İçeriğe atla
Noroxi

Yayın tarihine göre

Temmuz 2026: sömürülen ve yeni ciddi CVE kayıtları

1.301 kayıt · 21 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 2 / 14

  • CVE-2026-44840
    30İzleyin

    Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    dgraph-io · dgraph8 Tem 2026

  • CVE-2026-58480
    37İzleyin

    Blocksy Companion Pro < 2.1.47 Unauthenticated File Upload via save_attachments

    KritikCVSS 9,2Kavram kanıtıEPSS %3

    creative themes · blocksy companion8 Tem 2026

  • CVE-2026-14361
    18İzleyin

    Consul-template is vulnerable to path redirection in writeToFile through symlink attack

    OrtaCVSS 4,7Kavram kanıtıEPSS %0

    hashicorp · tooling8 Tem 2026

  • CVE-2026-36027
    27İzleyin

    An issue in Code27 Companion Hub SQ3A.220705.003.A1 allows a physically proximate attacker to execute arbitrary code via the USB debugging (

    OrtaCVSS 6,8Kavram kanıtıEPSS %0

    8 Tem 2026

  • CVE-2026-59822
    65Bu hafta

    LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

    YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %0

    litellm · litellm8 Tem 2026

  • CVE-2026-58191
    24İzleyin

    Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    appium · appium\/base-driver8 Tem 2026

  • CVE-2026-60105
    30İzleyin

    Monsta FTP < 2.14.5 SSRF via IPv4-Mapped IPv6 Address Bypass

    YüksekCVSS 7,7Kavram kanıtıEPSS %1

    monsta limited of new zealand · monsta ftp8 Tem 2026

  • CVE-2026-31309
    39İzleyin

    Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0 allows an unauthenticated at

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    8 Tem 2026

  • CVE-2026-44024
    39İzleyin

    Fluentd: Remote Code Execution (RCE) via Arbitrary File Write in `${tag}` Placeholder

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    fluentd · fluentd8 Tem 2026

  • CVE-2026-52200
    39İzleyin

    An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax web management API

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    8 Tem 2026

  • CVE-2026-56291
    74Bu hafta

    Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1

    KritikCVSS 10,0KEVSilahlaştırılmışEPSS %14

    balbooa · forms9 Tem 2026

  • CVE-2026-56292
    36İzleyin

    Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1

    KritikCVSS 9,2Kavram kanıtıEPSS %1

    acymailing · acymailing9 Tem 2026

  • CVE-2026-59212
    21İzleyin

    Open WebUI: Model meta.knowledge read-only file access can be upgraded to file write/delete

    OrtaCVSS 5,4İstismar yokEPSS %0

    openwebui · open webui9 Tem 2026

  • CVE-2026-55420
    32İzleyin

    Discourse: Remote code execution via pdf uploads

    YüksekCVSS 8,1İstismar yokEPSS %0

    discourse · discourse9 Tem 2026

  • CVE-2026-59726
    41Planlayın

    Ruflo: Unauthenticated RCE in MCP bridge default docker-compose deployment

    KritikCVSS 10,0Kavram kanıtıEPSS %3

    ruvnet · ruflo9 Tem 2026

  • CVE-2026-59734
    35İzleyin

    Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    coollabsio · coolify9 Tem 2026

  • CVE-2026-59827
    36İzleyin

    Metabase: Unsafe Deserialization of H2 Query Results

    YüksekCVSS 8,8Kavram kanıtıEPSS %3

    metabase · metabase9 Tem 2026

  • CVE-2026-61343
    34İzleyin

    LibreBooking path traversal

    YüksekCVSS 8,6Kavram kanıtıEPSS %1

    librebooking · librebooking9 Tem 2026

  • CVE-2026-58123
    38İzleyin

    Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API

    KritikCVSS 9,3Kavram kanıtıEPSS %4

    nesquena · hermes-webui9 Tem 2026

  • CVE-2025-63579
    30İzleyin

    Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported.

