Yayın tarihine göre
Ağustos 2026: sömürülen ve yeni ciddi CVE kayıtları
7.295 kayıt · 20 KEV. Yayın sırasıyla.
Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.
Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.
Sayfa 65 / 73
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
31İzleyin | CVE-2026-80580İstismar yok | fbdev: bound mode sysfs output to the sysfs bufferlinux · linux | Yüksek7,8 | — | %0,1 | 26 Ağu 2026 |
33İzleyin | CVE-2026-80584İstismar yok | s390/qeth: validate user buffer length in SNMP and ARP query ioctlslinux · linux | Yüksek8,4 | — | %0,1 | 26 Ağu 2026 |
37İzleyin | CVE-2026-80585İstismar yok | mptcp: fastopen: only mark MPTFO subflows with SYN datalinux · linux | Kritik9,4 | — | %0,3 | 26 Ağu 2026 |
39İzleyin | CVE-2026-80586İstismar yok | mptcp: options: reset DSS fields in case of unexpected sizelinux · linux | Kritik9,8 | — | %0,3 | 26 Ağu 2026 |
39İzleyin | CVE-2026-80587İstismar yok | mptcp: avoid combining some incoming suboptionslinux · linux | Kritik9,8 | — | %0,4 | 26 Ağu 2026 |
30İzleyin | CVE-2026-80588İstismar yok | mptcp: reclaim forward-allocated memory on RX path errorslinux · linux | Yüksek7,5 | — | %0,6 | 26 Ağu 2026 |
39İzleyin | CVE-2026-80589İstismar yok | block: stop the timeout timer when releasing a never added disklinux · linux | Kritik9,8 | — | %0,3 | 26 Ağu 2026 |
38İzleyin | CVE-2026-80428Kavram kanıtı | ILIAS PHP Object Injection via Shibboleth Logoutilias-elearning e.v. · ilias · CWE-502 | Kritik9,3 | — | %4,6 | 26 Ağu 2026 |
34İzleyin | CVE-2026-81029İstismar yok | OpenMetadata before 2.0.0 JWT Disclosure via Unvalidated SAML and OIDC Redirect URIopen-metadata · openmetadata · CWE-601 | Yüksek8,5 | — | %0,5 | 26 Ağu 2026 |
39İzleyin | CVE-2025-70290İstismar yok | An issue was discovered in Denx U-Boot before 2026.04.CWE-190 | Kritik9,8 | — | %0,6 | 26 Ağu 2026 |
39İzleyin | CVE-2025-70293İstismar yok | An issue was discovered in Denx U-Boot before 2026.04.CWE-122 | Kritik9,8 | — | %0,8 | 26 Ağu 2026 |
30İzleyin | CVE-2026-26445İstismar yok | stomper 5e2741e is vulnerable to Denial of Service.CWE-770 | Yüksek7,5 | — | %0,4 | 26 Ağu 2026 |
30İzleyin | CVE-2026-26446İstismar yok | Stomper 5e2741e is vulnerable to Denial of Service.CWE-703 | Yüksek7,5 | — | %0,4 | 26 Ağu 2026 |
30İzleyin | CVE-2026-26447İstismar yok | Stomper 5e2741e is vulnerable to Use-After-Free.CWE-416 | Yüksek7,5 | — | %0,4 | 26 Ağu 2026 |
39İzleyin | CVE-2026-26448İstismar yok | Stomper 5e2741e is vulnerable to Use-After-Free.CWE-416 | Kritik9,8 | — | %0,5 | 26 Ağu 2026 |
30İzleyin | CVE-2026-26449İstismar yok | In Stomper 5e2741e when a client sends a SEND frame missing the destination header field, the server triggers a null pointer dereference (orCWE-476 | Yüksek7,5 | — | %0,4 | 26 Ağu 2026 |
30İzleyin | CVE-2026-46369İstismar yok | Nimiq: Validity store off by one errornimiq · core-rs-albatross · CWE-193 | Yüksek7,5 | — | %0,5 | 26 Ağu 2026 |
30İzleyin | CVE-2026-54245İstismar yok | Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet databasefleetdm · fleet · CWE-89 | Yüksek7,6 | — | %0,5 | 26 Ağu 2026 |
76Bu hafta | CVE-2026-60004Silahlaştırılmış | Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.gitea · gitea · CWE-94 | Kritik9,8 | KEV | %23,9 | 26 Ağu 2026 |
28İzleyin | CVE-2026-66003İstismar yok | Frappe: Access control bypass via REST API dot-notation fields on linked doctypesfrappe · frappe · CWE-863 | Yüksek7,1 | — | %0,4 | 26 Ağu 2026 |
39İzleyin | CVE-2026-68000İstismar yok | The front-end interface /cms/category/list of MCMS <=6.2.0 is vulnerable to SQL injection.CWE-89 | Kritik9,8 | — | %0,4 | 26 Ağu 2026 |
36İzleyin | CVE-2026-68861İstismar yok | Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Commandell · powerprotect one · CWE-78 | Yüksek8,8 | — | %1,6 | 26 Ağu 2026 |
30İzleyin | CVE-2026-68863İstismar yok | Dell PowerProtect One, versions 20.1.0.0 and below, contain a Stack-based Buffer Overflow vulnerability.dell · powerprotect one · CWE-121 | Yüksek7,5 | — | %0,4 | 26 Ağu 2026 |
36İzleyin | CVE-2026-74770İstismar yok | Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Commandell · powerprotect one · CWE-78 | Yüksek8,8 | — | %1,9 | 26 Ağu 2026 |
