,2 | — | %0,6 | 30 Tem 2026 |
40Planlayın | CVE-2026-38709İstismar yok | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2CWE-77 | Kritik9,8 | — | %2,7 | 30 Tem 2026 |
30İzleyin | CVE-2026-5846İstismar yok | Hard-coded Cryptographic Key in Watchfire Controllerswatchfire · bc550 · CWE-321 | Yüksek7,6 | — | %0,2 | 30 Tem 2026 |
34İzleyin | CVE-2026-62246İstismar yok | Kamaji: TenantControlPlane namespace/name collision binds two tenants to the same SQL datastore schema + DB user, breaking per-tenant isolationclastix · kamaji · CWE-284 | Yüksek8,5 | — | %0,3 | 30 Tem 2026 |
34İzleyin | CVE-2026-63559İstismar yok | o6 Automation open62541 Integer Overflow or Wraparoundo6 automation · open62541 · CWE-190 | Yüksek8,7 | — | %0,6 | 30 Tem 2026 |
28İzleyin | CVE-2026-64816İstismar yok | RapidRAW < 1.6.0 NTLMv2 Credential Leak via UNC Path in lutPathcybertimon · rapidraw · CWE-73 | Yüksek7,1 | — | %0,4 | 30 Tem 2026 |
28İzleyin | CVE-2026-63035İstismar yok | o6 Automation open62541 Use After Freeo6 automation · open62541 · CWE-416 | Yüksek7,2 | — | %0,7 | 30 Tem 2026 |
33İzleyin | CVE-2026-63362İstismar yok | o6 Automation open62541 Integer Underflowo6 automation · open62541 · CWE-191 | Yüksek8,2 | — | %1,8 | 30 Tem 2026 |
28İzleyin | CVE-2026-63550İstismar yok | MZ Automation libiec61850 Out-of-bounds Readmz automation gmbh · libiec61850 · CWE-125 | Yüksek7,1 | — | %0,4 | 30 Tem 2026 |
28İzleyin | CVE-2026-65421İstismar yok | MZ Automation libiec61850 Out-of-bounds Readmz automation gmbh · libiec61850 · CWE-125 | Yüksek7,1 | — | %0,2 | 30 Tem 2026 |
34İzleyin | CVE-2026-65423İstismar yok | o6 Automation open62541 Integer Overflow or Wraparoundo6 automation · open62541 · CWE-190 | Yüksek8,7 | — | %0,7 | 30 Tem 2026 |
34İzleyin | CVE-2026-66360İstismar yok | MZ Automation libiec61850 Out-of-bounds Readmz automation gmbh · libiec61850 · CWE-125 | Yüksek8,7 | — | %0,4 | 30 Tem 2026 |
28İzleyin | CVE-2026-66364İstismar yok | MZ Automation libiec61850 Out-of-bounds Readmz automation gmbh · libiec61850 · CWE-125 | Yüksek7,1 | — | %0,2 | 30 Tem 2026 |
28İzleyin | CVE-2026-66369İstismar yok | MZ Automation libiec61850 Out-of-bounds Readmz automation gmbh · libiec61850 · CWE-125 | Yüksek7,1 | — | %0,2 | 30 Tem 2026 |
34İzleyin | CVE-2026-66420İstismar yok | MeshCentral Cross-Site WebSocket Hijacking via Origin Validation Bypass on Self-Signed Certificate Deploymentsylianst · meshcentral · CWE-346 | Yüksek8,6 | — | %0,2 | 30 Tem 2026 |
35İzleyin | CVE-2026-66421Kavram kanıtı | OpenClaw Dashboard Stored XSS via lastMessage Session Fieldtugcantopaloglu · openclaw agent dashboard · CWE-79 | Yüksek8,8 | — | %0,6 | 30 Tem 2026 |
28İzleyin | CVE-2026-66720İstismar yok | MZ Automation libiec61850 Out-of-bounds Readmz automation gmbh · libiec61850 · CWE-125 | Yüksek7,1 | — | %0,2 | 30 Tem 2026 |
30İzleyin | CVE-2024-25039İstismar yok | IBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multiple vulnerabilitiesibm · engineering requirements management doors web access · CWE-400 | Yüksek7,5 | — | %0,4 | 30 Tem 2026 |
39İzleyin | CVE-2025-65336İstismar yok | Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php.CWE-89 | Kritik9,8 | — | %0,3 | 30 Tem 2026 |
39İzleyin | CVE-2025-69930İstismar yok | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.php?id=1.CWE-89 | Kritik9,8 | — | %0,3 | 30 Tem 2026 |
39İzleyin | CVE-2025-69931İstismar yok | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_membership.php?id=1.CWE-89 | Kritik9,8 | — | %0,3 | 30 Tem 2026 |
39İzleyin | CVE-2025-69933İstismar yok | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1.CWE-89 | Kritik9,8 | — | %0,3 | 30 Tem 2026 |
39İzleyin | CVE-2025-69934İstismar yok | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1.CWE-89 | Kritik9,8 | — | %0,3 | 30 Tem 2026 |