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    9 Tem 2026

  • CVE-2026-50181
    28İzleyin

    Langroid: Path traversal in the file tools allows read/write outside configured current directory

    YüksekCVSS 7,1Kavram kanıtıEPSS %0

    langroid · langroid9 Tem 2026

  • CVE-2025-45422
    32İzleyin

    Incorrect access control in Proximus b-box v8c.725A allows authenticated attackers to bypass normal restrictions and make arbitrary changes

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    9 Tem 2026

  • CVE-2026-14894
    41Planlayın

    Super Forms <= 6.3.313 - Unauthenticated Arbitrary File Upload via 'data' Parameter (datauristring / value)

    KritikCVSS 9,8Kavram kanıtıEPSS %5

    webrehab · super forms – drag & drop form builder10 Tem 2026

  • CVE-2026-15282
    39İzleyin

    Instant Appointment <= 1.2 - Unauthenticated Arbitrary File Upload

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    tenteeglobal · instant appointment10 Tem 2026

  • CVE-2026-21045
    33İzleyin

    Out-of-bounds write in parsing TIFF format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote attackers to write

    YüksekCVSS 8,3Kavram kanıtıEPSS %0

    samsung mobile · samsung mobile devices10 Tem 2026

  • CVE-2026-21055
    34İzleyin

    Improper export of android application components in Bixby prior to version 4.0.70.8 allows local attackers to execute arbitrary commands wi

    YüksekCVSS 8,5Kavram kanıtıEPSS %0

    samsung mobile · bixby10 Tem 2026

  • CVE-2026-12400
    17İzleyin

    FlowForms <= 1.1.1 - Authenticated (Contributor+) Insecure Direct Object Reference to Arbitrary Form Modification via REST API '/flowforms/v1/forms/{id}' Endpoi

    OrtaCVSS 4,3Kavram kanıtıEPSS %0

    priyanshuchaudhary · flowforms – conversational form builder10 Tem 2026

  • CVE-2026-6440
    17İzleyin

    GoodMeet <= 1.1.8 - Cross-Site Request Forgery to Google Meet Credential Reset via 'goodmeet_reset_google_meet_credential'

    OrtaCVSS 4,3Kavram kanıtıEPSS %0

    sovlix · goodmeet – google meet integration for webinar, meeting & video conference10 Tem 2026

  • CVE-2026-13247
    25İzleyin

    Logo Slider <= 5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lgx_tooltip_position' Parameter

    OrtaCVSS 6,4Kavram kanıtıEPSS %0

    logichunt · logo slider wp – responsive logo carousel, logo gallery & logo showcase10 Tem 2026

  • CVE-2026-14461
    20İzleyin

    Out-of-bound read in mtr

    OrtaCVSS 5,1Kavram kanıtıEPSS %0

    bitwizard · mtr10 Tem 2026

  • CVE-2026-58225
    8İzleyin

    SQL injection via unescaped dollar-quote in Postgrex.Notifications reconnect replay causes notification denial of service

    DüşükCVSS 2,1Kavram kanıtıEPSS %0

    elixir-ecto · postgrex10 Tem 2026

  • CVE-2026-29519
    24İzleyin

    Lucee CFML Server Reflected XSS via URL Path Parsing

    OrtaCVSS 6,2Kavram kanıtıEPSS %0

    lucee · lucee10 Tem 2026

  • CVE-2026-51119
    36İzleyin

    An issue in Invixium IXM WEB v.2.3.85.25 allows an attacker to escalate privileges via the /SystemUsers/CreateAppUser components

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    10 Tem 2026

  • CVE-2026-55780
    9İzleyin

    NanaZip: Uncaught exception / unbounded allocation in NanaZip .NET single-file Extract() via unvalidated entry Size

    DüşükCVSS 2,4Kavram kanıtıEPSS %0

    m2team · nanazip10 Tem 2026

  • CVE-2026-55781
    9İzleyin

    NanaZip: Unbounded memory allocation (DoS) in NanaZip UFS parser via unvalidated fs_bsize/fs_fsize superblock fields

    DüşükCVSS 2,4Kavram kanıtıEPSS %0

    m2team · nanazip10 Tem 2026

  • CVE-2026-61459
    38İzleyin

    MCP Server Kubernetes < 3.9.0 Argument Injection via kubectl Structured Tools

    KritikCVSS 9,3Kavram kanıtıEPSS %2

    suyogs · mcp-server-kubernetes10 Tem 2026

  • CVE-2026-57850
    34İzleyin

    RustDesk Missing Session Scope Enforcement Allows Out-of-Scope Control Message Injection

    YüksekCVSS 8,7Kavram kanıtıEPSS %0

    rustdesk · rustdesk10 Tem 2026

  • CVE-2026-55229
    30İzleyin

    Gotenberg: SSRF via LibreOffice document processing

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    gotenberg · gotenberg10 Tem 2026

