İçeriğe atla
Noroxi

Yayın tarihine göre

Temmuz 2026: sömürülen ve yeni ciddi CVE kayıtları

1.296 kayıt · 21 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 8 / 13

  • CVE-2026-54621
    31İzleyin

    `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description

    YüksekCVSS 7,8İstismar yokEPSS %0

    koxudaxi · datamodel-code-generator28 Tem 2026

  • CVE-2026-54653
    35İzleyin

    `datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field

    YüksekCVSS 8,8İstismar yokEPSS %0

    koxudaxi · datamodel-code-generator28 Tem 2026

  • CVE-2026-54654
    31İzleyin

    `datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field

    YüksekCVSS 7,8İstismar yokEPSS %0

    koxudaxi · datamodel-code-generator28 Tem 2026

  • CVE-2026-54655
    31İzleyin

    `datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator

    YüksekCVSS 7,8İstismar yokEPSS %0

    koxudaxi · datamodel-code-generator28 Tem 2026

  • CVE-2026-54656
    31İzleyin

    `datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data

    YüksekCVSS 7,8İstismar yokEPSS %0

    koxudaxi · datamodel-code-generator28 Tem 2026

  • CVE-2026-54690
    32İzleyin

    datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)

    YüksekCVSS 8,2İstismar yokEPSS %0

    koxudaxi · datamodel-code-generator28 Tem 2026

  • CVE-2026-54691
    32İzleyin

    datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

    YüksekCVSS 8,2İstismar yokEPSS %0

    koxudaxi · datamodel-code-generator28 Tem 2026

  • CVE-2026-55389
    30İzleyin

    datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`

    YüksekCVSS 7,5İstismar yokEPSS %0

    koxudaxi · datamodel-code-generator28 Tem 2026

  • CVE-2026-55390
    30İzleyin

    Arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate

    YüksekCVSS 7,5İstismar yokEPSS %0

    koxudaxi · datamodel-code-generator28 Tem 2026

  • CVE-2026-55391
    30İzleyin

    datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding

    YüksekCVSS 7,5İstismar yokEPSS %0

    koxudaxi · datamodel-code-generator28 Tem 2026

  • CVE-2026-55415
    30İzleyin

    datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements

    YüksekCVSS 7,5İstismar yokEPSS %0

    koxudaxi · datamodel-code-generator28 Tem 2026

  • CVE-2026-47219
    30İzleyin

    find-my-way is Vulnerable to DDoS with HTTP2

    YüksekCVSS 7,5İstismar yokEPSS %0

    delvedor · find-my-way28 Tem 2026

  • CVE-2026-54638
    30İzleyin

    td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode

    YüksekCVSS 7,5İstismar yokEPSS %0

    gotd · td28 Tem 2026

  • CVE-2026-54650
    34İzleyin

    openhole-server vulnerable to path traversal via URL-decoded request path

    YüksekCVSS 8,6İstismar yokEPSS %0

    bablilayoub · openhole28 Tem 2026

  • CVE-2026-54719
    30İzleyin

    goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)

    YüksekCVSS 7,5İstismar yokEPSS %0

    goshs-labs · goshs28 Tem 2026

  • CVE-2026-62325
    36İzleyin

    goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

    KritikCVSS 9,1İstismar yokEPSS %0

    goshs-labs · goshs28 Tem 2026

  • CVE-2026-64863
    36İzleyin

    goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

    KritikCVSS 9,1İstismar yokEPSS %0

    goshs-labs · goshs28 Tem 2026

  • CVE-2026-12476
    28İzleyin

    Easy Digital Downloads <= 3.6.9 - Authenticated (Shop Manager+) Arbitrary File Upload via 'edd-import-file' Parameter

    YüksekCVSS 7,2İstismar yokEPSS %1

    smub · easy digital downloads – ecommerce payments and subscriptions made easy29 Tem 2026

