İçeriğe atla
Noroxi

Yayın tarihine göre

Temmuz 2026: sömürülen ve yeni ciddi CVE kayıtları

1.051 kayıt · 21 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 3 / 11

  • CVE-2026-13585
    32İzleyin

    Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Cont

    YüksekCVSS 8,2Kavram kanıtıEPSS %0

    asus · system control interface v314 Tem 2026

  • CVE-2026-15583
    34İzleyin

    SSRF (confused deputy) in Grafana MCP Server via X-Grafana-URL header

    YüksekCVSS 8,6Kavram kanıtıEPSS %0

    grafana · grafana mcp server15 Tem 2026

  • CVE-2026-57821
    32İzleyin

    Apache Fineract: Office list: SQL Injection via Subquery in orderBy

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    apache · fineract15 Tem 2026

  • CVE-2026-42533
    36İzleyin

    NGINX Map directive and Regex matching vulnerability

    KritikCVSS 9,2Kavram kanıtıEPSS %0

    f5 · nginx gateway fabric15 Tem 2026

  • CVE-2026-56434
    33İzleyin

    NGINX ngx_http_ssi_module vulnerability

    YüksekCVSS 8,3İstismar yokEPSS %0

    f5 · nginx gateway fabric15 Tem 2026

  • CVE-2026-45805
    35İzleyin

    Penpot: MCP REPL server binds to 0.0.0.0 with unauthenticated /execute endpoint — RCE

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    penpot · penpot15 Tem 2026

  • CVE-2026-45806
    30İzleyin

    Penpot: Authenticated SSRF in remote image import via create-file-media-object-from-url

    YüksekCVSS 7,7Kavram kanıtıEPSS %0

    penpot · penpot15 Tem 2026

  • CVE-2026-61430
    33İzleyin

    PraisonAI before 1.6.78 DNS Rebinding SSRF via web_crawl

    YüksekCVSS 8,4İstismar yokEPSS %0

    mervinpraison · praisonai15 Tem 2026

  • CVE-2026-43637
    35İzleyin

    Cornac < 2.6.0 Path Traversal via _extract_archive() in download.py

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    preferredai · cornac15 Tem 2026

  • CVE-2026-61736
    37İzleyin

    LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests

    KritikCVSS 9,3Kavram kanıtıEPSS %1

    hkuds · lightrag15 Tem 2026

  • CVE-2026-52887
    40Planlayın

    NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE

    KritikCVSS 10,0Kavram kanıtıEPSS %0

    nocobase · nocobase15 Tem 2026

  • CVE-2026-14960
    39İzleyin

    Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interface.

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    pegatron corp. · tdelo64.sys15 Tem 2026

  • CVE-2026-26718
    36İzleyin

    A Cross-Site Request Forgery (CSRF) vulnerability exists in the xxl-job-admin web application v.3.0.0 that allows an attacker to perform una

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    15 Tem 2026

  • CVE-2026-26719
    24İzleyin

    Cross Site Scripting vulnerability in xxl-job-admin v.3.0.0 allows a remote attacker to execute arbitrary code via a crafted HTTP GET reques

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    15 Tem 2026

  • CVE-2026-30623
    40Planlayın

    LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality.

    KritikCVSS 9,8Kavram kanıtıEPSS %4

    15 Tem 2026

  • CVE-2026-46339
    41Planlayın

    9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes

    KritikCVSS 10,0Kavram kanıtıEPSS %2

    decolua · 9router15 Tem 2026

  • CVE-2026-49352
    39İzleyin

    9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    decolua · 9router15 Tem 2026

  • CVE-2026-36590
    30İzleyin

    An issue in EMQ NanoMQ v.0.24.9 allows a remote attacker to cause a denial of service via the nni_qos_db_set function in broker_tcp.c compon

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    emqx · nanomq15 Tem 2026

  • CVE-2026-15013
    40Planlayın

    SAML Single Sign On <= 5.4.3 - Unauthenticated Authentication Bypass via 'SAMLResponse' Parameter Signature Algorithm Confusion

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    cyberlord92 · saml single sign on – sso login16 Tem 2026

  • CVE-2026-12684
    26İzleyin

    Customer Reviews for WooCommerce < 5.113.0 - Unauthenticated Arbitrary Media Upload via cr_upload_media

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    unknown · customer reviews for woocommerce16 Tem 2026