  • CVE-2026-57219
    35İzleyin

    RabbitMQ: Unauthenticated disclosure of OAuth client credentials via an HTTP API endpoint with certain less common OAuth 2 configurations

    YüksekCVSS 8,7Kavram kanıtıEPSS %2

    broadcom · rabbitmq server10 Tem 2026

  • CVE-2026-10768
    40Planlayın

    LocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-039

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    localgovdrupal · localgov workflows10 Tem 2026

  • CVE-2026-13233
    13İzleyin

    OpenAI Provider - Moderately critical - Server-side Request Forgery - SA-CONTRIB-2026-053

    DüşükCVSS 3,3Kavram kanıtıEPSS %0

    openai provider project · openai provider10 Tem 2026

  • CVE-2026-49844
    25İzleyin

    Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()

    OrtaCVSS 6,3Kavram kanıtıEPSS %0

    apache · log4j10 Tem 2026

  • CVE-2026-15096
    25İzleyin

    Themify Builder <= 7.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Module 'b_width_map' Field

    OrtaCVSS 6,4İstismar yokEPSS %0

    themifyme · themify builder11 Tem 2026

  • CVE-2026-3576
    60Bu hafta

    Planyo online reservation system <= 3.0 - Unauthenticated Server-Side Request Forgery via 'ulap_url' Parameter

    YüksekCVSS 7,2SilahlaştırılmışEPSS %8

    xtreeme · planyo online reservation system11 Tem 2026

  • CVE-2026-9282
    31İzleyin

    W3 Total Cache <= 2.9.4 - Unauthenticated Arbitrary File Read via 'f_array[]' Parameter

    YüksekCVSS 7,5Kavram kanıtıEPSS %2

    boldgrid · w3 total cache11 Tem 2026

  • CVE-2026-57827
    41Planlayın

    Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12

    KritikCVSS 10,0Kavram kanıtıEPSS %2

    rsjoomla · rsfiles\!11 Tem 2026

  • CVE-2026-61447
    41Planlayın

    PraisonAI before 1.6.78 Remote Code Execution via CodeAgent

    KritikCVSS 10,0Kavram kanıtıEPSS %2

    mervinpraison · praisonai11 Tem 2026

  • CVE-2026-61876
    37İzleyin

    LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting

    KritikCVSS 9,4Kavram kanıtıEPSS %1

    openwrt · luci12 Tem 2026

  • CVE-2026-15502
    21İzleyin

    AojiaoZero Antaris PayPal IPN Payment ipn.php _rewardPurchase sql injection

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    aojiaozero · antaris12 Tem 2026

  • CVE-2026-15520
    7İzleyin

    GNU LibreDWG R2004 Section Decompression decode.c decompress_R2004_section heap-based overflow

    DüşükCVSS 1,9İstismar yokEPSS %0

    gnu · libredwg12 Tem 2026

  • CVE-2026-57829
    34İzleyin

    Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate < 2.2.7

    YüksekCVSS 8,7Kavram kanıtıEPSS %0

    ollyo · helix ultimate13 Tem 2026

  • CVE-2026-57830
    35İzleyin

    Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    ollyo · helix ultimate13 Tem 2026

  • CVE-2026-57811
    40Planlayın

    WordPress Realtyna Organic IDX plugin plugin <= 5.2.0 - Remote Code Execution (RCE) vulnerability

    KritikCVSS 10,0Kavram kanıtıEPSS %0

    realtyna · realtyna organic idx plugin13 Tem 2026

  • CVE-2026-40468
    8İzleyin

    Heap buffer overflow in gawk

    DüşükCVSS 2,1İstismar yokEPSS %0

    fossies · gawk13 Tem 2026

  • CVE-2026-60121
    38İzleyin

    Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via ping.php

    KritikCVSS 9,3Kavram kanıtıEPSS %3

    vitec · flamingo13 Tem 2026

  • CVE-2026-53365
    22İzleyin

    vsock/virtio: fix zerocopy completion for multi-skb sends

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    linux · linux kernel13 Tem 2026