39İzleyin | CVE-2025-69935İstismar yok | CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameterCWE-89 | Kritik9,8 | — | %0,3 | 30 Tem 2026 |
39İzleyin | CVE-2025-69936İstismar yok | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1.CWE-89 | Kritik9,8 | — | %0,3 | 30 Tem 2026 |
39İzleyin | CVE-2025-69937İstismar yok | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id.CWE-89 | Kritik9,8 | — | %0,4 | 30 Tem 2026 |
39İzleyin | CVE-2025-69938İstismar yok | CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType.CWE-89 | Kritik9,8 | — | %0,3 | 30 Tem 2026 |
39İzleyin | CVE-2025-69941İstismar yok | SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1.CWE-89 | Kritik9,8 | — | %0,3 | 30 Tem 2026 |
39İzleyin | CVE-2025-69947İstismar yok | SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1.CWE-89 | Kritik9,8 | — | %0,3 | 30 Tem 2026 |
32İzleyin | CVE-2026-14537İstismar yok | Authorization Bypass in MCP Toolbox Legacy HTTP Endpointsgoogle · mcp toolbox for databases · CWE-863 | Yüksek8,1 | — | %0,2 | 30 Tem 2026 |
- CVE-2026-1294730İzleyin
IBM App Connect Enterprise is vulnerable to Confidentiality disclosure on Discovery Connector nodes
YüksekCVSS 7,5İstismar yokEPSS %0ibm · app connect enterprise30 Tem 2026
- CVE-2026-1451930İzleyin
IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings
YüksekCVSS 7,5İstismar yokEPSS %0ibm · app connect enterprise30 Tem 2026
- CVE-2026-1452239İzleyin
IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings
KritikCVSS 9,8İstismar yokEPSS %1ibm · app connect enterprise30 Tem 2026
- CVE-2026-1498035İzleyin
IBM WebSphere Application Server Liberty is affected by a cross-site request forgery
YüksekCVSS 8,8İstismar yokEPSS %0ibm · websphere application server30 Tem 2026
- CVE-2026-1543539İzleyin
IBM App Connect Enterprise is vulnerable to arbitrary file write vulnerability
KritikCVSS 9,8İstismar yokEPSS %0ibm · app connect enterprise30 Tem 2026
- CVE-2026-1630830İzleyin
IBM Enterprise Build of Quarkus is affected by a DoS vulnerability
YüksekCVSS 7,5İstismar yokEPSS %0ibm · enterprise build of quarkus30 Tem 2026
- CVE-2026-5343136İzleyin
Boruta accepts expired JWT client assertions due to missing exp claim validation
KritikCVSS 9,1İstismar yokEPSS %0malach-it · boruta30 Tem 2026
- CVE-2026-6563533İzleyin
Boruta dynamic client registration allows creation of over-privileged OAuth clients
YüksekCVSS 8,3İstismar yokEPSS %0malach-it · boruta30 Tem 2026
- CVE-2026-6734534İzleyin
MaxKey 4.1.12 DefaultRedirectResolver OAuth Authorization Code Theft
YüksekCVSS 8,5İstismar yokEPSS %0dromara · maxkey30 Tem 2026
- CVE-2026-6734630İzleyin
Swarms 6.8.1 Server-Side Request Forgery via DNS Rebinding Bypass
YüksekCVSS 7,7İstismar yokEPSS %0kyegomez · swarms30 Tem 2026
- CVE-2026-6734834İzleyin
Julep Insecure Direct Object Reference via GET /executions/{execution_id}
YüksekCVSS 8,6İstismar yokEPSS %0julep-ai · julep30 Tem 2026
- CVE-2026-6734934İzleyin
OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass
YüksekCVSS 8,7İstismar yokEPSS %0opencost · opencost30 Tem 2026
- CVE-2026-654031İzleyin
L7 policy bypass via unnormalized HTTP path matching
YüksekCVSS 7,9İstismar yokEPSS %0tigera · calico30 Tem 2026
- CVE-2026-1084230İzleyin
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerability
YüksekCVSS 7,5İstismar yokEPSS %0ibm · websphere application server30 Tem 2026
- CVE-2026-1565832İzleyin
foreUP customer REST API allows unauthenticated endpoint access
YüksekCVSS 8,1İstismar yokEPSS %0foreup · foreup30 Tem 2026
- CVE-2026-2832339İzleyin
SolarWinds Web Help Desk SAML Authentication Bypass Vulnerability
KritikCVSS 9,8İstismar yokEPSS %1solarwinds · web help desk30 Tem 2026
- CVE-2026-2881130İzleyin
Apache JSPWiki: Error Handling - Reveals Error Details
YüksekCVSS 7,5İstismar yokEPSS %0apache · jspwiki30 Tem 2026