  • CVE-2026-15925
    36İzleyin

    Improper TLS Hostname Verification in Snowflake Connector for Python

    KritikCVSS 9,2İstismar yokEPSS %0

    snowflake · snowflake connector for python16 Tem 2026

  • CVE-2026-45695
    39İzleyin

    Kopia: Unauthenticated RCE via SSH ProxyCommand Injection when --insecure --without-password is used

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    kopia · kopia16 Tem 2026

  • CVE-2026-44595
    17İzleyin

    Yamcs: Unauthorized user enumeration via IAM API endpoints

    OrtaCVSS 4,3Kavram kanıtıEPSS %1

    spaceapplications · yamcs16 Tem 2026

  • CVE-2026-44596
    40Planlayın

    Yamcs: No Rate Limiting on Authentication Endpoint

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    spaceapplications · yamcs16 Tem 2026

  • CVE-2021-27137
    63Bu hafta

    An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724.

    YüksekCVSS 8,1KEVSilahlaştırılmışEPSS %3

    dd-wrt · dd-wrt16 Tem 2026

  • CVE-2026-47729
    26İzleyin

    Squid: Memory disclosure in FTP gateway

    OrtaCVSS 6,5Kavram kanıtıEPSS %1

    squid-cache · squid16 Tem 2026

  • CVE-2026-36425
    26İzleyin

    An issue in OPSWAT AppRemover Driver (ardrv.sys) v2017.10.02.1551 and earlier in IOCTL handler 0x2420031.

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    16 Tem 2026

  • CVE-2026-44177
    36İzleyin

    Kirby: Pre-authentication path traversal and PHP file inclusion during user lookup

    YüksekCVSS 8,8Kavram kanıtıEPSS %1

    getkirby · kirby16 Tem 2026

  • CVE-2026-15094
    24İzleyin

    WP Hotel Booking <= 2.3.2 - Reflected Cross-Site Scripting via 'check_in_date' Parameter

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    thimpress · wp hotel booking17 Tem 2026

  • CVE-2026-62201
    19İzleyin

    OpenClaw < 2026.6.6 Network Policy Bypass via exec-server

    OrtaCVSS 4,9Kavram kanıtıEPSS %0

    openclaw · openclaw17 Tem 2026

  • CVE-2026-62216
    9İzleyin

    OpenClaw 2026.4.20 < 2026.5.28 Policy Bypass via Media Upload

    DüşükCVSS 2,3İstismar yokEPSS %0

    openclaw · openclaw17 Tem 2026

  • CVE-2026-62227
    19İzleyin

    OpenClaw 2026.4.14 < 2026.5.26 SSRF via Browser Snapshot

    OrtaCVSS 4,9İstismar yokEPSS %0

    openclaw · openclaw17 Tem 2026

  • CVE-2026-62229
    30İzleyin

    OpenClaw < 2026.5.18 Authorization Bypass via Glob Matching

    YüksekCVSS 7,7İstismar yokEPSS %0

    openclaw · openclaw17 Tem 2026

  • CVE-2026-11961
    32İzleyin

    User Registration & Membership < 5.2.3 - Unauthenticated Privilege Escalation via Unbound members_data Membership ID

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    unknown · user registration & membership17 Tem 2026

  • CVE-2026-14871
    28İzleyin

    osTicket v1.18.3 - v1.17.7 - BOLA/IDOR in ticket field viewing allows cross-department data disclosure

    YüksekCVSS 7,1Kavram kanıtıEPSS %0

    osticket · osticket17 Tem 2026

  • CVE-2025-60357
    32İzleyin

    AhnLab EPP Management v1.0.14.32-6249 was discovered to contain a NoSQL injection vulnerability via the eventlog/agentEvent/list endpoint.

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    ahnlab · epp management17 Tem 2026

  • CVE-2026-51833
    30İzleyin

    Xenforo 2.3.8 is vulnerable to SSRF.