  • CVE-2026-61500
    37İzleyin

    Rejetto HFS < 3.2.1 Session Forgery via Predictable Signing Key

    KritikCVSS 9,3Kavram kanıtıEPSS %0

    rejetto · hfs13 Tem 2026

  • CVE-2026-6875
    38İzleyin

    Sandbox Escape in ServiceNow AI Platform

    KritikCVSS 9,5Kavram kanıtıEPSS %1

    servicenow · servicenow ai platform13 Tem 2026

  • CVE-2026-15598
    21İzleyin

    antv layout object.js setNestedValue prototype pollution

    OrtaCVSS 5,3Kavram kanıtıEPSS %0

    antv · layout13 Tem 2026

  • CVE-2026-59801
    38İzleyin

    9Router 0.4.41 - Unauthenticated API Exposure via /api/providers

    KritikCVSS 9,3Kavram kanıtıEPSS %2

    decolua · 9router13 Tem 2026

  • CVE-2026-12478
    19İzleyin

    Libsoup: incomplete fix for cve-2026-0716: out-of-bounds read in libsoup websocket frame processing (unmasked path)

    OrtaCVSS 4,8Kavram kanıtıEPSS %0

    red hat · red hat enterprise linux 1014 Tem 2026

  • CVE-2026-15718
    17İzleyin

    Invalid pointer in the JavaScript: WebAssembly component

    OrtaCVSS 4,3Kavram kanıtıEPSS %0

    mozilla · firefox14 Tem 2026

  • CVE-2026-12523
    30İzleyin

    Resource exhaustion in quiche HTTP/3 and QPACK layers

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    cloudflare · quiche14 Tem 2026

  • CVE-2026-34348
    26İzleyin

    Windows Event Logging Service Information Disclosure Vulnerability

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    microsoft · windows 10 180914 Tem 2026

  • CVE-2026-36214
    25İzleyin

    osTicket versions from 1.10 up to 1.17.7 and from 1.18.0 up to 1.18.3 are vulnerable to a stored XSS due to a vulnerable Bootstrap Tooltip c

    OrtaCVSS 6,4Kavram kanıtıEPSS %0

    osticket · osticket14 Tem 2026

  • CVE-2026-49176
    31İzleyin

    Windows WalletService Elevation of Privilege Vulnerability

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    microsoft · windows 10 160714 Tem 2026

  • CVE-2026-50338
    32İzleyin

    Azure Spring Apps Elevation of Privilege Vulnerability

    YüksekCVSS 8,2Kavram kanıtıEPSS %0

    microsoft · azure spring cloud14 Tem 2026

  • CVE-2026-50522
    70Bu hafta

    Microsoft SharePoint Remote Code Execution Vulnerability

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %3

    microsoft · sharepoint server14 Tem 2026

  • CVE-2026-54107
    28İzleyin

    Windows Win32k Elevation of Privilege Vulnerability

    YüksekCVSS 7,0Kavram kanıtıEPSS %0

    microsoft · windows 10 160714 Tem 2026

  • CVE-2026-54433
    40Planlayın

    In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message

    KritikCVSS 10,0Kavram kanıtıEPSS %0

    roundcube · webmail14 Tem 2026

  • CVE-2026-54992
    31İzleyin

    Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    microsoft · windows 10 160714 Tem 2026

  • CVE-2026-55006
    31İzleyin

    Microsoft Exchange Server Elevation of Privilege Vulnerability

    YüksekCVSS 7,8İstismar yokEPSS %0

    microsoft · exchange server14 Tem 2026

  • CVE-2026-56155
    61Bu hafta

    Active Directory Federation Services Elevation of Privilege Vulnerability

    YüksekCVSS 7,8KEVSilahlaştırılmışEPSS %0

    microsoft · windows 10 160714 Tem 2026

  • CVE-2026-56164
    69Bu hafta

    Microsoft SharePoint Server Elevation of Privilege Vulnerability

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %1

    microsoft · sharepoint server14 Tem 2026

  • CVE-2026-58635
    31İzleyin

    Windows Narrator Braille Elevation of Privilege Vulnerability

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    microsoft · windows 10 180914 Tem 2026

  • CVE-2026-58644
    74Bu hafta

    Microsoft SharePoint Remote Code Execution Vulnerability

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %15

    microsoft · sharepoint server14 Tem 2026

  • CVE-2026-59891
    38İzleyin

    Credential confusion in  @sigstore/oci  can leak registry credentials to an attacker-controlled registry

    KritikCVSS 9,6Kavram kanıtıEPSS %0

    sigstore · sigstore-js14 Tem 2026

  • CVE-2026-45067
    25İzleyin

    Symfony: Email Header / SMTP Command Injection via CRLF in Symfony\Component\Mime\Address

