İçeriğe atla
Noroxi

Yayın tarihine göre

Temmuz 2026: sömürülen ve yeni ciddi CVE kayıtları

1.302 kayıt · 21 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 13 / 14

  • CVE-2026-55502
    28İzleyin

    Cloudreve: OAuth Admin.Read scope can update OneDrive storage policy credentials

    YüksekCVSS 7,1İstismar yokEPSS %0

    cloudreve · cloudreve31 Tem 2026

  • CVE-2026-58039
    13İzleyin

    A flaw in Node.js Permission Model enforcement allows process.report writes (and overwrites) files outside --allow-fs-write paths.

    DüşükCVSS 3,3Kavram kanıtıEPSS %0

    nodejs · node31 Tem 2026

  • CVE-2026-14537
    32İzleyin

    Authorization Bypass in MCP Toolbox Legacy HTTP Endpoints

    YüksekCVSS 8,1İstismar yokEPSS %0

    google · mcp toolbox for databases31 Tem 2026

  • CVE-2026-14540
    32İzleyin

    Server-Side Request Forgery via Unrestricted HTTP Redirection in MCP Toolbox

    YüksekCVSS 8,0İstismar yokEPSS %0

    google · mcp toolbox for databases31 Tem 2026

  • CVE-2026-63221
    37İzleyin

    CodeIgniter: SQL injection is possible via Query Builder deleteBatch() when used with where() conditions

    KritikCVSS 9,4İstismar yokEPSS %0

    codeigniter4 · codeigniter431 Tem 2026

  • CVE-2026-63222
    30İzleyin

    CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames

    YüksekCVSS 7,5İstismar yokEPSS %0

    codeigniter4 · codeigniter431 Tem 2026

  • CVE-2026-63223
    39İzleyin

    CodeIgniter: Uploaded file extension validation bypass in is_image and mime_in rules

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    codeigniter4 · codeigniter431 Tem 2026

  • CVE-2026-12251
    32İzleyin

    Ultimate Member < 2.12.1 - Unauthenticated Privilege Escalation via Role Selection Field

    YüksekCVSS 8,1İstismar yokEPSS %0

    unknown · ultimate member31 Tem 2026

  • CVE-2026-12695
    32İzleyin

    miniOrange 2FA < 6.2.6 - 2FA Bypass via Attacker-Controlled ga_secret

    YüksekCVSS 8,1İstismar yokEPSS %0

    unknown · miniorange 2fa31 Tem 2026

  • CVE-2026-12720
    30İzleyin

    Kirki < 6.0.13 - Unauthenticated PHP Object Injection

    YüksekCVSS 7,5İstismar yokEPSS %0

    unknown · kirki31 Tem 2026

  • CVE-2026-12721
    34İzleyin

    Kirki < 6.0.13 - Unauthenticated SQL Injection

    YüksekCVSS 8,6İstismar yokEPSS %0

    unknown · kirki31 Tem 2026

  • CVE-2026-13392
    28İzleyin

    ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)

    YüksekCVSS 7,2İstismar yokEPSS %0

    unknown · elementskit elementor addons31 Tem 2026

  • CVE-2026-14541
    32İzleyin

    Authentication Bypass and Audience Confusion in MCP Toolbox OAuth Provider

    YüksekCVSS 8,0İstismar yokEPSS %0

    google · mcp toolbox for databases31 Tem 2026

  • CVE-2026-13609
    35İzleyin

    Frontend Admin by DynamiApps < 3.29.9 - Unauthenticated Stored Cross-Site Scripting via Form Field

    YüksekCVSS 8,8İstismar yokEPSS %0

    unknown · frontend admin by dynamiapps31 Tem 2026

  • CVE-2026-14319
    30İzleyin

    GiveWP < 4.16.3 - Unauthenticated Recurring Donor Information Disclosure

    YüksekCVSS 7,5İstismar yokEPSS %0

    unknown · givewp31 Tem 2026

  • CVE-2026-14333
    30İzleyin

    Demi - One Click Demo Import, Backup & Site Migration < 0.0.7 - Unauthenticated Sensitive Data Exposure via Public Backup Directory

