Yayın tarihine göre

Eylül 2026: sömürülen ve yeni ciddi CVE kayıtları

7.955 kayıt · 32 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 32 / 80

CVE kayıtları
Aksiyon	CVE	Zafiyet	Ciddiyet	KEV	EPSS	Yayın
34İzleyin	CVE-2026-90776İstismar yok	Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsingnodemailer · nodemailer · CWE-407 Kimlik doğrulamasız	Yüksek8,7	—	%0,6	13 Eyl 2026
34İzleyin	CVE-2026-90777İstismar yok	ESPnet before 202609 Remote Code Execution via Unsafe Deserializationespnet · espnet · CWE-502 Girişsiz RCE Deserializasyon	Yüksek8,7	—	%0,7	13 Eyl 2026
34İzleyin	CVE-2026-90778İstismar yok	SIPp through 3.7.7 Buffer Overflow via SIP To Header Tagsipp · sipp · CWE-120 Kimlik doğrulamasız Bellek hatası	Yüksek8,7	—	%0,8	13 Eyl 2026
34İzleyin	CVE-2026-90779İstismar yok	SIPp through 3.7.7 Stack Buffer Overflow via createAuthHeader Algorithm Parametersipp · sipp · CWE-121 Kimlik doğrulamasız Bellek hatası	Yüksek8,7	—	%0,8	13 Eyl 2026
34İzleyin	CVE-2026-90780İstismar yok	SIPp through 3.7.7 Buffer Overflow via Oversized SIP Header Contentsipp · sipp · CWE-120 Kimlik doğrulamasız Bellek hatası	Yüksek8,7	—	%0,8	13 Eyl 2026
19İzleyin	CVE-2026-90781Kavram kanıtı	alsa-lib through 1.2.16.1 Off-by-One Stack Buffer Overflow in __snd_ctl_ascii_elem_id_parse()alsa project · alsa-lib · CWE-193	Orta4,8	—	%0,1	13 Eyl 2026
24İzleyin	CVE-2026-90782Kavram kanıtı	S2OPC through 1.7.3 NULL Pointer Dereference in alloc_notification_message_items()systerel · s2opc · CWE-476 Bellek hatası	Orta6,0	—	%0,5	13 Eyl 2026
34İzleyin	CVE-2026-90783İstismar yok	MKVToolNix through 101.0 Heap Buffer Overflow via avilib ODML Superindex Integer Wraparoundmoritz bunkus · mkvtoolnix · CWE-680	Yüksek8,5	—	%0,2	13 Eyl 2026
30İzleyin	CVE-2026-29811İstismar yok	CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normalcyberpanel · cyberpanel · CWE-1025	Yüksek7,7	—	%0,3	13 Eyl 2026
29İzleyin	CVE-2026-36453İstismar yok	Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1.rhymix · rhymix · CWE-425 Erişim denetimi (IDOR)	Yüksek7,4	—	%0,2	13 Eyl 2026
32İzleyin	CVE-2026-37008İstismar yok	CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVEcrewai · crewai · CWE-424	Yüksek8,1	—	%0,1	13 Eyl 2026
35İzleyin	CVE-2026-74933İstismar yok	GenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored XSS and Configuration Overwriteunknown · geniewords · CWE-862 Kimlik doğrulamasız Erişim denetimi (IDOR) XSS	Yüksek8,8	—	%0,5	13 Eyl 2026
40Planlayın	CVE-2026-81648Kavram kanıtı	CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Routerunknown · cryptopayment gateway · CWE-862 Kimlik doğrulamasız Erişim denetimi (IDOR)	Kritik10,0	—	%0,4	13 Eyl 2026
35İzleyin	CVE-2026-85129İstismar yok	Hoo Companion 1.0.2 - Unauthenticated Stored XSS via Theme Settings Importunknown · hoo companion · CWE-79 Kimlik doğrulamasız XSS	Yüksek8,8	—	%0,4	13 Eyl 2026
35İzleyin	CVE-2026-88793İstismar yok	YouTube Embed 10.0 - 10.3 - Unauthenticated Stored XSS via youram_serverunknown · youtube embed · CWE-79 Kimlik doğrulamasız XSS	Yüksek8,8	—	%0,5	13 Eyl 2026
30İzleyin	CVE-2026-88802İstismar yok	MDJM Event Management and Mobile Events Manager - Unauthenticated Arbitrary Post Deletionunknown · mdjm event management · CWE-862 Kimlik doğrulamasız Erişim denetimi (IDOR)	Yüksek7,5	—	%0,4	13 Eyl 2026
30İzleyin	CVE-2026-15891İstismar yok	NULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gatewayzephyrproject · zephyr · CWE-476 Kimlik doğrulamasız Bellek hatası Hizmet dışı bırakma	Yüksek7,5	—	%0,3	13 Eyl 2026
34İzleyin	CVE-2026-90605İstismar yok	Totolink A3002MU boa formFilter buffer overflowtotolink · a3002mu · CWE-119 Bellek hatası	Yüksek8,6	—	%0,8	13 Eyl 2026
34İzleyin	CVE-2026-90606İstismar yok	Totolink A3002MU boa formIpv6Setup buffer overflowtotolink · a3002mu · CWE-119 Bellek hatası	Yüksek8,6	—	%0,8	13 Eyl 2026
34İzleyin	CVE-2026-90607İstismar yok	Totolink A3002MU boa formNewSchedule buffer overflowtotolink · a3002mu · CWE-119 Bellek hatası	Yüksek8,6	—	%0,8	13 Eyl 2026