  • CVE-2026-18072
    40Planlayın

    Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … 10.8.7 - Unauthenticated Authentication Bypass via Hardcoded Backdoor in '_wplogin

    KritikCVSS 9,8Kavram kanıtıEPSS %2

    nico23 · advanced responsive video embedder for rumble, odysee, youtube, vimeo, kick …29 Tem 2026

  • CVE-2026-11974
    34İzleyin

    Media folder Addon < 4.1.7 - Unauthenticated Arbitrary File Download

    YüksekCVSS 8,6İstismar yokEPSS %0

    unknown · wp-media-folder-addon29 Tem 2026

  • CVE-2026-13423
    39İzleyin

    Streamit <= 4.5.0 - Unauthenticated Remote Code Execution via Arbitrary Function Call

    KritikCVSS 9,8İstismar yokEPSS %0

    unknown · streamit29 Tem 2026

  • CVE-2026-13690
    29İzleyin

    UsersWP < 1.2.67 - Two-Factor Authentication Bypass

    YüksekCVSS 7,4İstismar yokEPSS %0

    unknown · userswp29 Tem 2026

  • CVE-2026-14234
    28İzleyin

    WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF

    YüksekCVSS 7,1İstismar yokEPSS %0

    unknown · wolf29 Tem 2026

  • CVE-2026-14300
    32İzleyin

    miniOrange Social Login and Register < 7.8.0 - Unauthenticated Account Takeover

    YüksekCVSS 8,1İstismar yokEPSS %0

    unknown · miniorange social login and register (discord, google, twitter, linkedin)29 Tem 2026

  • CVE-2026-63227
    39İzleyin

    Unrestricted SCORM file upload vulnerability

    KritikCVSS 9,9İstismar yokEPSS %0

    an unrestricted scorm file upload vulnerability in koollab lms allowed an authenticated module designer to upload a scorm package containing a php webshell to a publicly accessible directory and execu · koollab lms29 Tem 2026

  • CVE-2026-13425
    28İzleyin

    Database for CF7 <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting via Array Form Field Values

    YüksekCVSS 7,2İstismar yokEPSS %0

    code4life · database for cf729 Tem 2026

  • CVE-2026-63229
    36İzleyin

    Pre-authentication blind SQL injection vulnerability

    KritikCVSS 9,1İstismar yokEPSS %0

    three learning · koollab lms29 Tem 2026

  • CVE-2026-63230
    36İzleyin

    Pre-authentication error-based SQL injection vulnerability

    KritikCVSS 9,1İstismar yokEPSS %0

    three learning · koollab lms29 Tem 2026

  • CVE-2026-63231
    32İzleyin

    Post-authentication SQL injection vulnerability

    YüksekCVSS 8,1İstismar yokEPSS %0

    three learning · koollab lms29 Tem 2026

  • CVE-2026-63232
    39İzleyin

    SQL injection and unsafe deserialisation vulnerability

    KritikCVSS 9,9İstismar yokEPSS %0

    three learning · koollab lms29 Tem 2026

  • CVE-2026-63233
    39İzleyin

    SQL injection and unsafe deserialisation vulnerability

    KritikCVSS 9,9İstismar yokEPSS %0

    three learning · koollab lms29 Tem 2026

  • CVE-2026-63234
    39İzleyin

    SQL injection and unsafe deserialisation vulnerability

    KritikCVSS 9,9İstismar yokEPSS %0

    three learning · koollab lms29 Tem 2026

  • CVE-2026-14900
    39İzleyin

    Cost Calculator Builder PRO <= 4.0.3 - Unauthenticated Remote Code Execution via 'orderDetails' Parameter

    KritikCVSS 9,8İstismar yokEPSS %1

    stylemixthemes · cost calculator builder pro29 Tem 2026

  • CVE-2026-16597
    28İzleyin

    GTM4WP <= 1.22.3 - Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing Fields