    YüksekCVSS 7,5İstismar yokEPSS %0

    unknown · demi31 Tem 2026

  • CVE-2026-14483
    40Planlayın

    Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Arbitrary File Upload via 'files[file]' Parameter via Public I/O 'set_property' Command

    KritikCVSS 9,8Kavram kanıtıEPSS %3

    realtyna · realtyna organic idx plugin + wpl real estate31 Tem 2026

  • CVE-2026-14830
    30İzleyin

    FlxWoo < 3.1.1 - Unauthenticated Payment Bypass

    YüksekCVSS 7,5İstismar yokEPSS %0

    unknown · flxwoo31 Tem 2026

  • CVE-2026-18157
    31İzleyin

    Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: remote code execution via apt argument injection

    YüksekCVSS 7,8İstismar yokEPSS %0

    redhatinsights · yggdrasil-worker-package-manager31 Tem 2026

  • CVE-2026-14919
    39İzleyin

    ShopMonitor.io < 1.2.0 - Unauthenticated Administrator Account Takeover via Password-Reset Email Reroute

    KritikCVSS 9,8İstismar yokEPSS %0

    unknown · shopmonitor.io31 Tem 2026

  • CVE-2026-14930
    30İzleyin

    JS Help Desk < 3.1.4 - Unauthenticated Arbitrary Ticket File Attachment Upload

    YüksekCVSS 7,5İstismar yokEPSS %0

    unknown · js help desk31 Tem 2026

  • CVE-2026-15048
    30İzleyin

    GeekyBot < 1.2.8 - Unauthenticated Sensitive Information Exposure via Chat History

    YüksekCVSS 7,5İstismar yokEPSS %0

    unknown · geeky bot31 Tem 2026

  • CVE-2026-15258
    32İzleyin

    Product Feed Manager for WooCommerce < 7.6.1 - Contributor+ SQL Injection via Feed Filter

    YüksekCVSS 8,1İstismar yokEPSS %0

    unknown · product feed manager for woocommerce31 Tem 2026

  • CVE-2026-16236
    35İzleyin

    Realtyna Organic IDX plugin + WPL Real Estate <= 5.3.0 - Authenticated (Subscriber+) Arbitrary File Upload

    YüksekCVSS 8,8İstismar yokEPSS %1

    realtyna · realtyna organic idx plugin + wpl real estate31 Tem 2026

  • CVE-2026-16105
    19İzleyin

    Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints

    OrtaCVSS 4,9İstismar yokEPSS %0

    redhat · build of keycloak31 Tem 2026

  • CVE-2026-18214
    32İzleyin

    Keycloak-services: keycloak-services: google external access-token exchange bypasses hosted-domain restriction

    YüksekCVSS 8,1İstismar yokEPSS %0

    redhat · build of keycloak31 Tem 2026

  • CVE-2026-18215
    32İzleyin

    Keycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenant

    YüksekCVSS 8,1İstismar yokEPSS %0

    redhat · build of keycloak31 Tem 2026

  • CVE-2026-65309
    30İzleyin

    Storage of passwords in a reversible format

    YüksekCVSS 7,5İstismar yokEPSS %0

    andritz · hipase-25031 Tem 2026

  • CVE-2026-43829
    36İzleyin

    A stack-based buffer overflow vulnerability in the password functionality could allow an unauthenticated attacker to achieve code execution

    KritikCVSS 9,2İstismar yokEPSS %0

    tbc · tbc31 Tem 2026

  • CVE-2026-43830
    35İzleyin

    A command injection vulnerability in the firmware upgrade file verification process could allow an attacker to execute arbitrary commands.