34İzleyin	CVE-2026-90608İstismar yok	Totolink A3002MU boa formPortFw buffer overflowtotolink · a3002mu · CWE-119 Bellek hatası	Yüksek8,6	—	%0,8	13 Eyl 2026
28İzleyin	CVE-2026-52296İstismar yok	FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.ffmpeg · ffmpeg · CWE-125 Bellek hatası	Yüksek7,1	—	%0,1	13 Eyl 2026
28İzleyin	CVE-2026-52297İstismar yok	FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in libffmpeg · ffmpeg · CWE-125 Bellek hatası	Yüksek7,1	—	%0,1	13 Eyl 2026
31İzleyin	CVE-2026-23789İstismar yok	An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processor Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400samsung · exynos 850 firmware · CWE-415 RCE Bellek hatası	Yüksek7,8	—	%0,1	13 Eyl 2026
30İzleyin	CVE-2026-31278Kavram kanıtı	An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and and BioStar X before 1.0.2 allows attackers supremainc · biostar 2 · CWE-319 Zayıf kripto	Yüksek7,7	—	%0,2	13 Eyl 2026
30İzleyin	CVE-2026-33963İstismar yok	An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680.samsung · exynos 1330 firmware · CWE-121 Bellek hatası	Yüksek7,5	—	%0,1	13 Eyl 2026
37İzleyin	CVE-2026-90680İstismar yok	D-Link DIR-823G HNAP1 SetStaticRouteSettings strcpy stack-based overflowd-link · dir-823g · CWE-119 Bellek hatası	Kritik9,4	—	%0,9	14 Eyl 2026
28İzleyin	CVE-2023-28148İstismar yok	A bodyclass XSS issue was discovered in Paessler PRTG before 23.3.86.1520.paessler · prtg network monitor · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,2	—	%0,2	14 Eyl 2026
30İzleyin	CVE-2023-32803İstismar yok	The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root certamazon · ca-certificates · CWE-669 Kimlik doğrulamasız	Yüksek7,5	—	%0,1	14 Eyl 2026
34İzleyin	CVE-2023-45858İstismar yok	A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that made it possible to read local files.paessler · prtg network monitor · CWE-23 Kimlik doğrulamasız Yol geçişi	Yüksek8,6	—	%0,6	14 Eyl 2026
35İzleyin	CVE-2023-46273İstismar yok	Bonjour Gateway in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has an ah_bgd buffer overflow via ah_event_sextremenetworks · iq engine · CWE-121 Bellek hatası	Yüksek8,8	—	%0,3	14 Eyl 2026
35İzleyin	CVE-2023-50461İstismar yok	An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3.typo3 · direct_mail · CWE-863 RCE Erişim denetimi (IDOR)	Yüksek8,8	—	%0,3	14 Eyl 2026
33İzleyin	CVE-2026-68955İstismar yok	The installer for Rakuten Kobo Desktop Application (Windows version) insecurely loads Dynamic Link Libraries.rakuten kobo inc. · the installer for rakuten kobo desktop application (windows version) · CWE-427 RCE Yerel yetki yükseltme	Yüksek8,4	—	%0,1	14 Eyl 2026
28İzleyin	CVE-2026-71198İstismar yok	In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image.openstack · glance · CWE-918 SSRF	Yüksek7,0	—	%0,4	14 Eyl 2026
35İzleyin	CVE-2026-82762İstismar yok	Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec FX5000 series, FX4000 sericontec co., ltd. · fxa5000 · CWE-78 RCE Komut enjeksiyonu	Yüksek8,7	—	%1,8	14 Eyl 2026
34İzleyin	CVE-2026-82765İstismar yok	Path traversal vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series.contec co., ltd. · fxa5000 · CWE-23 Yol geçişi	Yüksek8,6	—	%0,4	14 Eyl 2026
35İzleyin	CVE-2026-82766İstismar yok	Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SGA1000.contec co., ltd. · sga1000 · CWE-78 RCE Komut enjeksiyonu	Yüksek8,7	—	%1,8	14 Eyl 2026
34İzleyin	CVE-2026-82768İstismar yok	Path traversal vulnerability exists in SGA1000.contec co., ltd. · sga1000 · CWE-23 Yol geçişi	Yüksek8,6	—	%0,4	14 Eyl 2026
34İzleyin	CVE-2026-82770İstismar yok	Buffer overflow vulnerability exists in Contec RP-WAH-SR Series.contec co., ltd. · rp-wah-sr1 · CWE-120 Bellek hatası	Yüksek8,7	—	%0,6	14 Eyl 2026
34İzleyin	CVE-2026-82772İstismar yok	Buffer overflow vulnerability exists in Contec EC1000 series.contec co., ltd. · ece1000 · CWE-120 Bellek hatası	Yüksek8,7	—	%0,6	14 Eyl 2026
35İzleyin	CVE-2026-82774İstismar yok	Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS M2M Gateway Series and contec co., ltd. · m2m gateway integrated type cps-mg341* · CWE-78 RCE Komut enjeksiyonu	Yüksek8,7	—	%1,8	14 Eyl 2026