    OrtaCVSS 6,3Kavram kanıtıEPSS %0

    symfony · symfony14 Tem 2026

  • CVE-2026-50343
    31İzleyin

    Microsoft Install Service Elevation of Privilege Vulnerability

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    microsoft · windows 10 180914 Tem 2026

  • CVE-2026-50369
    35İzleyin

    Windows Remote Desktop Services Elevation of Privilege Vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    microsoft · windows 10 160714 Tem 2026

  • CVE-2026-50402
    31İzleyin

    NTFS Elevation of Privilege Vulnerability

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    microsoft · windows 10 160714 Tem 2026

  • CVE-2026-50416
    13İzleyin

    Win32k Information Disclosure Vulnerability

    DüşükCVSS 3,3Kavram kanıtıEPSS %0

    microsoft · windows 11 24h214 Tem 2026

  • CVE-2026-50444
    35İzleyin

    Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %0

    microsoft · windows 10 160714 Tem 2026

  • CVE-2026-50657
    22İzleyin

    Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    microsoft · defender for endpoint14 Tem 2026

  • CVE-2026-54121
    35İzleyin

    Active Directory Certificate Services Elevation of Privilege Vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    microsoft · windows 10 160714 Tem 2026

  • CVE-2026-55040
    87Hemen

    Microsoft SharePoint Server Security Feature Bypass Vulnerability

    KritikCVSS 9,1KEVSilahlaştırılmışEPSS %69

    microsoft · sharepoint server14 Tem 2026

  • CVE-2026-10672
    36İzleyin

    Unterminated URI buffer causes out-of-bounds read in LwM2M firmware pull (Package URI)

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    zephyrproject · zephyr14 Tem 2026

  • CVE-2026-47301
    35İzleyin

    Configuration Manager Elevation of Privilege Vulnerability

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    microsoft · configuration manager 250314 Tem 2026

  • CVE-2026-13001
    40Planlayın

    Podlove Podcast Publisher <= 4.5.1 - Unauthenticated Arbitrary File Upload via podlove_image_cache_url Parameter

    KritikCVSS 9,8Kavram kanıtıEPSS %3

    eteubert · podlove podcast publisher14 Tem 2026

  • CVE-2026-15409
    72Bu hafta

    A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface.

    KritikCVSS 10,0KEVSilahlaştırılmışEPSS %6

    sonicwall · sma6210 firmware14 Tem 2026

  • CVE-2026-15410
    62Bu hafta

    Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Man

    YüksekCVSS 7,2KEVSilahlaştırılmışEPSS %11

    sonicwall · sma6210 firmware14 Tem 2026

  • CVE-2026-45071
    34İzleyin

    Symfony: XXE (Local File Disclosure) in DomCrawler::addXmlContent() via validateOnParse = true

    YüksekCVSS 8,7Kavram kanıtıEPSS %0

    sensiolabs · symfony14 Tem 2026

  • CVE-2026-47423
    32İzleyin

    DOMPurify XSS via `selectedcontent` re-clone

    YüksekCVSS 8,2Kavram kanıtıEPSS %0

    cure53 · dompurify14 Tem 2026

  • CVE-2026-47429
    23İzleyin

    Vitest: Arbitrary file can be read and executed when Vitest UI server is listening

    OrtaCVSS 5,9Kavram kanıtıEPSS %0

    vitest.dev · vitest14 Tem 2026

  • CVE-2026-48356
    37İzleyin

    Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)

    KritikCVSS 9,3Kavram kanıtıEPSS %1

    adobe · commerce14 Tem 2026

  • CVE-2026-52100
    30İzleyin

    Cross Site Request Forgery vulnerability in andreimarcu linux-server v.1.0 through v.2.3.8 allows a remote attacker to execute arbitrary cod

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    14 Tem 2026

  • CVE-2026-13585
    32İzleyin

    Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Cont

    YüksekCVSS 8,2Kavram kanıtıEPSS %0

    asus · system control interface v314 Tem 2026

  • CVE-2026-15583
    34İzleyin

    SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header

    YüksekCVSS 8,6Kavram kanıtıEPSS %0

    grafana · grafana mcp server15 Tem 2026

  • CVE-2026-57821
    32İzleyin

    Apache Fineract: Office list: SQL Injection via Subquery in orderBy

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    apache · fineract15 Tem 2026

  • CVE-2026-61430
    33İzleyin

    PraisonAI before 1.6.78 DNS Rebinding SSRF via web_crawl

    YüksekCVSS 8,4İstismar yokEPSS %0

    mervinpraison · praisonai15 Tem 2026