30İzleyin | CVE-2026-74774İstismar yok | Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Certificate Validation vulnerability.dell · powerprotect one · CWE-295 | Yüksek7,5 | — | %0,2 | 26 Ağu 2026 |
39İzleyin | CVE-2026-75327İstismar yok | In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java has an arbitrary file upload vCWE-434 | Kritik9,8 | — | %0,5 | 26 Ağu 2026 |
39İzleyin | CVE-2026-75334İstismar yok | The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution.CWE-89 | Kritik9,8 | — | %0,6 | 26 Ağu 2026 |
31İzleyin | CVE-2026-77652İstismar yok | Dia: dia: heap buffer overflow in wpg colormap parser via out-of-bounds palette indexgnome · dia · CWE-122 | Yüksek7,8 | — | %0,2 | 26 Ağu 2026 |
35İzleyin | CVE-2026-79938İstismar yok | Dell PowerProtect Cyber Recovery, versions prior to 20.3, contain an Improper Authentication vulnerability.dell · powerprotect cyber recovery · CWE-287 | Yüksek8,8 | — | %0,4 | 26 Ağu 2026 |
31İzleyin | CVE-2026-79939İstismar yok | Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link (Symlink) Following vulnerability.dell · powerprotect cyber recovery · CWE-61 | Yüksek7,8 | — | %0,1 | 26 Ağu 2026 |
30İzleyin | CVE-2025-51675İstismar yok | An issue was discovered in openRISC OR1200 commit 83ac6b.CWE-691 | Yüksek7,5 | — | %0,2 | 26 Ağu 2026 |
36İzleyin | CVE-2025-51679İstismar yok | An issue was discovered in openRISC OR1200 commit 83ac6b.CWE-1281 | Kritik9,1 | — | %0,3 | 26 Ağu 2026 |
30İzleyin | CVE-2025-61478İstismar yok | An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial ofCWE-400 | Yüksek7,5 | — | %0,2 | 26 Ağu 2026 |
30İzleyin | CVE-2025-61479İstismar yok | An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial ofCWE-294 | Yüksek7,5 | — | %0,2 | 26 Ağu 2026 |
30İzleyin | CVE-2025-61480İstismar yok | An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial ofCWE-294 | Yüksek7,5 | — | %0,1 | 26 Ağu 2026 |
33İzleyin | CVE-2026-15973İstismar yok | LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entrieslimesurvey · limesurvey · CWE-79 | Yüksek8,4 | — | %0,2 | 26 Ağu 2026 |
24İzleyin | CVE-2026-39275Kavram kanıtı | Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, fCWE-79 | Orta6,1 | — | %0,3 | 26 Ağu 2026 |
39İzleyin | CVE-2026-52103İstismar yok | A zero-click remote code execution (RCE) vulnerability in the /Terminal/Notification.hs component of SimpleX Chat before v6.5 allows attackeCWE-94 | Kritik9,8 | — | %1,0 | 26 Ağu 2026 |
32İzleyin | CVE-2026-55228İstismar yok | Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private projectweblateorg · weblate · CWE-639 | Yüksek8,1 | — | %0,4 | 26 Ağu 2026 |
30İzleyin | CVE-2026-61792İstismar yok | Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)weblateorg · weblate · CWE-22 | Yüksek7,7 | — | %0,5 | 26 Ağu 2026 |
39İzleyin | CVE-2026-75411İstismar yok | JeecgBoot v3.9.2 is vulnerable to Remote command execution.CWE-94 | Kritik9,8 | — | %1,1 | 26 Ağu 2026 |
30İzleyin | CVE-2026-75413İstismar yok | DocSys V2.02.80 is vulnerable to Any File Download.CWE-552 | Yüksek7,5 | — | %0,4 | 26 Ağu 2026 |
39İzleyin | CVE-2026-75414İstismar yok | In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering the user input, which leads to a command exCWE-94 | Kritik9,8 | — | %0,8 | 26 Ağu 2026 |
30İzleyin | CVE-2026-75415İstismar yok | AntFlow V2.0.0 is vulnerable to Incorrect Access Control.CWE-639 | Yüksek7,5 | — | %0,3 | 26 Ağu 2026 |
35İzleyin | CVE-2026-79921İstismar yok | amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payloadrabbitmq · amqp091-go · CWE-770 | Yüksek8,9 | — | %0,5 | 26 Ağu 2026 |
28İzleyin | CVE-2026-16809İstismar yok | LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message renderinglimesurvey · limesurvey · CWE-79 | Yüksek7,2 | — | %0,2 | 26 Ağu 2026 |
34İzleyin | CVE-2026-43621İstismar yok | Simple Machines Forum < 2.1.7 Authorization Confusion via Profile::load()simplemachines · smf · CWE-863 | Yüksek8,6 | — | %0,3 | 26 Ağu 2026 |
34İzleyin | CVE-2026-55182İstismar yok | LibreNMS: Remote Code Execution by Signal Alert Transportation Modulelibrenms · librenms · CWE-77 | Yüksek8,6 | — | %1,6 | 26 Ağu 2026 |
30İzleyin | CVE-2026-61617İstismar yok | Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustionpterodactyl · wings · CWE-400 | Yüksek7,7 | — | %0,4 | 26 Ağu 2026 |