- CVE-2026-2881239İzleyin
Apache JSPWiki: UserManager does not sanity-check user database at startup
KritikCVSS 9,8İstismar yokEPSS %0apache · jspwiki30 Tem 2026
- CVE-2026-2881335İzleyin
Apache JSPWiki: JSPWiki vulnerable to JSON hijacking
YüksekCVSS 8,8İstismar yokEPSS %0apache · jspwiki30 Tem 2026
- CVE-2026-2881430İzleyin
Apache JSPWiki: Pre-Authentication Arbitrary Wiki Markup Rendering
YüksekCVSS 7,5İstismar yokEPSS %0apache · jspwiki30 Tem 2026
- CVE-2026-4461324İzleyin
Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling
OrtaCVSS 6,1Kavram kanıtıEPSS %0apache · zeppelin30 Tem 2026
- CVE-2026-497839İzleyin
SQLi in UMAI Vision's Traffic Analysis System
KritikCVSS 9,8İstismar yokEPSS %0umai vision · traffic analysis system30 Tem 2026
- CVE-2026-5268039İzleyin
Apache Kyuubi: REST batch multipart upload path traversal allows controlled file write
KritikCVSS 9,8Kavram kanıtıEPSS %1apache · kyuubi30 Tem 2026
- CVE-2026-5786233İzleyin
Kanboard 1.2.52 and prior SSRF Filter Bypass via Hexadecimal IP Notation
YüksekCVSS 8,4İstismar yokEPSS %0kanboard · kanboard30 Tem 2026
- CVE-2026-5822235İzleyin
Samba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributes
YüksekCVSS 8,8Kavram kanıtıEPSS %0red hat · red hat enterprise linux 1030 Tem 2026
- CVE-2026-1838130İzleyin
Project-koku/koku-metrics-operator: koku-metrics-operator: operator service-account token exfiltration via user-controlled prometheus service_address
YüksekCVSS 7,6İstismar yokEPSS %0redhat · cost management metrics operator30 Tem 2026
- CVE-2026-1177128İzleyin
OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authenti
YüksekCVSS 7,0İstismar yokEPSS %0openvpn · openvpn30 Tem 2026
- CVE-2026-1188533İzleyin
Power System update in Buffer Copy
YüksekCVSS 8,4İstismar yokEPSS %0ibm · power system s1122 \(9824-22a\) firmware30 Tem 2026
- CVE-2026-1293228İzleyin
A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers
YüksekCVSS 7,1İstismar yokEPSS %0openvpn · openvpn30 Tem 2026
- CVE-2026-1294039İzleyin
Langflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpoints
KritikCVSS 9,8Kavram kanıtıEPSS %0langflow · langflow30 Tem 2026
- CVE-2026-1294528İzleyin
Langflow is affected by exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints
YüksekCVSS 7,1İstismar yokEPSS %0langflow · langflow30 Tem 2026
- CVE-2026-5472234İzleyin
dssrf: there a critical security bug with remove_at_symbol_in_string
YüksekCVSS 8,7İstismar yokEPSS %0hackingrepo · dssrf-js30 Tem 2026
- CVE-2026-6266330İzleyin
Banks: Arbitrary File Read via Path Traversal in Media Filters (image/audio/video/document)
YüksekCVSS 7,5İstismar yokEPSS %0masci · banks30 Tem 2026
- CVE-2026-932230İzleyin
IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities
YüksekCVSS 7,5İstismar yokEPSS %0ibm · websphere application server30 Tem 2026
- CVE-2026-1053531İzleyin
IBM® Db2® is vulnerable to buffer overflow in setgid helper db2flacc which can lead to privilege escalation and instance compromise from an unprivileged shell
YüksekCVSS 7,8İstismar yokEPSS %0ibm · db230 Tem 2026
- CVE-2026-1054530İzleyin
IBM Planning Analytics Local is affected by Open Redirect
YüksekCVSS 7,5İstismar yokEPSS %0ibm · planning analytics local30 Tem 2026
- CVE-2026-1211839İzleyin
IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data
KritikCVSS 9,8Kavram kanıtıEPSS %0ibm · webmethods integration30 Tem 2026
- CVE-2026-1273330İzleyin
IBM DataPower Gateway affected by denial of service
YüksekCVSS 7,5İstismar yokEPSS %0ibm · datapower gateway30 Tem 2026
- CVE-2026-1294230İzleyin
Langflow is affected by path traversal due to multiple unauthenticated and insufficiently authorized API endpoints
YüksekCVSS 7,5İstismar yokEPSS %0langflow · langflow30 Tem 2026
- CVE-2026-1294339İzleyin