    YüksekCVSS 7,2İstismar yokEPSS %0

    duracelltomi · gtm4wp – a google tag manager (gtm) plugin for wordpress29 Tem 2026

  • CVE-2026-16655
    28İzleyin

    Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member

    YüksekCVSS 7,2İstismar yokEPSS %0

    wpmanageninja · fluent forms – customizable contact forms, survey, quiz, & conversational form builder29 Tem 2026

  • CVE-2026-18220
    31İzleyin

    Binutils: binutils: out-of-bounds write in bfd dlx elf backend relocation processing

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    red hat · red hat enterprise linux 1029 Tem 2026

  • CVE-2026-18191
    37İzleyin

    Vacron｜IP Camera - Hidden Functionality

    KritikCVSS 9,3İstismar yokEPSS %0

    vacron · vin-ds783e-e629 Tem 2026

  • CVE-2026-18192
    28İzleyin

    Vacron｜IP Camera - Arbitrary File Read

    YüksekCVSS 7,1İstismar yokEPSS %0

    vacron · vin-ds783e-e629 Tem 2026

  • CVE-2026-33267
    30İzleyin

    Apache Traffic Server: Untrusted @ headers can spoof ATS internal metadata

    YüksekCVSS 7,7Kavram kanıtıEPSS %0

    apache · traffic server29 Tem 2026

  • CVE-2026-33930
    32İzleyin

    Apache Traffic Server: Buffer overflow via Host field that has a long string value

    YüksekCVSS 8,2İstismar yokEPSS %0

    apache · traffic server29 Tem 2026

  • CVE-2026-35226
    28İzleyin

    Out-of-bounds Write in CODESYS PROFINET Controller

    YüksekCVSS 7,1İstismar yokEPSS %0

    codesys · codesys profinet29 Tem 2026

  • CVE-2026-41920
    28İzleyin

    Apache Traffic Server: SNI to Host header matching policy is not properly enforced

    YüksekCVSS 7,0İstismar yokEPSS %0

    apache · traffic server29 Tem 2026

  • CVE-2026-57834
    28İzleyin

    Apache Traffic Server: Malformed chunked message body allows request smuggling

    YüksekCVSS 7,0İstismar yokEPSS %0

    apache · traffic server29 Tem 2026

  • CVE-2026-58150
    31İzleyin

    Apache Traffic Server: HTTP/2 requests with Transfer-Encoding are not rejected, allowing request smuggling

    YüksekCVSS 7,8İstismar yokEPSS %0

    apache · traffic server29 Tem 2026

  • CVE-2026-58151
    34İzleyin

    Apache Traffic Server: Abusive HTTP/2 framing can exhaust resources and crash the server

    YüksekCVSS 8,7İstismar yokEPSS %0

    apache · traffic server29 Tem 2026

  • CVE-2026-58154
    36İzleyin

    Apache Traffic Server: Memory-safety errors in MIME and header parsing

    KritikCVSS 9,2İstismar yokEPSS %0

    apache · traffic server29 Tem 2026

  • CVE-2026-58155
    36İzleyin

    Apache Traffic Server: Header-name length truncation enables header aliasing and request smuggling

    KritikCVSS 9,2İstismar yokEPSS %0

    apache · traffic server29 Tem 2026

  • CVE-2026-64556
    31İzleyin

    perf/core: Detach event groups during remove_on_exec

    YüksekCVSS 7,8İstismar yokEPSS %0

    linux · linux29 Tem 2026

  • CVE-2026-64557
    35İzleyin

    Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()

    YüksekCVSS 8,8İstismar yokEPSS %0

    linux · linux29 Tem 2026

  • CVE-2026-65324
    32İzleyin

    Apache Traffic Server: HTTP/2 and HTTP/3 dechunking removes per-stream buffer cap, allowing memory exhaustion

    YüksekCVSS 8,2İstismar yokEPSS %0

    apache · traffic server29 Tem 2026

  • CVE-2026-0667
    37İzleyin

    CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability that could cause arbitrary code execution, denial of service and