29İzleyin | CVE-2026-63360İstismar yok | LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpointlimesurvey · limesurvey · CWE-79 | Yüksek7,4 | — | %0,4 | 26 Ağu 2026 |
34İzleyin | CVE-2026-64632İstismar yok | A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account.veeam · one · CWE-522 | Yüksek8,5 | — | %0,3 | 26 Ağu 2026 |
37İzleyin | CVE-2026-65641İstismar yok | A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account.veeam · one · CWE-288 | Kritik9,3 | — | %0,5 | 26 Ağu 2026 |
34İzleyin | CVE-2026-65642İstismar yok | Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and webpros · plesk · CWE-639 | Yüksek8,6 | — | %0,4 | 26 Ağu 2026 |
39İzleyin | CVE-2026-65646İstismar yok | Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arwebpros · plesk · CWE-74 | Kritik9,9 | — | %0,6 | 26 Ağu 2026 |
34İzleyin | CVE-2026-65647Kavram kanıtı | Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.webpros · plesk migrator · CWE-59 | Yüksek8,7 | — | %0,7 | 26 Ağu 2026 |
30İzleyin | CVE-2026-75328İstismar yok | In DocSys-master V2.02.85, the downloadDocEx interface in src/com/DocSystem/controller/DocController.java has an arbitrary file read vulneraCWE-22 | Yüksek7,5 | — | %0,5 | 26 Ağu 2026 |
39İzleyin | CVE-2026-75329İstismar yok | The Netty configuration distribution service (port 8283) of super-diamond-server <= 1.3.3 has no authentication mechanism.CWE-306 | Kritik9,8 | — | %0,6 | 26 Ağu 2026 |
30İzleyin | CVE-2026-75333İstismar yok | yx-image-recognition v1.0 is vulnerable to Path Traversal.CWE-22 | Yüksek7,5 | — | %0,5 | 26 Ağu 2026 |
34İzleyin | CVE-2026-77298İstismar yok | SeaweedFS S3 OIDC Bearer authentication bypasses IAM role trust policyseaweedfs · seaweedfs · CWE-863 | Yüksek8,7 | — | %0,3 | 26 Ağu 2026 |
32İzleyin | CVE-2026-77317İstismar yok | SeaweedFS: SFTP path ACL literal prefix match permits cross-tenant file read and overwriteseaweedfs · seaweedfs · CWE-863 | Yüksek8,1 | — | %0,3 | 26 Ağu 2026 |
30İzleyin | CVE-2026-77368İstismar yok | SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Pathsseaweedfs · seaweedfs · CWE-639 | Yüksek7,6 | — | %0,3 | 26 Ağu 2026 |
28İzleyin | CVE-2026-77611İstismar yok | SeaweedFS: Authenticated S3 object-scope bypass in PutObjectAcl allows overwriting a different object with the same basenameseaweedfs · seaweedfs · CWE-863 | Yüksek7,1 | — | %0,3 | 26 Ağu 2026 |
30İzleyin | GHSA-2rrw-hpqm-36pvİstismar yok | Duplicate Advisory: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressionsPyPI · nltk · CWE-1333 | Yüksek7,5 | — | — | 26 Ağu 2026 |
34İzleyin | CVE-2026-47665İstismar yok | Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTMLpenpot · penpot · CWE-79 | Yüksek8,7 | — | %0,4 | 26 Ağu 2026 |
30İzleyin | CVE-2026-47666İstismar yok | Penpot: Stored XSS via custom font family name injected into a @font-face style rulepenpot · penpot · CWE-79 | Yüksek7,6 | — | %0,3 | 26 Ağu 2026 |
40Planlayın | CVE-2026-65956İstismar yok | KubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRF1panel-dev · kubepi · CWE-306 | Kritik10,0 | — | %0,6 | 26 Ağu 2026 |
39İzleyin | CVE-2026-75330İstismar yok | The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server <= 1.3.3 is vulnerable to SQL injection.CWE-89 | Kritik9,8 | — | %0,4 | 26 Ağu 2026 |
36İzleyin | CVE-2026-75332İstismar yok | Zyplayer-Doc <=1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via WikiPageWebService.download().CWE-918 | Kritik9,1 | — | %0,4 | 26 Ağu 2026 |
39İzleyin | CVE-2026-75336İstismar yok | Funiture 1.0.0 is vulnerable to SQL Injection in the backend tool interfaces /sys/tool/select.json and /sys/tool/update.json.CWE-89 | Kritik9,8 | — | %0,4 | 26 Ağu 2026 |
39İzleyin | CVE-2026-75338İstismar yok | disconf (Distributed Configuration Management Platform) 2.6.36 is vulnerable to Incorrect Access Control.CWE-284 | Kritik9,8 | — | %0,6 | 26 Ağu 2026 |
36İzleyin | CVE-2026-75340İstismar yok | The device metadata import interface /device/instance/{productId}/property-metadata/import of jetlinks community 2.11 is vulnerable to ServeCWE-918 | Kritik9,1 | — | %0,4 | 26 Ağu 2026 |
30İzleyin | CVE-2026-47851İstismar yok | Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Readervmware · spring ai · CWE-674 | Yüksek7,5 | — | %0,4 | 26 Ağu 2026 |