This Power Hardware Management Console update is being released to address
KritikCVSS 9,8İstismar yokEPSS %0ibm · hardware management console30 Tem 2026
- CVE-2026-1343539İzleyin
Python Interpreter Sandbox Bypass Leading to Sensitive Data Exposure
KritikCVSS 9,9İstismar yokEPSS %0langflow · langflow30 Tem 2026
- CVE-2026-1344432İzleyin
Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently aut
YüksekCVSS 8,1İstismar yokEPSS %0langflow · langflow30 Tem 2026
- CVE-2026-1596939İzleyin
SGLang contains an unauthenticated RCE in /load_lora_adapter_from_tensors via bypass of SafeUnpickler’s incomplete denylist, allowing arbitr
KritikCVSS 9,8İstismar yokEPSS %1lmsys · sglang30 Tem 2026
- CVE-2026-1597139İzleyin
SGLang contains an RCE vulnerability when the optional dumper subsystem is enabled, allowing for a sandbox escape when DUMPER_SERVER_PORT is
KritikCVSS 9,8İstismar yokEPSS %0lmsys · sglang30 Tem 2026
- CVE-2026-1597639İzleyin
SGLang contains a RCE vulnerability when attempting to load model weights from a HuggingFace repository, specifically within the /update_wei
KritikCVSS 9,8İstismar yokEPSS %0lmsys · sglang30 Tem 2026
- CVE-2026-1597730İzleyin
SGLang contains a credential leakage vulnerability in the /server_info endpoint, which will return API keys and SSL keyfile information when
YüksekCVSS 7,5İstismar yokEPSS %0lmsys · sglang30 Tem 2026
- CVE-2026-1597830İzleyin
SGLang contains a model weight exfiltration vulnerability when no API keys are configured, as SGLang will expose two endpoints that allow a
YüksekCVSS 7,5İstismar yokEPSS %0lmsys · sglang30 Tem 2026
- CVE-2026-1814034İzleyin
Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers
YüksekCVSS 8,7İstismar yokEPSS %0amazon · aws-smithy-json30 Tem 2026
- CVE-2026-4849937İzleyin
Activepieces: Cross-tenant data exposure and code injection via the Code piece sandbox cache
KritikCVSS 9,3İstismar yokEPSS %0activepieces · activepieces30 Tem 2026
- CVE-2026-6153630İzleyin
Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCE
YüksekCVSS 7,5İstismar yokEPSS %0masci · banks30 Tem 2026
- CVE-2026-6606660Bu hafta
Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing
KritikCVSS 9,5SilahlaştırılmışEPSS %27rails · rails30 Tem 2026
- CVE-2026-6641533İzleyin
Leantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import()
YüksekCVSS 8,4İstismar yokEPSS %0leantime · leantime30 Tem 2026
- CVE-2026-6641634İzleyin
Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware
YüksekCVSS 8,6İstismar yokEPSS %0leantime · leantime30 Tem 2026
- CVE-2026-1153634İzleyin
IBM WebSphere Application Server is affected by a remote code execution vulnerability
YüksekCVSS 8,5İstismar yokEPSS %0ibm · websphere application server30 Tem 2026
- CVE-2026-1294639İzleyin
Remote Code Execution in CUGA Component CodeAgent
KritikCVSS 9,9İstismar yokEPSS %0langflow · langflow30 Tem 2026
- CVE-2026-6720635İzleyin
Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Upload
YüksekCVSS 8,7Kavram kanıtıEPSS %2wolfcms · wolfcms30 Tem 2026
- CVE-2026-6720734İzleyin
Wolf CMS 0.8.3.1 Authorization Bypass via BackupRestoreController
YüksekCVSS 8,7İstismar yokEPSS %0wolfcms · wolfcms30 Tem 2026
- CVE-2026-6720838İzleyin
Juggle 1.6.0 Unauthenticated RCE via Exposed H2 Console
KritikCVSS 9,3Kavram kanıtıEPSS %4somta · juggle30 Tem 2026
- CVE-2026-6752730İzleyin
OpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH parameter "fileLinks"
YüksekCVSS 7,6İstismar yokEPSS %0opf · openproject30 Tem 2026
- CVE-2026-6759437İzleyin
Spikster Missing Authentication via API Route Group
KritikCVSS 9,3İstismar yokEPSS %0yolanmees · spikster30 Tem 2026
- CVE-2026-3584739İzleyin
An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file
KritikCVSS 9,8İstismar yokEPSS %030 Tem 2026
- CVE-2026-5253936İzleyin
Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret.