    YüksekCVSS 8,6İstismar yokEPSS %2

    tbc · tbc31 Tem 2026

  • CVE-2026-43831
    36İzleyin

    A stack-based buffer overflow vulnerability in the log message functionality could allow an unauthenticated attacker to achieve code executi

    KritikCVSS 9,2İstismar yokEPSS %0

    tbc · tbc31 Tem 2026

  • CVE-2026-43832
    36İzleyin

    A stack-based buffer overflow vulnerability in the Cookie parsing methods could allow an unauthenticated attacker to achieve code execution

    KritikCVSS 9,2İstismar yokEPSS %0

    tbc · tbc31 Tem 2026

  • CVE-2026-43833
    30İzleyin

    A stack-based buffer overflow vulnerability in the upload functionality could allow an authenticated attacker to achieve code execution.

    YüksekCVSS 7,5İstismar yokEPSS %0

    tbc · tbc31 Tem 2026

  • CVE-2026-65310
    30İzleyin

    Missing authentication and permissive CORS policy

    YüksekCVSS 7,5İstismar yokEPSS %0

    andritz · hipase-25031 Tem 2026

  • CVE-2026-65313
    32İzleyin

    Use of hard-coded VNC credentials in the engineering-workstation provisioning

    YüksekCVSS 8,1İstismar yokEPSS %0

    andritz · hipase-25031 Tem 2026

  • CVE-2026-56670
    32İzleyin

    ComfyUI: Stored XSS via SVG file upload on the /view endpoint

    YüksekCVSS 8,2İstismar yokEPSS %0

    comfy-org · comfyui31 Tem 2026

  • CVE-2026-56671
    30İzleyin

    ComfyUI: Path traversal in /experiment/models/preview allows arbitrary image file read

    YüksekCVSS 7,5İstismar yokEPSS %0

    comfy-org · comfyui31 Tem 2026

  • CVE-2026-56672
    32İzleyin

    ComfyUI: Stored XSS via /userdata/{file} due to Missing Content-Type Sanitization

    YüksekCVSS 8,2İstismar yokEPSS %0

    comfy-org · comfyui31 Tem 2026

  • CVE-2026-56673
    30İzleyin

    ComfyUI: Path traversal in LoadImage via the /prompt API allows arbitrary file existence probing and image exfiltration

    YüksekCVSS 7,5İstismar yokEPSS %0

    comfy-org · comfyui31 Tem 2026

  • CVE-2026-18452
    40Planlayın

    Rich Source｜DMS+ (Non-Mobile) - Use of Hard-coded Credentials

    KritikCVSS 10,0İstismar yokEPSS %0

    rich source · dms+ (non-mobile)31 Tem 2026

  • CVE-2026-16843
    28İzleyin

    Some Hikvision Networking Products are vulnerable to authenticated command execution due to insufficient input validation.

    YüksekCVSS 7,2İstismar yokEPSS %0

    hikvision · ds-3wap521-si31 Tem 2026

  • CVE-2026-10079
    34İzleyin

    Stackrox: stackrox: deploy-time policy enforcement and visibility bypass via label injection

    YüksekCVSS 8,5İstismar yokEPSS %0

    red hat · red hat advanced cluster security 431 Tem 2026

  • CVE-2026-11770
    30İzleyin

    389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check

    YüksekCVSS 7,5İstismar yokEPSS %0

    redhat · directory server31 Tem 2026

  • CVE-2026-15722
    30İzleyin

    389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing

    YüksekCVSS 7,5İstismar yokEPSS %0

    redhat · directory server31 Tem 2026

  • CVE-2026-18446
    30İzleyin

    fast-uri vulnerable to host confusion via backslash authority introducer

    YüksekCVSS 7,5İstismar yokEPSS %0

    openjsf · fast-uri31 Tem 2026

  • CVE-2026-62391
    32İzleyin

    Apache Kyuubi: kyuubi.session.local.dir.allow.list bypass via unprefixed Spark file-conf aliases