    KritikCVSS 9,3İstismar yokEPSS %0

    schneider electric · scadapack 47x29 Tem 2026

  • CVE-2026-44944
    34İzleyin

    iscsiuio control-socket authentication bypass in open-iscsi

    YüksekCVSS 8,5İstismar yokEPSS %0

    open-iscsi · open-iscsi29 Tem 2026

  • CVE-2025-10656
    39İzleyin

    Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Missing Authorization to Unauthenticated Privilege Escalation via Admin Account

    KritikCVSS 9,8İstismar yokEPSS %0

    holest · spreadsheet price changer for woocommerce and wp e-commerce – light29 Tem 2026

  • CVE-2026-55995
    34İzleyin

    Double-free in the iSNS attribute decoder in open-iscsi

    YüksekCVSS 8,7İstismar yokEPSS %0

    open-iscsi · open-iscsi29 Tem 2026

  • CVE-2026-23904
    29İzleyin

    Apache Kyuubi: Unrestricted access via Kyuubi engine-ui proxy

    YüksekCVSS 7,3İstismar yokEPSS %0

    apache · kyuubi29 Tem 2026

  • CVE-2026-50622
    35İzleyin

    Apache Atlas: Missing Authorization on Admin Endpoints

    YüksekCVSS 8,8İstismar yokEPSS %0

    apache · atlas29 Tem 2026

  • CVE-2026-58158
    32İzleyin

    Apache Traffic Server: PROXY protocol parsing has port truncation and a stack overflow

    YüksekCVSS 8,2İstismar yokEPSS %0

    apache · traffic server29 Tem 2026

  • CVE-2026-58159
    28İzleyin

    Apache Traffic Server: Listener and ACL handling allow access-control bypass

    YüksekCVSS 7,0İstismar yokEPSS %0

    apache · traffic server29 Tem 2026

  • CVE-2026-58161
    36İzleyin

    Apache Traffic Server: Memory-safety errors in TLS and SNI handling can crash the server

    KritikCVSS 9,2İstismar yokEPSS %0

    apache · traffic server29 Tem 2026

  • CVE-2026-58162
    33İzleyin

    Apache Traffic Server: Certifier plugin trusts client SNI when generating certificates

    YüksekCVSS 8,4İstismar yokEPSS %0

    apache · traffic server29 Tem 2026

  • CVE-2026-58163
    33İzleyin

    Apache Traffic Server: Cache deserialization and lifetime errors can corrupt state or crash the server

    YüksekCVSS 8,3İstismar yokEPSS %0

    apache · traffic server29 Tem 2026

  • CVE-2026-58164
    33İzleyin

    Apache Traffic Server: Remap configuration lifetime and TOCTOU errors cause use-after-free

    YüksekCVSS 8,3İstismar yokEPSS %0

    apache · traffic server29 Tem 2026

  • CVE-2026-58175
    32İzleyin

    Apache Traffic Server: HostDB SRV handling leaks memory

    YüksekCVSS 8,2İstismar yokEPSS %0

    apache · traffic server29 Tem 2026

  • CVE-2026-58177
    33İzleyin

    Apache Traffic Server: Memory-safety and path-traversal errors in the Cripts framework

    YüksekCVSS 8,3İstismar yokEPSS %0

    apache · traffic server29 Tem 2026

  • CVE-2026-58178
    32İzleyin

    Apache Traffic Server: ESI plugin allows uncontrolled recursion and server-side request forgery

    YüksekCVSS 8,2İstismar yokEPSS %0

    apache · traffic server29 Tem 2026

  • CVE-2026-58179
    36İzleyin

    Apache Traffic Server: regex_remap plugin overflows the stack from attacker input