35İzleyin	CVE-2026-82777İstismar yok	Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS PAC Series.contec co., ltd. · integrated type cps-pc341[][]-*-9201 · CWE-78 RCE Komut enjeksiyonu	Yüksek8,7	—	%1,8	14 Eyl 2026
35İzleyin	CVE-2026-82779İstismar yok	Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS TM Series.contec co., ltd · cps-tm341g5mb-adsc1-931 · CWE-78 RCE Komut enjeksiyonu	Yüksek8,7	—	%1,8	14 Eyl 2026
34İzleyin	CVE-2026-82780İstismar yok	Unrestricted upload of file with dangerous type issue exists in CONPROSYS TM Series.contec co., ltd · cps-tm341g5mb-adsc1-931 · CWE-434 Dosya yükleme	Yüksek8,7	—	%0,6	14 Eyl 2026
32İzleyin	CVE-2026-82786İstismar yok	Insufficiently protected credentials issue exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-.contec co., ltd. · remote i/o coupler unit (server type) cpsn-mcb271- · CWE-522 Kimlik doğrulamasız Bilgi sızıntısı	Yüksek8,2	—	%0,3	14 Eyl 2026
34İzleyin	CVE-2026-82787İstismar yok	Missing authentication for critical function vulnerability exists in CPSL-08P1EN.contec co., ltd. · cpsl-08p1en · CWE-306 Kimlik doğrulama atlatma	Yüksek8,7	—	%0,6	14 Eyl 2026
34İzleyin	CVE-2026-82789İstismar yok	An improper neutralization of directives in dynamically evaluated code ('Eval Injection') issue exists in CONPROSYS HMI System(CHS).contec · conprosys hmi system(chs) · CWE-95 RCE	Yüksek8,7	—	%0,5	14 Eyl 2026
35İzleyin	CVE-2026-82791İstismar yok	Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec CAN 2.0B Communication Wircontec co., ltd. · can-2-wf · CWE-78 RCE Komut enjeksiyonu	Yüksek8,7	—	%1,8	14 Eyl 2026
34İzleyin	CVE-2026-82793İstismar yok	Unrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit.contec co., ltd. · can-2-wf · CWE-434 RCE Dosya yükleme	Yüksek8,6	—	%0,6	14 Eyl 2026
35İzleyin	CVE-2026-82794İstismar yok	SolarView Compact contains an OS command Injection vulnerability in in Schedule Settings.contec co., ltd. · sv-cpt-mc310 · CWE-78 RCE Komut enjeksiyonu	Yüksek8,7	—	%1,8	14 Eyl 2026
30İzleyin	CVE-2026-85189İstismar yok	Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla < 17.0.0regularlabs.com · modals (free, pro) extension for joomla · CWE-79 XSS	Yüksek7,5	—	%0,4	14 Eyl 2026
30İzleyin	CVE-2026-85190İstismar yok	Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla < 5.0.5regularlabs.com · quick index (free, pro) extension for joomla · CWE-79 XSS	Yüksek7,5	—	%0,4	14 Eyl 2026
30İzleyin	CVE-2026-85191İstismar yok	Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla < 3.1.0regularlabs.com · tabs & accordions (free, pro) extension for joomla · CWE-79 XSS	Yüksek7,5	—	%0,4	14 Eyl 2026
37İzleyin	CVE-2026-85192İstismar yok	Joomla Extension - regularlabs.com - Authenticated, privileged remote code execution in Conditional Content extension for Joomla < 8.0.0regularlabs.com · conditional content pro extension for joomla · CWE-94 RCE	Kritik9,4	—	%0,6	14 Eyl 2026
30İzleyin	CVE-2026-85195İstismar yok	Joomla Extension - regularlabs.com - Privileged stored XSS via link option in Articles Anywhere extension for Joomla < 20.0.0regularlabs.com · articles anywhere (free, pro) extension for joomla · CWE-79 XSS	Yüksek7,5	—	%0,4	14 Eyl 2026
30İzleyin	CVE-2026-88852İstismar yok	Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla < 7.0.0, Snippets Pro extension for Joomla < 11.regularlabs.com · snippets (free) extension for joomla · CWE-79 XSS	Yüksek7,5	—	%0,4	14 Eyl 2026
30İzleyin	CVE-2026-88853İstismar yok	Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla < 17.0.0regularlabs.com · modals (pro) extension for joomla · CWE-79 XSS	Yüksek7,5	—	%0,4	14 Eyl 2026
28İzleyin	CVE-2026-90688İstismar yok	Tenda W20E HTTP formIPMacBindAdd stack-based overflowtenda · w20e · CWE-119 Bellek hatası	Yüksek7,1	—	%0,7	14 Eyl 2026
34İzleyin	CVE-2026-90689İstismar yok	Tenda W20E formDelWebAuthWhiteUser stack-based overflowtenda · w20e · CWE-119 Bellek hatası	Yüksek8,7	—	%0,8	14 Eyl 2026