30İzleyin | CVE-2026-47852İstismar yok | Predictable cache directory location allows local ONNX model substitution in Spring AIvmware · spring ai · CWE-377 | Yüksek7,5 | — | %0,3 | 26 Ağu 2026 |
30İzleyin | CVE-2026-47863İstismar yok | Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flushbroadcom · reactor core · CWE-835 | Yüksek7,5 | — | %0,4 | 26 Ağu 2026 |
28İzleyin | CVE-2026-80183İstismar yok | In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignmentopenstack · keystone · CWE-843 | Yüksek7,1 | — | %0,3 | 26 Ağu 2026 |
28İzleyin | CVE-2026-13415İstismar yok | CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Privilege Escalation via cmp_ajax_import_settingsunknown · cmp · CWE-269 | Yüksek7,2 | — | %0,2 | 27 Ağu 2026 |
28İzleyin | CVE-2026-19223İstismar yok | Smush < 4.3.2 - Admin+ Network-Wide RCE via Hub Connector on Multisiteunknown · smush · CWE-94 | Yüksek7,2 | — | %0,3 | 27 Ağu 2026 |
30İzleyin | CVE-2026-19715İstismar yok | WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log Fileunknown · wp oauth server ( login with wordpress ) · CWE-200 | Yüksek7,5 | — | %0,2 | 27 Ağu 2026 |
28İzleyin | CVE-2026-47849İstismar yok | Spring Data REST allows mutation of identifier and version properties via JSON Patchvmware · spring data rest · CWE-915 | Yüksek7,1 | — | %0,3 | 27 Ağu 2026 |
41Planlayın | CVE-2026-47864İstismar yok | Unsafe Java deserialization in SerializingHttpMessageConverter — remote code executionvmware · spring integration · CWE-502 | Kritik9,8 | — | %5,9 | 27 Ağu 2026 |
39İzleyin | CVE-2026-47875İstismar yok | JobParameterDeserializer bypasses the trusted-type allowlistbroadcom · spring batch · CWE-502 | Kritik9,8 | — | %0,4 | 27 Ağu 2026 |
29İzleyin | CVE-2026-47878İstismar yok | Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlistbroadcom · spring batch · CWE-502 | Yüksek7,3 | — | %0,3 | 27 Ağu 2026 |
34İzleyin | CVE-2026-47879İstismar yok | Spring Cloud Gateway SSRF and native file access with gRPCvmware · spring cloud gateway · CWE-918 | Yüksek8,7 | — | %0,3 | 27 Ağu 2026 |
30İzleyin | CVE-2026-47881İstismar yok | Denial of Service in Spring Batch FlatFileItemReader via Malformed Input Filebroadcom · spring batch · CWE-400 | Yüksek7,5 | — | %0,4 | 27 Ağu 2026 |
24İzleyin | CVE-2026-47883Kavram kanıtı | Spring Framework Open Redirect in UrlHandlerFiltervmware · spring framework · CWE-601 | Orta6,1 | — | %0,2 | 27 Ağu 2026 |
39İzleyin | CVE-2026-47884Kavram kanıtı | Spring Framework Improper Path Limitation in XsltViewvmware · spring framework · CWE-22 | Kritik9,8 | — | %0,6 | 27 Ağu 2026 |
30İzleyin | CVE-2026-47885İstismar yok | Spring Framework maxPartSize Ignored in PartEventHttpMessageReadervmware · spring framework · CWE-770 | Yüksek7,5 | — | %0,3 | 27 Ağu 2026 |
30İzleyin | CVE-2026-47886İstismar yok | Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressionsvmware · spring framework · CWE-400 | Yüksek7,5 | — | %0,4 | 27 Ağu 2026 |
30İzleyin | CVE-2026-47888İstismar yok | Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandlervmware · spring framework · CWE-401 | Yüksek7,5 | — | %0,4 | 27 Ağu 2026 |
30İzleyin | CVE-2026-47889İstismar yok | Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponsevmware · spring framework · CWE-1275 | Yüksek7,5 | — | %0,4 | 27 Ağu 2026 |
39İzleyin | CVE-2026-47890İstismar yok | Spring Framework Server Sent Event stream corruption while rendering fragmentsvmware · spring framework · CWE-93 | Kritik9,8 | — | %0,5 | 27 Ağu 2026 |
39İzleyin | CVE-2026-47891İstismar yok | Spring Framework maxInMemorySize Bypassed in Jaxb2Decodervmware · spring framework · CWE-770 | Kritik9,8 | — | %0,5 | 27 Ağu 2026 |
39İzleyin | CVE-2026-47892İstismar yok | Spring Framework Header Predicate Bypass in WebFlux Functional Endpointsvmware · spring framework · CWE-863 | Kritik9,8 | — | %0,5 | 27 Ağu 2026 |
30İzleyin | CVE-2026-47893İstismar yok | Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketServicevmware · spring framework · CWE-209 | Yüksek7,5 | — | %0,4 | 27 Ağu 2026 |
30İzleyin | CVE-2026-47894İstismar yok | Spring Cloud Config Server Native Environment Repository Exposurevmware · spring cloud config · CWE-22 | Yüksek7,5 | — | %0,4 | 27 Ağu 2026 |