    YüksekCVSS 8,1İstismar yokEPSS %0

    apache · kyuubi31 Tem 2026

  • CVE-2025-67649
    37İzleyin

    Unauthenticated SQL Injection in PHP Jabbers - Car Rental Script script

    KritikCVSS 9,3İstismar yokEPSS %0

    php jabbers · car rental script31 Tem 2026

  • CVE-2025-67650
    34İzleyin

    Authenticated SQL Injection in PHP Jabbers scripts

    YüksekCVSS 8,6İstismar yokEPSS %0

    php jabbers · appointment scheduler31 Tem 2026

  • CVE-2026-46593
    34İzleyin

    Authenticated SQL Injection in PHP Poll Script

    YüksekCVSS 8,6İstismar yokEPSS %0

    php jabbers · php poll script31 Tem 2026

  • CVE-2026-18141
    32İzleyin

    Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header

    YüksekCVSS 8,2İstismar yokEPSS %0

    red hat · red hat ansible automation platform 2.6 for rhel 931 Tem 2026

  • CVE-2026-58048
    37İzleyin

    Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.

    KritikCVSS 9,4Kavram kanıtıEPSS %0

    webpros · cpanel31 Tem 2026

  • CVE-2026-67822
    39İzleyin

    Tenda W6-S 1.0.0.4(510) contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint.

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    31 Tem 2026

  • CVE-2026-17561
    39İzleyin

    Unauthenticated RCE in Innotim Software's Logsign SIEM

    KritikCVSS 9,8İstismar yokEPSS %0

    innotim software, telecommunications and consulting trade ltd. co. · logsign siem31 Tem 2026

  • CVE-2026-18358
    30İzleyin

    Gnome-remote-desktop: gnome-remote-desktop system-mode rdp server missing connection throttling allows unauthenticated denial of service

    YüksekCVSS 7,5İstismar yokEPSS %0

    gnome · gnome-remote-desktop31 Tem 2026

  • CVE-2026-10685
    30İzleyin

    Use-after-free of GATT subscribe params in Bluetooth host CCC-write response handler

    YüksekCVSS 7,6İstismar yokEPSS %0

    zephyrproject · zephyr31 Tem 2026

  • CVE-2026-53500
    32İzleyin

    Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

    YüksekCVSS 8,2İstismar yokEPSS %0

    thumbor · thumbor31 Tem 2026

  • CVE-2026-53501
    32İzleyin

    Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature

    YüksekCVSS 8,2İstismar yokEPSS %0

    thumbor · thumbor31 Tem 2026

  • CVE-2026-53502
    34İzleyin

    Thumbor has path traversal via post-validation URL decoding bypass in file_loader

    YüksekCVSS 8,7İstismar yokEPSS %0

    thumbor · thumbor31 Tem 2026

  • CVE-2026-53503
    30İzleyin

    Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

    YüksekCVSS 7,5İstismar yokEPSS %0

    thumbor · thumbor31 Tem 2026

  • CVE-2026-53504
    30İzleyin

    Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter

    YüksekCVSS 7,5İstismar yokEPSS %0

    thumbor · thumbor31 Tem 2026

  • CVE-2026-53505
    30İzleyin

    Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS

    YüksekCVSS 7,5İstismar yokEPSS %0

    thumbor · thumbor31 Tem 2026

  • GHSA-p7w7-4929-vpj5
    30İzleyin

    `@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation

    YüksekCVSS 7,5İstismar yok

    npm · @dynatrace-oss/dynatrace-mcp-server31 Tem 2026

  • CVE-2026-62959
    32İzleyin

    Coturn: Pre-authentication heap memory disclosure in ACME redirect (`try_acme_redirect`)