37İzleyin	CVE-2026-90692İstismar yok	D-Link DIR-878 Dynamic DNS IPv6 Settings SetDynamicDNSIPv6Settings stack-based overflowd-link · dir-878 · CWE-119 Bellek hatası	Kritik9,4	—	%0,9	14 Eyl 2026
34İzleyin	CVE-2026-12518İstismar yok	Local privilege escalation in the Logi Options+ updater service on Windowslogitech · logi options+ · CWE-269 RCE Yerel yetki yükseltme	Yüksek8,5	—	%0,1	14 Eyl 2026
37İzleyin	CVE-2026-90693İstismar yok	D-Link DIR-878 WAN Settings SetWan3Settings stack-based overflowd-link · dir-878 · CWE-119 Bellek hatası	Kritik9,4	—	%0,9	14 Eyl 2026
35İzleyin	CVE-2026-90699İstismar yok	D-Link DWR-M920 formPinManageSetup sub_41E60C os command injectiond-link · dwr-m920 · CWE-77 RCE Komut enjeksiyonu	Yüksek8,6	—	%3,2	14 Eyl 2026
35İzleyin	CVE-2026-72524İstismar yok	Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tablesapache software foundation · apache doris · CWE-863 Erişim denetimi (IDOR)	Yüksek8,8	—	%0,4	14 Eyl 2026
35İzleyin	CVE-2026-90702İstismar yok	D-Link DWR-M921 formDiskFormat system os command injectiond-link · dwr-m921 · CWE-77 RCE Komut enjeksiyonu	Yüksek8,5	—	%3,6	14 Eyl 2026
35İzleyin	CVE-2026-90703İstismar yok	D-Link DWR-M921 formDiskCreateShare system os command injectiond-link · dwr-m921 · CWE-77 RCE Komut enjeksiyonu	Yüksek8,5	—	%3,6	14 Eyl 2026
31İzleyin	CVE-2026-90894İstismar yok	Parallels Desktop local privilege escalation via appliance extract argument injectionparallels · parallels desktop for mac · CWE-78 RCE Yerel yetki yükseltme Komut enjeksiyonu	Yüksek7,8	—	%0,1	14 Eyl 2026
33İzleyin	CVE-2026-90895İstismar yok	MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injectionmisp · misp · CWE-150	Yüksek8,4	—	%0,1	14 Eyl 2026
34İzleyin	CVE-2026-20773İstismar yok	Improper Authorization in PingFederate Administrative Expression Evaluation Endpointping identity · pingfederate · CWE-863 Erişim denetimi (IDOR)	Yüksek8,5	—	%0,2	14 Eyl 2026
34İzleyin	CVE-2026-78375İstismar yok	Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.0joomshaper.com · sp page builder (free and pro) extension for joomla · CWE-89 SQL enjeksiyonu	Yüksek8,6	—	%0,3	14 Eyl 2026
28İzleyin	CVE-2026-81564İstismar yok	Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0joomshaper.com · sp page builder (free and pro) extension for joomla · CWE-22 Yol geçişi	Yüksek7,0	—	%0,4	14 Eyl 2026
39İzleyin	CVE-2026-82232İstismar yok	Apache Syncope: SQL injection via sort parameter in Task searchapache software foundation · apache syncope · CWE-89 Kimlik doğrulamasız SQL enjeksiyonu	Kritik9,8	—	%0,6	14 Eyl 2026
39İzleyin	CVE-2026-86460İstismar yok	Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistenceapache software foundation · apache syncope · CWE-89 Kimlik doğrulamasız SQL enjeksiyonu	Kritik9,8	—	%0,5	14 Eyl 2026
30İzleyin	CVE-2026-87779İstismar yok	Apache Syncope: AES Secret Key disclosure via log outputapache software foundation · apache syncope · CWE-532 Kimlik doğrulamasız Bilgi sızıntısı	Yüksek7,5	—	%0,4	14 Eyl 2026
36İzleyin	CVE-2026-87785İstismar yok	Apache Syncope: JWT subject spoofingapache software foundation · apache syncope · CWE-290 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,1	—	%0,5	14 Eyl 2026
36İzleyin	CVE-2026-87802İstismar yok	Apache Syncope: SRA OAuth2 JWT signature verification bypassapache software foundation · apache syncope · CWE-347 Kimlik doğrulamasız Zayıf kripto	Kritik9,1	—	%0,2	14 Eyl 2026
34İzleyin	CVE-2026-89180İstismar yok	Thinking Software Technology｜EFence - SQL Injectionthinking software technology · efence · CWE-89 Kimlik doğrulamasız SQL enjeksiyonu	Yüksek8,7	—	%0,5	14 Eyl 2026
40Planlayın	CVE-2026-90898Kavram kanıtı	Bifrost unauthenticated remote code execution via MCP stdio client registrationmaximhq · bifrost · CWE-284 Girişsiz RCE Erişim denetimi (IDOR)	Kritik9,8	—	%2,3	14 Eyl 2026
38İzleyin	CVE-2026-21391İstismar yok	Improper Claim Validation in PingAM OIDC Providerping identity · pingam · CWE-290 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,5	—	%0,4	14 Eyl 2026