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    17 Tem 2026

  • CVE-2026-9586
    73Bu hafta

    Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB

    KritikCVSS 9,3KEVSilahlaştırılmışEPSS %18

    sangoma · switchvox17 Tem 2026

  • CVE-2026-9198
    78Bu hafta

    Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %28

    langflow · langflow17 Tem 2026

  • CVE-2026-9103
    40Planlayın

    Unauthenticated Superuser Token Issuance via Auto-Login Endpoint

    KritikCVSS 9,8Kavram kanıtıEPSS %3

    langflow · langflow17 Tem 2026

  • CVE-2026-36669
    39İzleyin

    An unauthenticated arbitrary file upload vulnerability in ck_upload_handler.php in Feng Office 3.11.13.11 allows remote attackers to upload

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    17 Tem 2026

  • CVE-2026-46420
    40Planlayın

    setup-php: Command Injection in Repository-Derived PHP Version Resolution

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    shivammathur · setup php17 Tem 2026

  • CVE-2026-52199
    36İzleyin

    An issue in Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the sbin/adbd component

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    17 Tem 2026

  • CVE-2026-60137
    60Bu hafta

    WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query

    OrtaCVSS 5,9KEVSilahlaştırılmışEPSS %5

    wordpress · wordpress17 Tem 2026

  • CVE-2026-63030
    72Bu hafta

    WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution

    KritikCVSS 9,8KEVSilahlaştırılmışEPSS %10

    wordpress · wordpress17 Tem 2026

  • CVE-2026-9147
    34İzleyin

    uproot 5.7.4 and prior Code Injection via TStreamerInfo Metadata

    YüksekCVSS 8,5Kavram kanıtıEPSS %0

    scikit-hep · uproot18 Tem 2026

  • CVE-2026-16219
    8İzleyin

    Croogo CMS Admin File Manager FileManager.php isEditable path traversal

    DüşükCVSS 2,1Kavram kanıtıEPSS %0

    croogo · cms19 Tem 2026

  • CVE-2026-63828
    33İzleyin

    apparmor: mediate the implicit connect of TCP fast open sendmsg

    YüksekCVSS 8,4Kavram kanıtıEPSS %0

    linux · linux19 Tem 2026

  • CVE-2026-11349
    34İzleyin

    Modern Events Calendar (Lite & Pro) < 7.34.0 - Unauthenticated SQL Injection via mec_list_load_more

    YüksekCVSS 8,6Kavram kanıtıEPSS %0

    unknown · modern event calendar pro20 Tem 2026

  • CVE-2026-12898
    26İzleyin

    All-in-One WP Migration and Backup < 7.106 - Unauthenticated Arbitrary-Location Log File Write via Path Traversal

    OrtaCVSS 6,5Kavram kanıtıEPSS %1

    unknown · all-in-one wp migration and backup20 Tem 2026

  • CVE-2026-13147
    36İzleyin

    Kirki < 6.0.12 - Unauthenticated Server-Side Request Forgery via kirki_get_apis

    KritikCVSS 9,1Kavram kanıtıEPSS %1

    unknown · kirki20 Tem 2026

  • CVE-2026-13156
    21İzleyin

    MailerSend - Official SMTP Integration < 1.0.8 - Settings Deletion and Plugin Deactivation via CSRF

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    unknown · mailersend20 Tem 2026

  • CVE-2026-9833
    28İzleyin

    Tag Groups < 2.2.0 - Reflected XSS via 'tag_groups_task' Parameter

    YüksekCVSS 7,1Kavram kanıtıEPSS %0

    unknown · tag groups is the advanced way to display your taxonomy terms20 Tem 2026

  • CVE-2026-63090
    34İzleyin

    ProFTPD mod_sftp Heap Buffer Overflow via SFTP Packet Reassembly

    YüksekCVSS 8,7İstismar yokEPSS %0

    proftpd · proftpd20 Tem 2026

  • CVE-2026-12080
    29İzleyin

    Qemu-kvm: qemu-guest-agent: local privilege escalation via symlink attack in guest-ssh-add-authorized-keys

    YüksekCVSS 7,3Kavram kanıtıEPSS %0

    red hat · red hat enterprise linux 1020 Tem 2026

  • CVE-2026-62183
    39İzleyin

    Apache Syncope: User self-service privilege escalation

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    apache · syncope20 Tem 2026

  • CVE-2026-63071
    39İzleyin

    Apache Syncope: RCE via Groovy Sandbox bypass

    KritikCVSS 9,8İstismar yokEPSS %0

    apache · syncope20 Tem 2026

  • CVE-2026-51031
    30İzleyin

    FlareSolverr before version 3.4.7 contains a server-side request forgery (SSRF) vulnerability in the /v1 API endpoint.