36İzleyin | CVE-2026-59270İstismar yok | Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfacesvmware · spring security · CWE-863 | Kritik9,1 | — | %0,4 | 27 Ağu 2026 |
38İzleyin | CVE-2026-77016İstismar yok | Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Deletion via Candidate Profile Mass Assignmentunknown · workeera · CWE-73 | Kritik9,6 | — | %0,4 | 27 Ağu 2026 |
30İzleyin | CVE-2026-77017İstismar yok | Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Read via Candidate Profile Mass Assignmentunknown · workeera · CWE-200 | Yüksek7,7 | — | %0,4 | 27 Ağu 2026 |
35İzleyin | CVE-2026-77018İstismar yok | Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Upload via Candidate Profile Mass Assignmentunknown · workeera · CWE-434 | Yüksek8,8 | — | %0,7 | 27 Ağu 2026 |
37İzleyin | CVE-2026-77991Kavram kanıtı | Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1joomlaeventmanager.net · jem - joomla event manager extension for joomla · CWE-434 | Kritik9,4 | — | %0,6 | 27 Ağu 2026 |
- CVE-2026-8058031İzleyin
fbdev: bound mode sysfs output to the sysfs buffer
YüksekCVSS 7,8İstismar yokEPSS %0linux · linux26 Ağu 2026
- CVE-2026-8058433İzleyin
s390/qeth: validate user buffer length in SNMP and ARP query ioctls
YüksekCVSS 8,4İstismar yokEPSS %0linux · linux26 Ağu 2026
- CVE-2026-8058537İzleyin
mptcp: fastopen: only mark MPTFO subflows with SYN data
KritikCVSS 9,4İstismar yokEPSS %0linux · linux26 Ağu 2026
- CVE-2026-8058639İzleyin
mptcp: options: reset DSS fields in case of unexpected size
KritikCVSS 9,8İstismar yokEPSS %0linux · linux26 Ağu 2026
- CVE-2026-8058739İzleyin
mptcp: avoid combining some incoming suboptions
KritikCVSS 9,8İstismar yokEPSS %0linux · linux26 Ağu 2026
- CVE-2026-8058830İzleyin
mptcp: reclaim forward-allocated memory on RX path errors
YüksekCVSS 7,5İstismar yokEPSS %0linux · linux26 Ağu 2026
- CVE-2026-8058939İzleyin
block: stop the timeout timer when releasing a never added disk
KritikCVSS 9,8İstismar yokEPSS %0linux · linux26 Ağu 2026
- CVE-2026-8042838İzleyin
ILIAS PHP Object Injection via Shibboleth Logout
KritikCVSS 9,3Kavram kanıtıEPSS %4ilias-elearning e.v. · ilias26 Ağu 2026
- CVE-2026-8102934İzleyin
OpenMetadata before 2.0.0 JWT Disclosure via Unvalidated SAML and OIDC Redirect URI
YüksekCVSS 8,5İstismar yokEPSS %0open-metadata · openmetadata26 Ağu 2026
- CVE-2025-7029039İzleyin
An issue was discovered in Denx U-Boot before 2026.04.
KritikCVSS 9,8İstismar yokEPSS %026 Ağu 2026
- CVE-2025-7029339İzleyin
An issue was discovered in Denx U-Boot before 2026.04.
KritikCVSS 9,8İstismar yokEPSS %026 Ağu 2026
- CVE-2026-2644530İzleyin
stomper 5e2741e is vulnerable to Denial of Service.
YüksekCVSS 7,5İstismar yokEPSS %026 Ağu 2026
- CVE-2026-2644630İzleyin
Stomper 5e2741e is vulnerable to Denial of Service.
YüksekCVSS 7,5İstismar yokEPSS %026 Ağu 2026
- CVE-2026-2644730İzleyin
Stomper 5e2741e is vulnerable to Use-After-Free.
YüksekCVSS 7,5İstismar yokEPSS %026 Ağu 2026
- CVE-2026-2644839İzleyin
Stomper 5e2741e is vulnerable to Use-After-Free.
KritikCVSS 9,8İstismar yokEPSS %026 Ağu 2026
- CVE-2026-2644930İzleyin
In Stomper 5e2741e when a client sends a SEND frame missing the destination header field, the server triggers a null pointer dereference (or
YüksekCVSS 7,5İstismar yokEPSS %026 Ağu 2026
- CVE-2026-4636930İzleyin
Nimiq: Validity store off by one error
YüksekCVSS 7,5İstismar yokEPSS %0nimiq · core-rs-albatross26 Ağu 2026
- CVE-2026-5424530İzleyin
Fleet: SQL injection in Okta conditional access endpoint allows host-controlled compromise of the Fleet database
YüksekCVSS 7,6İstismar yokEPSS %0fleetdm · fleet26 Ağu 2026
- CVE-2026-6000476Bu hafta
Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %23gitea · gitea26 Ağu 2026
- CVE-2026-6600328İzleyin
Frappe: Access control bypass via REST API dot-notation fields on linked doctypes
YüksekCVSS 7,1İstismar yokEPSS %0frappe · frappe26 Ağu 2026
- CVE-2026-6800039İzleyin
The front-end interface /cms/category/list of MCMS <=6.2.0 is vulnerable to SQL injection.
KritikCVSS 9,8İstismar yokEPSS %026 Ağu 2026
- CVE-2026-6886136İzleyin
Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Comman
YüksekCVSS 8,8İstismar yokEPSS %1dell · powerprotect one26 Ağu 2026
- CVE-2026-6886330İzleyin
Dell PowerProtect One, versions 20.1.0.0 and below, contain a Stack-based Buffer Overflow vulnerability.