37İzleyin	CVE-2026-90919İstismar yok	LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle Deserializationmodeltc · lightllm · CWE-502 Girişsiz RCE Deserializasyon	Kritik9,3	—	%1,0	14 Eyl 2026
36İzleyin	CVE-2026-12258İstismar yok	Inadequate access control in the Hiperdino REST APIhiperdino · rest api · CWE-284 Kimlik doğrulamasız Erişim denetimi (IDOR)	Kritik9,2	—	%0,4	14 Eyl 2026
30İzleyin	CVE-2026-73178İstismar yok	Apache Syncope: JWT Access Token takeoverapache software foundation · apache syncope · CWE-200 Kimlik doğrulamasız Bilgi sızıntısı	Yüksek7,5	—	%0,4	14 Eyl 2026
39İzleyin	CVE-2026-73470İstismar yok	Apache Syncope: Delegating users can grant unowned Rolesapache software foundation · apache syncope · CWE-269 Kimlik doğrulamasız	Kritik9,8	—	%0,5	14 Eyl 2026
39İzleyin	CVE-2026-73579İstismar yok	Apache Syncope: Non-recursive Any search could skip Realms restrictionsapache software foundation · apache syncope · CWE-863 Kimlik doğrulamasız Erişim denetimi (IDOR)	Kritik9,8	—	%0,5	14 Eyl 2026
39İzleyin	CVE-2026-73668İstismar yok	Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration valuesapache software foundation · apache syncope · CWE-863 Kimlik doğrulamasız Erişim denetimi (IDOR)	Kritik9,8	—	%0,5	14 Eyl 2026
39İzleyin	CVE-2026-75030İstismar yok	Apache Syncope: Incomplete authorization checks for Group members deprovisioningapache software foundation · apache syncope · CWE-862 Kimlik doğrulamasız Erişim denetimi (IDOR)	Kritik9,8	—	%0,6	14 Eyl 2026
39İzleyin	CVE-2026-77051İstismar yok	Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events searchapache software foundation · apache syncope · CWE-89 Kimlik doğrulamasız SQL enjeksiyonu	Kritik9,8	—	%0,6	14 Eyl 2026
39İzleyin	CVE-2026-77181İstismar yok	Apache Syncope: ClientApp update entitlement not effectiveapache software foundation · apache syncope · CWE-863 Kimlik doğrulamasız Erişim denetimi (IDOR)	Kritik9,8	—	%0,5	14 Eyl 2026
36İzleyin	CVE-2026-78299İstismar yok	In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract feclipse foundation · eclipse embedded cdt (c/c++ development tools) · CWE-22 Kimlik doğrulamasız Yol geçişi	Kritik9,1	—	%0,5	14 Eyl 2026
39İzleyin	CVE-2026-78330İstismar yok	Apache Syncope: Privilege escalation for admin user via JWT authenticationapache software foundation · apache syncope · CWE-266 Kimlik doğrulamasız	Kritik9,8	—	%0,6	14 Eyl 2026
30İzleyin	CVE-2026-78336İstismar yok	Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated userapache software foundation · apache syncope · CWE-201 Kimlik doğrulamasız	Yüksek7,5	—	%0,4	14 Eyl 2026
28İzleyin	CVE-2026-90927İstismar yok	filebrowser through 2.63.23 Denial of Service via unbounded WebSocket messagefilebrowser · filebrowser · CWE-400 Hizmet dışı bırakma	Yüksek7,1	—	%0,4	14 Eyl 2026
28İzleyin	CVE-2026-90928İstismar yok	File Browser through 2.63.23 Memory Exhaustion via subtitle endpointfilebrowser · filebrowser · CWE-400 Hizmet dışı bırakma	Yüksek7,1	—	%0,4	14 Eyl 2026
28İzleyin	CVE-2026-90929İstismar yok	File Browser 2.5.0 Directory Deletion via Upload Failure Cleanupfilebrowser · filebrowser · CWE-863 Erişim denetimi (IDOR)	Yüksek7,2	—	%0,4	14 Eyl 2026
30İzleyin	CVE-2026-90930İstismar yok	File Browser through 2.63.23 Path Traversal via Symlink Aliasfilebrowser · filebrowser · CWE-59 Yol geçişi	Yüksek7,6	—	%0,5	14 Eyl 2026
34İzleyin	CVE-2026-90932İstismar yok	LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCElaradashboard · laradashboard · CWE-73 RCE Yol geçişi	Yüksek8,6	—	%0,8	14 Eyl 2026
28İzleyin	CVE-2026-90933İstismar yok	laradashboard through 1.2.2 Missing Authorization via License APIlaradashboard · laradashboard · CWE-862 Erişim denetimi (IDOR)	Yüksek7,1	—	%0,3	14 Eyl 2026
34İzleyin	CVE-2026-90934İstismar yok	EspoCRM before 10.0.4 Field-level Security Bypass via Attendeesespocrm · espocrm · CWE-863 Erişim denetimi (IDOR)	Yüksek8,7	—	%0,3	14 Eyl 2026
37İzleyin	CVE-2026-90937İstismar yok	froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URLfroxlor · froxlor · CWE-93	Kritik9,4	—	%0,4	14 Eyl 2026