KritikCVSS 9,1İstismar yokEPSS %030 Tem 2026
- CVE-2026-5471528İzleyin
GoAccess: Heap Out-of-Bounds Write in parse_browser()
YüksekCVSS 7,1İstismar yokEPSS %0allinurl · goaccess30 Tem 2026
- CVE-2026-5576834İzleyin
GoAccess WebSocket Server: Signed 32 bit truncation of the 64 bit frame length causes a remote pre-authentication denial of service
YüksekCVSS 8,7İstismar yokEPSS %0allinurl · goaccess30 Tem 2026
- CVE-2026-6641837İzleyin
OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field
KritikCVSS 9,3Kavram kanıtıEPSS %0tugcantopaloglu · openclaw agent dashboard30 Tem 2026
- CVE-2026-6680340Planlayın
Azure Cosmos DB Remote Code Execution Vulnerability
KritikCVSS 10,0İstismar yokEPSS %0microsoft · azure cosmos db30 Tem 2026
- CVE-2026-6850030İzleyin
Sylius Mollie Plugin: Payment status forgery via the payment webhook
YüksekCVSS 7,5İstismar yokEPSS %0sylius · mollieplugin30 Tem 2026
- CVE-2026-6850239İzleyin
LazyOwn: Unauthenticated Socket.IO `input` Event Reaches LazyOwn Command Dispatcher — Unauthenticated RCE
KritikCVSS 9,8İstismar yokEPSS %0grisuno · lazyown30 Tem 2026
- CVE-2026-6850339İzleyin
LazyOwn: Default C2 Operator Credentials Enable Administrative Access to C2 Dashboard
KritikCVSS 9,8İstismar yokEPSS %0grisuno · lazyown30 Tem 2026
- CVE-2026-1256234İzleyin
Toptech Systems RCU II+ and Multiload II+ Missing Authentication for Critical Function
YüksekCVSS 8,7İstismar yokEPSS %0toptech systems · rcu ii+30 Tem 2026
- CVE-2026-1806432İzleyin
NASA Core Flight System (cFS) Health & Safety (HS) Application NULL Pointer Dereference
YüksekCVSS 8,2İstismar yokEPSS %0nasa · core flight system (cfs) health & safety (hs) application30 Tem 2026
- CVE-2026-3870940Planlayın
TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2
KritikCVSS 9,8İstismar yokEPSS %230 Tem 2026
- CVE-2026-584630İzleyin
Hard-coded Cryptographic Key in Watchfire Controllers
YüksekCVSS 7,6İstismar yokEPSS %0watchfire · bc55030 Tem 2026
- CVE-2026-6224634İzleyin
Kamaji: TenantControlPlane namespace/name collision binds two tenants to the same SQL datastore schema + DB user, breaking per-tenant isolation
YüksekCVSS 8,5İstismar yokEPSS %0clastix · kamaji30 Tem 2026
- CVE-2026-6355934İzleyin
o6 Automation open62541 Integer Overflow or Wraparound
YüksekCVSS 8,7İstismar yokEPSS %0o6 automation · open6254130 Tem 2026
- CVE-2026-6481628İzleyin
RapidRAW < 1.6.0 NTLMv2 Credential Leak via UNC Path in lutPath
YüksekCVSS 7,1İstismar yokEPSS %0cybertimon · rapidraw30 Tem 2026
- CVE-2026-6303528İzleyin
o6 Automation open62541 Use After Free
YüksekCVSS 7,2İstismar yokEPSS %0o6 automation · open6254130 Tem 2026
- CVE-2026-6336233İzleyin
o6 Automation open62541 Integer Underflow
YüksekCVSS 8,2İstismar yokEPSS %1o6 automation · open6254130 Tem 2026
- CVE-2026-6355028İzleyin
MZ Automation libiec61850 Out-of-bounds Read
YüksekCVSS 7,1İstismar yokEPSS %0mz automation gmbh · libiec6185030 Tem 2026
- CVE-2026-6542128İzleyin
MZ Automation libiec61850 Out-of-bounds Read