YüksekCVSS 7,5İstismar yokEPSS %0dell · powerprotect one26 Ağu 2026
- CVE-2026-7477036İzleyin
Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Comman
YüksekCVSS 8,8İstismar yokEPSS %1dell · powerprotect one26 Ağu 2026
- CVE-2026-7477430İzleyin
Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Certificate Validation vulnerability.
YüksekCVSS 7,5İstismar yokEPSS %0dell · powerprotect one26 Ağu 2026
- CVE-2026-7532739İzleyin
In DocSys-master V2.02.85, the uploadMarkdownPic interface in src/com/DocSystem/controller/DocController.java has an arbitrary file upload v
KritikCVSS 9,8İstismar yokEPSS %026 Ağu 2026
- CVE-2026-7533439İzleyin
The report module in the backend of smart-web2 v1.3.1 is vulnerable to arbitrary SQL execution.
KritikCVSS 9,8İstismar yokEPSS %026 Ağu 2026
- CVE-2026-7765231İzleyin
Dia: dia: heap buffer overflow in wpg colormap parser via out-of-bounds palette index
YüksekCVSS 7,8İstismar yokEPSS %0gnome · dia26 Ağu 2026
- CVE-2026-7993835İzleyin
Dell PowerProtect Cyber Recovery, versions prior to 20.3, contain an Improper Authentication vulnerability.
YüksekCVSS 8,8İstismar yokEPSS %0dell · powerprotect cyber recovery26 Ağu 2026
- CVE-2026-7993931İzleyin
Dell PowerProtect Cyber Recovery, versions Prior to 20.3, contain an UNIX Symbolic Link (Symlink) Following vulnerability.
YüksekCVSS 7,8İstismar yokEPSS %0dell · powerprotect cyber recovery26 Ağu 2026
- CVE-2025-5167530İzleyin
An issue was discovered in openRISC OR1200 commit 83ac6b.
YüksekCVSS 7,5İstismar yokEPSS %026 Ağu 2026
- CVE-2025-5167936İzleyin
An issue was discovered in openRISC OR1200 commit 83ac6b.
KritikCVSS 9,1İstismar yokEPSS %026 Ağu 2026
- CVE-2025-6147830İzleyin
An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of
YüksekCVSS 7,5İstismar yokEPSS %026 Ağu 2026
- CVE-2025-6147930İzleyin
An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of
YüksekCVSS 7,5İstismar yokEPSS %026 Ağu 2026
- CVE-2025-6148030İzleyin
An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of
YüksekCVSS 7,5İstismar yokEPSS %026 Ağu 2026
- CVE-2026-1597333İzleyin
LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries
YüksekCVSS 8,4İstismar yokEPSS %0limesurvey · limesurvey26 Ağu 2026
- CVE-2026-3927524İzleyin
Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, f
OrtaCVSS 6,1Kavram kanıtıEPSS %026 Ağu 2026
- CVE-2026-5210339İzleyin
A zero-click remote code execution (RCE) vulnerability in the /Terminal/Notification.hs component of SimpleX Chat before v6.5 allows attacke
KritikCVSS 9,8İstismar yokEPSS %126 Ağu 2026
- CVE-2026-5522832İzleyin
Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project
YüksekCVSS 8,1İstismar yokEPSS %0weblateorg · weblate26 Ağu 2026
- CVE-2026-6179230İzleyin
Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)
YüksekCVSS 7,7İstismar yokEPSS %0weblateorg · weblate26 Ağu 2026
- CVE-2026-7541139İzleyin
JeecgBoot v3.9.2 is vulnerable to Remote command execution.
KritikCVSS 9,8İstismar yokEPSS %126 Ağu 2026
- CVE-2026-7541330İzleyin
DocSys V2.02.80 is vulnerable to Any File Download.
YüksekCVSS 7,5İstismar yokEPSS %026 Ağu 2026
- CVE-2026-7541439İzleyin
In AntFlow V2.0.0, ActivitiTest.java enables users to execute JUEL expressions without filtering the user input, which leads to a command ex
KritikCVSS 9,8İstismar yokEPSS %026 Ağu 2026
- CVE-2026-7541530İzleyin
AntFlow V2.0.0 is vulnerable to Incorrect Access Control.
YüksekCVSS 7,5İstismar yokEPSS %026 Ağu 2026
- CVE-2026-7992135İzleyin
amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload
YüksekCVSS 8,9İstismar yokEPSS %0rabbitmq · amqp091-go26 Ağu 2026
- CVE-2026-1680928İzleyin
LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering
YüksekCVSS 7,2İstismar yokEPSS %0limesurvey · limesurvey26 Ağu 2026
- CVE-2026-4362134İzleyin
Simple Machines Forum < 2.1.7 Authorization Confusion via Profile::load()
YüksekCVSS 8,6İstismar yokEPSS %0simplemachines · smf26 Ağu 2026
- CVE-2026-5518234İzleyin
LibreNMS: Remote Code Execution by Signal Alert Transportation Module
YüksekCVSS 8,6İstismar yokEPSS %1librenms · librenms26 Ağu 2026
- CVE-2026-6161730İzleyin
Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion
YüksekCVSS 7,7İstismar yokEPSS %0pterodactyl · wings26 Ağu 2026
- CVE-2026-6336029İzleyin
LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint
YüksekCVSS 7,4İstismar yokEPSS %0limesurvey · limesurvey26 Ağu 2026
- CVE-2026-6463234İzleyin
A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account.