35İzleyin	CVE-2026-90938İstismar yok	LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocketlangbot-app · langbot · CWE-306 Kimlik doğrulamasız Kimlik doğrulama atlatma	Yüksek8,8	—	%0,5	14 Eyl 2026

CVE-2026-90776
34İzleyin
Nodemailer 9.1.0 through 10.0.4 Denial of Service via Quadratic Address Parsing
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
nodemailer · nodemailer13 Eyl 2026
CVE-2026-90777
34İzleyin
ESPnet before 202609 Remote Code Execution via Unsafe Deserialization
YüksekCVSS 8,7İstismar yokEPSS %0
- Girişsiz RCE
- Deserializasyon
espnet · espnet13 Eyl 2026
CVE-2026-90778
34İzleyin
SIPp through 3.7.7 Buffer Overflow via SIP To Header Tag
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
sipp · sipp13 Eyl 2026
CVE-2026-90779
34İzleyin
SIPp through 3.7.7 Stack Buffer Overflow via createAuthHeader Algorithm Parameter
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
sipp · sipp13 Eyl 2026
CVE-2026-90780
34İzleyin
SIPp through 3.7.7 Buffer Overflow via Oversized SIP Header Content
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
sipp · sipp13 Eyl 2026
CVE-2026-90781
19İzleyin
alsa-lib through 1.2.16.1 Off-by-One Stack Buffer Overflow in __snd_ctl_ascii_elem_id_parse()
OrtaCVSS 4,8Kavram kanıtıEPSS %0
alsa project · alsa-lib13 Eyl 2026
CVE-2026-90782
24İzleyin
S2OPC through 1.7.3 NULL Pointer Dereference in alloc_notification_message_items()
OrtaCVSS 6,0Kavram kanıtıEPSS %0
- Bellek hatası
systerel · s2opc13 Eyl 2026
CVE-2026-90783
34İzleyin
MKVToolNix through 101.0 Heap Buffer Overflow via avilib ODML Superindex Integer Wraparound
YüksekCVSS 8,5İstismar yokEPSS %0
moritz bunkus · mkvtoolnix13 Eyl 2026
CVE-2026-29811
30İzleyin
CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normal
YüksekCVSS 7,7İstismar yokEPSS %0
cyberpanel · cyberpanel13 Eyl 2026
CVE-2026-36453
29İzleyin
Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1.
YüksekCVSS 7,4İstismar yokEPSS %0
- Erişim denetimi (IDOR)
rhymix · rhymix13 Eyl 2026
CVE-2026-37008
32İzleyin
CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE
YüksekCVSS 8,1İstismar yokEPSS %0
crewai · crewai13 Eyl 2026
CVE-2026-74933
35İzleyin
GenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored XSS and Configuration Overwrite
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
- XSS
unknown · geniewords13 Eyl 2026
CVE-2026-81648
40Planlayın
CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router
KritikCVSS 10,0Kavram kanıtıEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
unknown · cryptopayment gateway13 Eyl 2026
CVE-2026-85129
35İzleyin
Hoo Companion 1.0.2 - Unauthenticated Stored XSS via Theme Settings Import
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
unknown · hoo companion13 Eyl 2026
CVE-2026-88793
35İzleyin
YouTube Embed 10.0 - 10.3 - Unauthenticated Stored XSS via youram_server
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
unknown · youtube embed13 Eyl 2026
CVE-2026-88802
30İzleyin
MDJM Event Management and Mobile Events Manager - Unauthenticated Arbitrary Post Deletion
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
unknown · mdjm event management13 Eyl 2026
CVE-2026-15891
30İzleyin
NULL pointer dereference in Zephyr MQTT-SN client when removing a non-responsive gateway
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
- Hizmet dışı bırakma
zephyrproject · zephyr13 Eyl 2026
CVE-2026-90605
34İzleyin
Totolink A3002MU boa formFilter buffer overflow
YüksekCVSS 8,6İstismar yokEPSS %0
- Bellek hatası
totolink · a3002mu13 Eyl 2026
CVE-2026-90606
34İzleyin
Totolink A3002MU boa formIpv6Setup buffer overflow
YüksekCVSS 8,6İstismar yokEPSS %0
- Bellek hatası
totolink · a3002mu13 Eyl 2026
CVE-2026-90607
34İzleyin
Totolink A3002MU boa formNewSchedule buffer overflow
YüksekCVSS 8,6İstismar yokEPSS %0
- Bellek hatası
totolink · a3002mu13 Eyl 2026
CVE-2026-90608
34İzleyin
Totolink A3002MU boa formPortFw buffer overflow
YüksekCVSS 8,6İstismar yokEPSS %0
- Bellek hatası
totolink · a3002mu13 Eyl 2026
CVE-2026-52296
28İzleyin
FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c.