YüksekCVSS 7,1İstismar yokEPSS %0mz automation gmbh · libiec6185030 Tem 2026
- CVE-2026-6542334İzleyin
o6 Automation open62541 Integer Overflow or Wraparound
YüksekCVSS 8,7İstismar yokEPSS %0o6 automation · open6254130 Tem 2026
- CVE-2026-6636034İzleyin
MZ Automation libiec61850 Out-of-bounds Read
YüksekCVSS 8,7İstismar yokEPSS %0mz automation gmbh · libiec6185030 Tem 2026
- CVE-2026-6636428İzleyin
MZ Automation libiec61850 Out-of-bounds Read
YüksekCVSS 7,1İstismar yokEPSS %0mz automation gmbh · libiec6185030 Tem 2026
- CVE-2026-6636928İzleyin
MZ Automation libiec61850 Out-of-bounds Read
YüksekCVSS 7,1İstismar yokEPSS %0mz automation gmbh · libiec6185030 Tem 2026
- CVE-2026-6642034İzleyin
MeshCentral Cross-Site WebSocket Hijacking via Origin Validation Bypass on Self-Signed Certificate Deployments
YüksekCVSS 8,6İstismar yokEPSS %0ylianst · meshcentral30 Tem 2026
- CVE-2026-6642135İzleyin
OpenClaw Dashboard Stored XSS via lastMessage Session Field
YüksekCVSS 8,8Kavram kanıtıEPSS %0tugcantopaloglu · openclaw agent dashboard30 Tem 2026
- CVE-2026-6672028İzleyin
MZ Automation libiec61850 Out-of-bounds Read
YüksekCVSS 7,1İstismar yokEPSS %0mz automation gmbh · libiec6185030 Tem 2026
- CVE-2024-2503930İzleyin
IBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multiple vulnerabilities
YüksekCVSS 7,5İstismar yokEPSS %0ibm · engineering requirements management doors web access30 Tem 2026
- CVE-2025-6533639İzleyin
Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php.
KritikCVSS 9,8İstismar yokEPSS %030 Tem 2026
- CVE-2025-6993039İzleyin
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.php?id=1.
KritikCVSS 9,8İstismar yokEPSS %030 Tem 2026
- CVE-2025-6993139İzleyin
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_membership.php?id=1.
KritikCVSS 9,8İstismar yokEPSS %030 Tem 2026
- CVE-2025-6993339İzleyin
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1.
KritikCVSS 9,8İstismar yokEPSS %030 Tem 2026
- CVE-2025-6993439İzleyin
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1.
KritikCVSS 9,8İstismar yokEPSS %030 Tem 2026
- CVE-2025-6993539İzleyin
CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameter
KritikCVSS 9,8İstismar yokEPSS %030 Tem 2026
- CVE-2025-6993639İzleyin
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1.
KritikCVSS 9,8İstismar yokEPSS %030 Tem 2026
- CVE-2025-6993739İzleyin
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id.
KritikCVSS 9,8İstismar yokEPSS %030 Tem 2026
- CVE-2025-6993839İzleyin
CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType.
KritikCVSS 9,8İstismar yokEPSS %030 Tem 2026
- CVE-2025-6994139İzleyin
SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1.
KritikCVSS 9,8İstismar yokEPSS %030 Tem 2026
- CVE-2025-6994739İzleyin
SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1.
KritikCVSS 9,8İstismar yokEPSS %030 Tem 2026
- CVE-2026-1453732İzleyin
Authorization Bypass in MCP Toolbox Legacy HTTP Endpoints
YüksekCVSS 8,1İstismar yokEPSS %0google · mcp toolbox for databases30 Tem 2026