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    20 Tem 2026

  • CVE-2026-61424
    40Planlayın

    Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2

    KritikCVSS 10,0Kavram kanıtıEPSS %0

    dj-extensions.com · dj-classifieds extension for joomla20 Tem 2026

  • CVE-2026-63766
    38İzleyin

    GPT-SoVITS 20250606v2pro OS Command Injection via webui.py

    KritikCVSS 9,3Kavram kanıtıEPSS %2

    rvc-boss · gpt-sovits20 Tem 2026

  • CVE-2026-53595
    38İzleyin

    FreeScout vulnerable to anonymous account takeover via /user-setup empty invite_hash on MySQL

    KritikCVSS 9,4Kavram kanıtıEPSS %1

    freescout-help-desk · freescout20 Tem 2026

  • CVE-2026-51385
    27İzleyin

    An issue in safishamsi Open-Source GRAPHIFY v.0.3.2 through v0.4.29 allows a remote attacker to execute arbitrary code via the validate_url,

    OrtaCVSS 6,9Kavram kanıtıEPSS %0

    20 Tem 2026

  • CVE-2026-52656
    39İzleyin

    An issue in SJCAM AllWinner Tech products SJ4000-Air V1.4C and before and Whitelabel based v.1.4C and before allows an attacker to execute a

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    20 Tem 2026

  • CVE-2026-16445
    31İzleyin

    Dracut: dracut: root code execution via dhcp options command injection in networkmanager initrd module

    YüksekCVSS 7,5İstismar yokEPSS %3

    red hat · red hat enterprise linux 821 Tem 2026

  • CVE-2026-8933
    31İzleyin

    snap-confine Local Privilege Escalation via Capabilities Misconfiguration or Flaw in Execution Environment Setup

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    canonical · ubuntu 26.04 lts21 Tem 2026

  • CVE-2026-65008
    38İzleyin

    Grav before 2.0.7 Remote Code Execution via Blueprint dynamicData

    KritikCVSS 9,3Kavram kanıtıEPSS %2

    getgrav · grav21 Tem 2026

  • CVE-2025-66390
    39İzleyin

    In Microsoft Azure API Management through 2025-10-17, when self-service signup (username/password Basic Authentication) is enabled in Tenant

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    21 Tem 2026

  • CVE-2026-64824
    37İzleyin

    Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore

    KritikCVSS 9,3Kavram kanıtıEPSS %0

    home-assistant · home assistant core21 Tem 2026

  • CVE-2026-63358
    33İzleyin

    FileGator privilege escalation

    YüksekCVSS 8,4Kavram kanıtıEPSS %0

    filegator · filegator21 Tem 2026

  • CVE-2026-15789
    27İzleyin

    Malicious client can bypass destination directory validation on local sources upload

    OrtaCVSS 6,9İstismar yokEPSS %0

    mobyproject · buildkit21 Tem 2026

  • CVE-2026-62574
    31İzleyin

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Install

    YüksekCVSS 7,8İstismar yokEPSS %0

    oracle · jre21 Tem 2026

  • CVE-2026-56819
    30İzleyin

    Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    netty · netty21 Tem 2026

  • CVE-2026-56852
    30İzleyin

    Infinite loop on invalid input in golang.org/x/text

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    golang.org/x/text · golang.org/x/text/unicode/norm21 Tem 2026

  • CVE-2026-60206
    39İzleyin

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

    KritikCVSS 9,9Kavram kanıtıEPSS %0

    oracle · weblogic server21 Tem 2026

  • CVE-2026-60217
    40Planlayın

    Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core).

    KritikCVSS 10,0İstismar yokEPSS %0

    oracle · coherence21 Tem 2026

  • CVE-2026-60357
    14İzleyin

    Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Siebel Server Sync for Exchange).

    DüşükCVSS 3,7İstismar yokEPSS %0

    oracle · siebel crm21 Tem 2026

  • CVE-2026-2406
    26İzleyin

    IDOR in Universe Software's Online Registration and Workflow Management System

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    universe software computer marketing trade and industry inc. · online registration and workflow management system22 Tem 2026

  • CVE-2026-65591
    35İzleyin

    n8n before 1.123.64 Sanitizer Bypass Remote Code Execution

    YüksekCVSS 8,9Kavram kanıtıEPSS %0

    n8n · n8n22 Tem 2026

  • CVE-2026-65650
    17İzleyin

    Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload.