YüksekCVSS 7,1İstismar yokEPSS %0
- Bellek hatası
ffmpeg · ffmpeg13 Eyl 2026
CVE-2026-52297
28İzleyin
FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in lib
YüksekCVSS 7,1İstismar yokEPSS %0
- Bellek hatası
ffmpeg · ffmpeg13 Eyl 2026
CVE-2026-23789
31İzleyin
An issue was discovered in MFC in Samsung Mobile Processor and Wearable Processor Exynos 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400
YüksekCVSS 7,8İstismar yokEPSS %0
- RCE
- Bellek hatası
samsung · exynos 850 firmware13 Eyl 2026
CVE-2026-31278
30İzleyin
An issue in the /api/v2/setting/adserversetting endpoint of Suprema BioStar 2 before 2.9.12 and and BioStar X before 1.0.2 allows attackers
YüksekCVSS 7,7Kavram kanıtıEPSS %0
- Zayıf kripto
supremainc · biostar 213 Eyl 2026
CVE-2026-33963
30İzleyin
An issue was discovered in camera in Samsung Mobile Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500, 2600, and 1680.
YüksekCVSS 7,5İstismar yokEPSS %0
- Bellek hatası
samsung · exynos 1330 firmware13 Eyl 2026
CVE-2026-90680
37İzleyin
D-Link DIR-823G HNAP1 SetStaticRouteSettings strcpy stack-based overflow
KritikCVSS 9,4İstismar yokEPSS %0
- Bellek hatası
d-link · dir-823g14 Eyl 2026
CVE-2023-28148
28İzleyin
A bodyclass XSS issue was discovered in Paessler PRTG before 23.3.86.1520.
YüksekCVSS 7,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
paessler · prtg network monitor14 Eyl 2026
CVE-2023-32803
30İzleyin
The ca-certificates package before ca-certificates-2021.2.50-72 for Amazon Linux 2 (AL2) does not properly remove certain TrustCor root cert
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
amazon · ca-certificates14 Eyl 2026
CVE-2023-45858
34İzleyin
A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that made it possible to read local files.
YüksekCVSS 8,6İstismar yokEPSS %0
- Kimlik doğrulamasız
- Yol geçişi
paessler · prtg network monitor14 Eyl 2026
CVE-2023-46273
35İzleyin
Bonjour Gateway in Extreme Networks IQ Engine before 10.6r1a, and through 10.6r4 before 10.6r5, has an ah_bgd buffer overflow via ah_event_s
YüksekCVSS 8,8İstismar yokEPSS %0
- Bellek hatası
extremenetworks · iq engine14 Eyl 2026
CVE-2023-50461
35İzleyin
An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3.
YüksekCVSS 8,8İstismar yokEPSS %0
- RCE
- Erişim denetimi (IDOR)
typo3 · direct_mail14 Eyl 2026
CVE-2026-68955
33İzleyin
The installer for Rakuten Kobo Desktop Application (Windows version) insecurely loads Dynamic Link Libraries.
YüksekCVSS 8,4İstismar yokEPSS %0
- RCE
- Yerel yetki yükseltme
rakuten kobo inc. · the installer for rakuten kobo desktop application (windows version)14 Eyl 2026
CVE-2026-71198
28İzleyin
In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image.
YüksekCVSS 7,0İstismar yokEPSS %0
- SSRF
openstack · glance14 Eyl 2026
CVE-2026-82762
35İzleyin
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec FX5000 series, FX4000 seri
YüksekCVSS 8,7İstismar yokEPSS %1
- RCE
- Komut enjeksiyonu
contec co., ltd. · fxa500014 Eyl 2026
CVE-2026-82765
34İzleyin
Path traversal vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series.