    YüksekCVSS 8,2İstismar yokEPSS %0

    coturn · coturn31 Tem 2026

  • CVE-2026-10686
    30İzleyin

    Missing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routers

    YüksekCVSS 7,5İstismar yokEPSS %0

    zephyrproject · zephyr31 Tem 2026

  • CVE-2026-16503
    36İzleyin

    VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities

    KritikCVSS 9,1İstismar yokEPSS %0

    vps.org · supabase template31 Tem 2026

  • CVE-2026-16504
    39İzleyin

    VPS.org one-click Zulip template deployment instance contains multiple vulnerabilities

    KritikCVSS 9,8İstismar yokEPSS %0

    vps.org · zulip template31 Tem 2026

  • CVE-2026-17346
    34İzleyin

    pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044)

    YüksekCVSS 8,7İstismar yokEPSS %0

    pgadmin · pgadmin 431 Tem 2026

  • CVE-2026-17347
    30İzleyin

    pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution

    YüksekCVSS 7,7İstismar yokEPSS %0

    pgadmin · pgadmin 431 Tem 2026

  • CVE-2026-17349
    37İzleyin

    pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner

    KritikCVSS 9,3İstismar yokEPSS %0

    pgadmin · pgadmin 431 Tem 2026

  • CVE-2026-17351
    37İzleyin

    pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045)

    KritikCVSS 9,4Kavram kanıtıEPSS %0

    pgadmin · pgadmin 431 Tem 2026

  • CVE-2026-17566
    37İzleyin

    pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)

    KritikCVSS 9,4Kavram kanıtıEPSS %0

    pgadmin · pgadmin 431 Tem 2026

  • CVE-2026-67607
    32İzleyin

    LightFTP 2.3.1 Race Condition DoS via worker_thread_cleanup

    YüksekCVSS 8,2İstismar yokEPSS %0

    hfiref0x · lightftp31 Tem 2026

  • GHSA-xh95-f55m-82fw
    30İzleyin

    Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)

    YüksekCVSS 7,5İstismar yok

    31 Tem 2026

  • GHSA-6hm5-jgcp-p838
    30İzleyin

    Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)

    YüksekCVSS 7,5İstismar yok

    31 Tem 2026

  • GHSA-fg7f-2386-8897
    30İzleyin

    Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex

    YüksekCVSS 7,5İstismar yok

    31 Tem 2026

  • GHSA-qvv7-cg9c-w4x3
    34İzleyin

    Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode

    YüksekCVSS 8,6İstismar yok

    31 Tem 2026

  • CVE-2026-52855
    39İzleyin

    Wings exposes node configuration secrets through egg configuration-file templating

    KritikCVSS 9,9İstismar yokEPSS %0

    pterodactyl · wings31 Tem 2026

  • CVE-2026-52856
    30İzleyin

    Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    pterodactyl · wings31 Tem 2026

  • CVE-2026-50986
    35İzleyin

    PrestaShop module, totadministrativemandate <1.8.1 is vulnerable to Cross Site Request Forgery (CSRF).

    YüksekCVSS 8,8İstismar yokEPSS %0

    31 Tem 2026

  • CVE-2026-65981
    28İzleyin

    Coturn: MOBILITY-TICKET session-resume authorization bypass allows cross-user TURN allocation takeover

    YüksekCVSS 7,1İstismar yokEPSS %0

    coturn · coturn31 Tem 2026

  • CVE-2026-51953
    29İzleyin

    An issue in FeehiCMS v.2.1.1 allows an attacker to escalate privileges via the Session management module, authentication logic, logout handl

    YüksekCVSS 7,4İstismar yokEPSS %0

    31 Tem 2026

  • CVE-2026-52134
    39İzleyin

    An issue in the parseGoosePayload() function (/goose/goose_receiver.c) of libiec61850 v1.6 allows attackers to bypass authentication via a c