    OrtaCVSS 4,3Kavram kanıtıEPSS %0

    elgg · elgg22 Tem 2026

  • CVE-2026-13181
    32İzleyin

    RadAsyncUpload AsyncUploadTypeName Type Resolution Vulnerability in Telerik UI for ASP.NET AJAX

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    progress · telerik ui for asp.net ajax22 Tem 2026

  • CVE-2026-16232
    68Bu hafta

    Authentication Bypass in the SmartConsole Login Process Using an Application Token

    KritikCVSS 9,3KEVSilahlaştırılmışEPSS %3

    checkpoint · multi-domain security management22 Tem 2026

  • CVE-2026-2395
    39İzleyin

    SQLi in Xpoda Türkiye Informatics Technology's No Code Platform

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    xpoda türkiye informatics technology inc. · no code platform22 Tem 2026

  • CVE-2026-65013
    34İzleyin

    Onlook tRPC Insecure Direct Object Reference via multiple procedures

    YüksekCVSS 8,7Kavram kanıtıEPSS %0

    onlook · repo22 Tem 2026

  • CVE-2026-38763
    22İzleyin

    An issue in Unistal Systems Pvt.

    OrtaCVSS 5,5Kavram kanıtıEPSS %0

    22 Tem 2026

  • CVE-2026-38765
    31İzleyin

    An issue in Unistal Systems Pvt.

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    22 Tem 2026

  • CVE-2026-38766
    31İzleyin

    An issue in Unistal Systems Pvt.

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    22 Tem 2026

  • CVE-2026-13078
    25İzleyin

    Local File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader

    OrtaCVSS 6,3Kavram kanıtıEPSS %0

    mongodb · mongodb22 Tem 2026

  • CVE-2026-14282
    39İzleyin

    GoDAM <= 1.12.2 - Unauthenticated Arbitrary File Upload via WPForms File Upload Field

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    rtcamp · godam – organize wordpress media library & file manager with unlimited folders for images, videos & more23 Tem 2026

  • CVE-2026-15015
    40Planlayın

    MountDev AI MCP Connector for WordPress <= 1.6.1 - Unauthenticated Privilege Escalation via OAuth Authorization Endpoint

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    cascadiawebservices · mountdev ai mcp connector for wordpress23 Tem 2026

  • CVE-2026-64600
    31İzleyin

    xfs: resample the data fork mapping after cycling ILOCK

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    linux · linux kernel23 Tem 2026

  • CVE-2026-16723
    36İzleyin

    Remote Code Execution in fastjson 1.2.68–1.2.83

    KritikCVSS 9,0Kavram kanıtıEPSS %0

    alibaba · fastjson23 Tem 2026

  • CVE-2026-61946
    26İzleyin

    WordPress Easy Appointments plugin <= 3.12.27 - Insecure Direct Object References (IDOR) vulnerability

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    easy appointments · easy appointments23 Tem 2026

  • CVE-2026-65496
    17İzleyin

    WordPress Complianz plugin <= 7.5.0 - Server Side Request Forgery (SSRF) vulnerability

    OrtaCVSS 4,4İstismar yokEPSS %0

    complianz · complianz23 Tem 2026

  • CVE-2026-65510
    28İzleyin

    WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    pepro dev. group · peprodev ultimate invoice23 Tem 2026

  • CVE-2026-65540
    28İzleyin

    WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability

    YüksekCVSS 7,1Kavram kanıtıEPSS %0

    metin saraç · popup for cf7 with sweet alert23 Tem 2026

  • CVE-2026-47668
    41Planlayın

    DbGate: Unauthenticated Remote Code Execution via JSON Script Runner

    KritikCVSS 10,0Kavram kanıtıEPSS %3

    dbgate · dbgate23 Tem 2026

  • CVE-2026-65919
    35İzleyin

    Meshery < 1.0.57 Unauthenticated Arbitrary File Read via fileView and fileDownload

    YüksekCVSS 8,7Kavram kanıtıEPSS %2

    meshery · meshery23 Tem 2026

  • CVE-2026-47670
    38İzleyin

    DbGate Vulnerable to Authenticated Remote Code Execution via loadReader functionName code injection

    KritikCVSS 9,4Kavram kanıtıEPSS %1

    dbgate · dbgate23 Tem 2026

  • CVE-2026-65761
    37İzleyin

    Joomla Extension - joomshaper.com - Unauthenticated SQL injection in Easy Store extension 1.0.0-2.0.1

    KritikCVSS 9,3Kavram kanıtıEPSS %1

    joomshaper.com · easy store extension for joomla23 Tem 2026

  • CVE-2026-15981
    39İzleyin

    SAML Single Sign On <= 5.4.4 - Unauthenticated Authentication Bypass via SAMLResponse Parameter

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    cyberlord92 · saml single sign on – sso login23 Tem 2026