YüksekCVSS 8,5İstismar yokEPSS %0veeam · one26 Ağu 2026
- CVE-2026-6564137İzleyin
A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account.
KritikCVSS 9,3İstismar yokEPSS %0veeam · one26 Ağu 2026
- CVE-2026-6564234İzleyin
Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and
YüksekCVSS 8,6İstismar yokEPSS %0webpros · plesk26 Ağu 2026
- CVE-2026-6564639İzleyin
Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose ar
KritikCVSS 9,9İstismar yokEPSS %0webpros · plesk26 Ağu 2026
- CVE-2026-6564734İzleyin
Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.
YüksekCVSS 8,7Kavram kanıtıEPSS %0webpros · plesk migrator26 Ağu 2026
- CVE-2026-7532830İzleyin
In DocSys-master V2.02.85, the downloadDocEx interface in src/com/DocSystem/controller/DocController.java has an arbitrary file read vulnera
YüksekCVSS 7,5İstismar yokEPSS %026 Ağu 2026
- CVE-2026-7532939İzleyin
The Netty configuration distribution service (port 8283) of super-diamond-server <= 1.3.3 has no authentication mechanism.
KritikCVSS 9,8İstismar yokEPSS %026 Ağu 2026
- CVE-2026-7533330İzleyin
yx-image-recognition v1.0 is vulnerable to Path Traversal.
YüksekCVSS 7,5İstismar yokEPSS %026 Ağu 2026
- CVE-2026-7729834İzleyin
SeaweedFS S3 OIDC Bearer authentication bypasses IAM role trust policy
YüksekCVSS 8,7İstismar yokEPSS %0seaweedfs · seaweedfs26 Ağu 2026
- CVE-2026-7731732İzleyin
SeaweedFS: SFTP path ACL literal prefix match permits cross-tenant file read and overwrite
YüksekCVSS 8,1İstismar yokEPSS %0seaweedfs · seaweedfs26 Ağu 2026
- CVE-2026-7736830İzleyin
SeaweedFS: Authenticated Cross-Prefix IDOR in Filer TUS Handler Enables Arbitrary Write to Tenant-Forbidden Paths
YüksekCVSS 7,6İstismar yokEPSS %0seaweedfs · seaweedfs26 Ağu 2026
- CVE-2026-7761128İzleyin
SeaweedFS: Authenticated S3 object-scope bypass in PutObjectAcl allows overwriting a different object with the same basename
YüksekCVSS 7,1İstismar yokEPSS %0seaweedfs · seaweedfs26 Ağu 2026
- GHSA-2rrw-hpqm-36pv30İzleyin
Duplicate Advisory: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions
YüksekCVSS 7,5İstismar yokPyPI · nltk26 Ağu 2026
- CVE-2026-4766534İzleyin
Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML
YüksekCVSS 8,7İstismar yokEPSS %0penpot · penpot26 Ağu 2026
- CVE-2026-4766630İzleyin
Penpot: Stored XSS via custom font family name injected into a @font-face style rule
YüksekCVSS 7,6İstismar yokEPSS %0penpot · penpot26 Ağu 2026
- CVE-2026-6595640Planlayın
KubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRF
KritikCVSS 10,0İstismar yokEPSS %01panel-dev · kubepi26 Ağu 2026
- CVE-2026-7533039İzleyin
The front-end interface /superdiamond/preview/{projectCode}/{module}/{type} of super-diamond-server <= 1.3.3 is vulnerable to SQL injection.
KritikCVSS 9,8İstismar yokEPSS %026 Ağu 2026
- CVE-2026-7533236İzleyin
Zyplayer-Doc <=1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via WikiPageWebService.download().
KritikCVSS 9,1İstismar yokEPSS %026 Ağu 2026
- CVE-2026-7533639İzleyin
Funiture 1.0.0 is vulnerable to SQL Injection in the backend tool interfaces /sys/tool/select.json and /sys/tool/update.json.
KritikCVSS 9,8İstismar yokEPSS %026 Ağu 2026
- CVE-2026-7533839İzleyin
disconf (Distributed Configuration Management Platform) 2.6.36 is vulnerable to Incorrect Access Control.