    KritikCVSS 9,2İstismar yokEPSS %0

    apache · traffic server29 Tem 2026

  • CVE-2026-58180
    32İzleyin

    Apache Traffic Server: txn_box plugin overflows the stack from attacker input

    YüksekCVSS 8,2İstismar yokEPSS %0

    apache · traffic server29 Tem 2026

  • CVE-2026-58181
    32İzleyin

    Apache Traffic Server: uri_signing and url_sig plugins can exhaust the stack or crash

    YüksekCVSS 8,2İstismar yokEPSS %0

    apache · traffic server29 Tem 2026

  • CVE-2026-58182
    32İzleyin

    Apache Traffic Server: ts_lua plugin has initialization and resource-handling errors

    YüksekCVSS 8,2İstismar yokEPSS %0

    apache · traffic server29 Tem 2026

  • CVE-2026-58183
    32İzleyin

    Apache Traffic Server: prefetch plugin can crash on attacker-influenced input

    YüksekCVSS 8,2İstismar yokEPSS %0

    apache · traffic server29 Tem 2026

  • CVE-2026-58184
    33İzleyin

    Apache Traffic Server: header_rewrite plugin cookie handling can corrupt memory

    YüksekCVSS 8,3İstismar yokEPSS %0

    apache · traffic server29 Tem 2026

  • CVE-2026-58185
    32İzleyin

    Apache Traffic Server: Use-after-free in the intercept plugin

    YüksekCVSS 8,2İstismar yokEPSS %0

    apache · traffic server29 Tem 2026

  • CVE-2026-58186
    32İzleyin

    Apache Traffic Server: webp_transform plugin decodes unsafely and mislabels degraded responses

    YüksekCVSS 8,2İstismar yokEPSS %0

    apache · traffic server29 Tem 2026

  • CVE-2026-58188
    33İzleyin

    Apache Traffic Server: Memory-safety and limit-bypass errors across experimental plugins

    YüksekCVSS 8,4İstismar yokEPSS %0

    apache · traffic server29 Tem 2026

  • CVE-2026-58189
    32İzleyin

    Apache Traffic Server: Plugins resetting the redirect counter enable SSRF amplification

    YüksekCVSS 8,2İstismar yokEPSS %0

    apache · traffic server29 Tem 2026

  • CVE-2026-59243
    39İzleyin

    Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    apache · apache-airflow-providers-fab29 Tem 2026

  • CVE-2026-12703
    32İzleyin

    Bypass of 2FA for Connections via Unattended Access in TeamViewer for macOS

    YüksekCVSS 8,0İstismar yokEPSS %0

    teamviewer · remote29 Tem 2026

  • CVE-2026-12895
    28İzleyin

    SQL Injection in Frappe's ERPNext

    YüksekCVSS 7,1İstismar yokEPSS %0

    frappe · erpnext29 Tem 2026

  • CVE-2026-14488
    36İzleyin

    Meta Box AIO <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'rwmb_frontend_field_object_id' Parameter

    KritikCVSS 9,1İstismar yokEPSS %0

    meta box · meta box aio29 Tem 2026

  • CVE-2026-65883
    40Planlayın

    Joomla Extension - aimy-extensions.com - RCE via PHP object injection in Aimy Captcha-Less Form Guard 18.0 - 20.0

    KritikCVSS 10,0Kavram kanıtıEPSS %0

    aimy-extensions · aimy captcha-less form guard29 Tem 2026

  • CVE-2026-14270
    35İzleyin

    Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) <= 2.3.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Fil

    YüksekCVSS 8,8İstismar yokEPSS %0

    themecomplete · extra checkout options - addon for extra product options plugin29 Tem 2026

  • CVE-2026-15228
    28İzleyin

    Kong Kubernetes Ingress Controller cluster-wide ingress configuration DoS via CA-certificate ID collision