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    31 Tem 2026

  • CVE-2026-54725
    38İzleyin

    vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via To

    KritikCVSS 9,6İstismar yokEPSS %0

    bank-vaults · vault-secrets-webhook31 Tem 2026

  • CVE-2026-54729
    34İzleyin

    dssrf: any users using 1.1.1.1 DNS is impacted by SSRF

    YüksekCVSS 8,7İstismar yokEPSS %0

    hackingrepo · dssrf-js31 Tem 2026

  • CVE-2026-54737
    29İzleyin

    @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging

    YüksekCVSS 7,3İstismar yokEPSS %0

    phun-ky · defaults-deep31 Tem 2026

  • CVE-2026-55100
    34İzleyin

    hashi-vault-js has a path traversal and query parameter injection

    YüksekCVSS 8,7İstismar yokEPSS %0

    kyndryl-open-source · hashi-vault-js31 Tem 2026

  • CVE-2026-38711
    40Planlayın

    TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2

    KritikCVSS 9,8İstismar yokEPSS %2

    31 Tem 2026

  • CVE-2026-53510
    32İzleyin

    Savon::Model evaluates WSDL operation names as Ruby source

    YüksekCVSS 8,1İstismar yokEPSS %0

    savonrb · savon31 Tem 2026

  • CVE-2026-53599
    30İzleyin

    Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers

    YüksekCVSS 7,5İstismar yokEPSS %0

    redaxo · core31 Tem 2026

  • CVE-2026-62999
    30İzleyin

    Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)

    YüksekCVSS 7,5İstismar yokEPSS %0

    copier-org · copier31 Tem 2026

  • CVE-2025-69946
    39İzleyin

    SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters district_id , division_id

    KritikCVSS 9,8İstismar yokEPSS %0

    31 Tem 2026

  • CVE-2025-69948
    39İzleyin

    SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/delete_group.php?id=1.

    KritikCVSS 9,8İstismar yokEPSS %0

    31 Tem 2026

  • CVE-2026-38708
    40Planlayın

    TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2

    KritikCVSS 9,8İstismar yokEPSS %2

    31 Tem 2026

  • CVE-2026-38710
    29İzleyin

    TR1200 v2.4.15 and TR3000 v2.4.21 were discovered to contain a command injection vulnerability in the system.setclock interface.

    YüksekCVSS 7,2İstismar yokEPSS %2

    31 Tem 2026

  • CVE-2026-38713
    40Planlayın

    TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2

    KritikCVSS 9,8İstismar yokEPSS %2

    31 Tem 2026

  • CVE-2026-51785
    39İzleyin

    An issue in Hugo Leisink Hiawatha v.12.1 and before allows a remote attacker to execute arbitrary code via a crafted request

    KritikCVSS 9,8İstismar yokEPSS %1

    31 Tem 2026

  • CVE-2026-68770
    37İzleyin

    sentence-transformers Arbitrary Code Execution on Local Model Load Despite trust_remote_code=False

    KritikCVSS 9,3İstismar yokEPSS %0

    hugging face · sentence-transformers31 Tem 2026

  • CVE-2026-68771
    37İzleyin

    ComfyUI 0.23.0 Unauthenticated RCE via LoadTrainingDataset Pickle Deserialization

    KritikCVSS 9,3Kavram kanıtıEPSS %1

    comfy-org · comfyui31 Tem 2026

  • CVE-2026-15006
    30İzleyin

    Bit integrations <= 2.9.0 - Unauthenticated Arbitrary File Read via Optional CF7 File Field

    YüksekCVSS 7,5İstismar yokEPSS %1

    bitpressadmin · bit integrations – form integration, webhook, spreadsheets, crm, lms & email automation31 Tem 2026

  • CVE-2026-15414
    35İzleyin

    Subscriptions for WooCommerce <= 2.0.0 - Authenticated (Contributor+) Privilege Escalation via '_wps_plan_user_role' Membership Plan Meta

    YüksekCVSS 8,8İstismar yokEPSS %0

    wpswings · subscriptions for woocommerce31 Tem 2026