KritikCVSS 9,8İstismar yokEPSS %026 Ağu 2026
- CVE-2026-7534036İzleyin
The device metadata import interface /device/instance/{productId}/property-metadata/import of jetlinks community 2.11 is vulnerable to Serve
KritikCVSS 9,1İstismar yokEPSS %026 Ağu 2026
- CVE-2026-4785130İzleyin
Unbounded recursion over attacker-controlled PDF outline tree in Spring AI PDF Document Reader
YüksekCVSS 7,5İstismar yokEPSS %0vmware · spring ai26 Ağu 2026
- CVE-2026-4785230İzleyin
Predictable cache directory location allows local ONNX model substitution in Spring AI
YüksekCVSS 7,5İstismar yokEPSS %0vmware · spring ai26 Ağu 2026
- CVE-2026-4786330İzleyin
Reactor Core bufferTimeout fair-backpressure pipeline permanently hangs when upstream delivers items during an active flush
YüksekCVSS 7,5İstismar yokEPSS %0broadcom · reactor core26 Ağu 2026
- CVE-2026-8018328İzleyin
In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment
YüksekCVSS 7,1İstismar yokEPSS %0openstack · keystone26 Ağu 2026
- CVE-2026-1341528İzleyin
CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Privilege Escalation via cmp_ajax_import_settings
YüksekCVSS 7,2İstismar yokEPSS %0unknown · cmp27 Ağu 2026
- CVE-2026-1922328İzleyin
Smush < 4.3.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite
YüksekCVSS 7,2İstismar yokEPSS %0unknown · smush27 Ağu 2026
- CVE-2026-1971530İzleyin
WP OAuth Server < 6.3.1 - Unauthenticated OAuth Token and User Data Disclosure via Debug Log File
YüksekCVSS 7,5İstismar yokEPSS %0unknown · wp oauth server ( login with wordpress )27 Ağu 2026
- CVE-2026-4784928İzleyin
Spring Data REST allows mutation of identifier and version properties via JSON Patch
YüksekCVSS 7,1İstismar yokEPSS %0vmware · spring data rest27 Ağu 2026
- CVE-2026-4786441Planlayın
Unsafe Java deserialization in SerializingHttpMessageConverter — remote code execution
KritikCVSS 9,8İstismar yokEPSS %5vmware · spring integration27 Ağu 2026
- CVE-2026-4787539İzleyin
JobParameterDeserializer bypasses the trusted-type allowlist
KritikCVSS 9,8İstismar yokEPSS %0broadcom · spring batch27 Ağu 2026
- CVE-2026-4787829İzleyin
Unsafe Java deserialization in DefaultExecutionContextSerializer without class allowlist
YüksekCVSS 7,3İstismar yokEPSS %0broadcom · spring batch27 Ağu 2026
- CVE-2026-4787934İzleyin
Spring Cloud Gateway SSRF and native file access with gRPC
YüksekCVSS 8,7İstismar yokEPSS %0vmware · spring cloud gateway27 Ağu 2026
- CVE-2026-4788130İzleyin
Denial of Service in Spring Batch FlatFileItemReader via Malformed Input File
YüksekCVSS 7,5İstismar yokEPSS %0broadcom · spring batch27 Ağu 2026
- CVE-2026-4788324İzleyin
Spring Framework Open Redirect in UrlHandlerFilter
OrtaCVSS 6,1Kavram kanıtıEPSS %0vmware · spring framework27 Ağu 2026
- CVE-2026-4788439İzleyin
Spring Framework Improper Path Limitation in XsltView
KritikCVSS 9,8Kavram kanıtıEPSS %0vmware · spring framework27 Ağu 2026
- CVE-2026-4788530İzleyin
Spring Framework maxPartSize Ignored in PartEventHttpMessageReader
YüksekCVSS 7,5İstismar yokEPSS %0vmware · spring framework27 Ağu 2026
- CVE-2026-4788630İzleyin
Spring Framework Denial of Service via Unbounded Exponentiation in SpEL Expressions
YüksekCVSS 7,5İstismar yokEPSS %0vmware · spring framework27 Ağu 2026
- CVE-2026-4788830İzleyin
Spring Framework Memory Leak via SETUP Frame in RSocketMessageHandler
YüksekCVSS 7,5İstismar yokEPSS %0vmware · spring framework27 Ağu 2026
- CVE-2026-4788930İzleyin
Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse
YüksekCVSS 7,5İstismar yokEPSS %0vmware · spring framework27 Ağu 2026
- CVE-2026-4789039İzleyin
Spring Framework Server Sent Event stream corruption while rendering fragments
KritikCVSS 9,8İstismar yokEPSS %0vmware · spring framework27 Ağu 2026
- CVE-2026-4789139İzleyin
Spring Framework maxInMemorySize Bypassed in Jaxb2Decoder
KritikCVSS 9,8İstismar yokEPSS %0vmware · spring framework27 Ağu 2026
- CVE-2026-4789239İzleyin
Spring Framework Header Predicate Bypass in WebFlux Functional Endpoints
KritikCVSS 9,8İstismar yokEPSS %0vmware · spring framework27 Ağu 2026
- CVE-2026-4789330İzleyin
Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService
YüksekCVSS 7,5İstismar yokEPSS %0vmware · spring framework27 Ağu 2026
- CVE-2026-4789430İzleyin
Spring Cloud Config Server Native Environment Repository Exposure
YüksekCVSS 7,5İstismar yokEPSS %0vmware · spring cloud config27 Ağu 2026
- CVE-2026-5927036İzleyin
Spring Security embedded UnboundID LDAP server exposes well-known administrative bind DN on all network interfaces
KritikCVSS 9,1İstismar yokEPSS %0vmware · spring security27 Ağu 2026
- CVE-2026-7701638İzleyin
Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Deletion via Candidate Profile Mass Assignment
KritikCVSS 9,6İstismar yokEPSS %0unknown · workeera27 Ağu 2026
- CVE-2026-7701730İzleyin
Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Read via Candidate Profile Mass Assignment
YüksekCVSS 7,7İstismar yokEPSS %0unknown · workeera27 Ağu 2026
- CVE-2026-7701835İzleyin
Workeera Remote Tech Job Board < 1.0.6 - Subscriber+ Arbitrary File Upload via Candidate Profile Mass Assignment
YüksekCVSS 8,8İstismar yokEPSS %0unknown · workeera27 Ağu 2026
- CVE-2026-7799137İzleyin
Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1
KritikCVSS 9,4Kavram kanıtıEPSS %0joomlaeventmanager.net · jem - joomla event manager extension for joomla27 Ağu 2026