    YüksekCVSS 7,1İstismar yokEPSS %0

    29 Tem 2026

  • CVE-2026-16463
    31İzleyin

    DXF File Parsing Heap-Based Overflow in Autodesk AutoCAD

    YüksekCVSS 7,8İstismar yokEPSS %0

    autodesk · advance steel29 Tem 2026

  • CVE-2026-16465
    28İzleyin

    DWG or DXF File Parsing Out-of-Bounds Read in Autodesk AutoCAD

    YüksekCVSS 7,1İstismar yokEPSS %0

    autodesk · advance steel29 Tem 2026

  • CVE-2026-16543
    28İzleyin

    Kong Operator cluster-wide ingress configuration DoS via embedded KIC CA-certificate ID collision

    YüksekCVSS 7,1İstismar yokEPSS %0

    29 Tem 2026

  • CVE-2026-13697
    36İzleyin

    undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

    KritikCVSS 9,1İstismar yokEPSS %0

    nodejs · undici29 Tem 2026

  • CVE-2026-54693
    32İzleyin

    ZITADEL Users Can Self-Verify Email/Phone via API

    YüksekCVSS 8,2İstismar yokEPSS %0

    zitadel · zitadel29 Tem 2026

  • CVE-2026-67194
    28İzleyin

    Courier IMAP < 6.0.1 Mail Server < 2.0.2 Stack Overflow DoS via Nested SEARCH Queries

    YüksekCVSS 7,1İstismar yokEPSS %0

    svarshavchik · courier imap29 Tem 2026

  • CVE-2026-12927
    33İzleyin

    CWE-787 Out-of-bounds write vulnerability exists that could cause loss of data or potentially risk arbitrary code execution when a malicious

    YüksekCVSS 8,4İstismar yokEPSS %0

    schneider electric · igss definition (def.exe)29 Tem 2026

  • CVE-2026-14354
    34İzleyin

    CWE-522 Insufficiently Protected Credentials vulnerability exists that could cause authentication bypass and unauthorized credential modific

    YüksekCVSS 8,7İstismar yokEPSS %0

    schneider electric · ecostruxure™ cybersecurity admin expert29 Tem 2026

  • CVE-2026-50641
    28İzleyin

    Plaintext password storage in Streamsoft Business Intelligence

    YüksekCVSS 7,1İstismar yokEPSS %0

    streamsoft · business intelligence29 Tem 2026

  • CVE-2026-65884
    40Planlayın

    Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2

    KritikCVSS 10,0İstismar yokEPSS %0

    balbooa · gridbox29 Tem 2026

  • CVE-2026-65885
    37İzleyin

    Joomla Extension - balbooa.com - Authenticated arbitrary file upload in Gridbox < 2.20.2

    KritikCVSS 9,4İstismar yokEPSS %0

    balbooa · gridbox29 Tem 2026

  • CVE-2026-65891
    26İzleyin

    Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor (JCE) < 2.9.99.

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    widgetfactorylimited · jce29 Tem 2026

  • CVE-2026-65943
    30İzleyin

    Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.0

    YüksekCVSS 7,5İstismar yokEPSS %0

    rolandd · ro csvi29 Tem 2026

  • CVE-2026-65944
    35İzleyin

    Joomla Extension - rolandd.com - CSRF vectors in AJAX endpoint handlers RO CSVI < 9.11.0

    YüksekCVSS 8,8İstismar yokEPSS %0

    rolandd · ro csvi29 Tem 2026

  • CVE-2026-65889
    36İzleyin

    Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion in Gridbox < 2.20.2

    KritikCVSS 9,2İstismar yokEPSS %0

    balbooa · gridbox29 Tem 2026

  • CVE-2026-65890
    36İzleyin

    Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.2

    KritikCVSS 9,2İstismar yokEPSS %0

    balbooa · gridbox29 Tem 2026

  • CVE-2026-67213
    32İzleyin

    nanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customRandom

    YüksekCVSS 8,2İstismar yokEPSS %0

    nanoid project · nanoid29 Tem 2026

  • CVE-2026-67214
    32İzleyin

    nanoid Infinite Loop via Negative Size in non-secure module

    YüksekCVSS 8,2İstismar yokEPSS %0

    nanoid project · nanoid29 Tem 2026