YüksekCVSS 8,6İstismar yokEPSS %0
- Yol geçişi
contec co., ltd. · fxa500014 Eyl 2026
CVE-2026-82766
35İzleyin
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SGA1000.
YüksekCVSS 8,7İstismar yokEPSS %1
- RCE
- Komut enjeksiyonu
contec co., ltd. · sga100014 Eyl 2026
CVE-2026-82768
34İzleyin
Path traversal vulnerability exists in SGA1000.
YüksekCVSS 8,6İstismar yokEPSS %0
- Yol geçişi
contec co., ltd. · sga100014 Eyl 2026
CVE-2026-82770
34İzleyin
Buffer overflow vulnerability exists in Contec RP-WAH-SR Series.
YüksekCVSS 8,7İstismar yokEPSS %0
- Bellek hatası
contec co., ltd. · rp-wah-sr114 Eyl 2026
CVE-2026-82772
34İzleyin
Buffer overflow vulnerability exists in Contec EC1000 series.
YüksekCVSS 8,7İstismar yokEPSS %0
- Bellek hatası
contec co., ltd. · ece100014 Eyl 2026
CVE-2026-82774
35İzleyin
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS M2M Gateway Series and
YüksekCVSS 8,7İstismar yokEPSS %1
- RCE
- Komut enjeksiyonu
contec co., ltd. · m2m gateway integrated type cps-mg341*14 Eyl 2026
CVE-2026-82777
35İzleyin
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS PAC Series.
YüksekCVSS 8,7İstismar yokEPSS %1
- RCE
- Komut enjeksiyonu
contec co., ltd. · integrated type cps-pc341[][]-*-920114 Eyl 2026
CVE-2026-82779
35İzleyin
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in CONPROSYS TM Series.
YüksekCVSS 8,7İstismar yokEPSS %1
- RCE
- Komut enjeksiyonu
contec co., ltd · cps-tm341g5mb-adsc1-93114 Eyl 2026
CVE-2026-82780
34İzleyin
Unrestricted upload of file with dangerous type issue exists in CONPROSYS TM Series.
YüksekCVSS 8,7İstismar yokEPSS %0
- Dosya yükleme
contec co., ltd · cps-tm341g5mb-adsc1-93114 Eyl 2026
CVE-2026-82786
32İzleyin
Insufficiently protected credentials issue exists in Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*.
YüksekCVSS 8,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bilgi sızıntısı
contec co., ltd. · remote i/o coupler unit (server type) cpsn-mcb271-*14 Eyl 2026
CVE-2026-82787
34İzleyin
Missing authentication for critical function vulnerability exists in CPSL-08P1EN.
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulama atlatma
contec co., ltd. · cpsl-08p1en14 Eyl 2026
CVE-2026-82789
34İzleyin
An improper neutralization of directives in dynamically evaluated code ('Eval Injection') issue exists in CONPROSYS HMI System(CHS).
YüksekCVSS 8,7İstismar yokEPSS %0
- RCE
contec · conprosys hmi system(chs)14 Eyl 2026
CVE-2026-82791
35İzleyin
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec CAN 2.0B Communication Wir
YüksekCVSS 8,7İstismar yokEPSS %1
- RCE
- Komut enjeksiyonu
contec co., ltd. · can-2-wf14 Eyl 2026
CVE-2026-82793
34İzleyin
Unrestricted upload of file with dangerous type issue exists in Contec CAN 2.0B Communication Wireless LAN / USB Converter Unit.
YüksekCVSS 8,6İstismar yokEPSS %0
- RCE
- Dosya yükleme
contec co., ltd. · can-2-wf14 Eyl 2026
CVE-2026-82794
35İzleyin
SolarView Compact contains an OS command Injection vulnerability in in Schedule Settings.
YüksekCVSS 8,7İstismar yokEPSS %1
- RCE
- Komut enjeksiyonu
contec co., ltd. · sv-cpt-mc31014 Eyl 2026
CVE-2026-85189
30İzleyin
Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla < 17.0.0
YüksekCVSS 7,5İstismar yokEPSS %0
- XSS
regularlabs.com · modals (free, pro) extension for joomla14 Eyl 2026
CVE-2026-85190
30İzleyin
Joomla Extension - regularlabs.com - Privileged stored XSS via class option in Quick Index extension for Joomla < 5.0.5
YüksekCVSS 7,5İstismar yokEPSS %0
- XSS
regularlabs.com · quick index (free, pro) extension for joomla14 Eyl 2026
CVE-2026-85191
30İzleyin
Joomla Extension - regularlabs.com - Privileged stored XSS via rtla-alias option in Tabs & Accordions extension for Joomla < 3.1.0
YüksekCVSS 7,5İstismar yokEPSS %0
- XSS
regularlabs.com · tabs & accordions (free, pro) extension for joomla14 Eyl 2026
CVE-2026-85192
37İzleyin
Joomla Extension - regularlabs.com - Authenticated, privileged remote code execution in Conditional Content extension for Joomla < 8.0.0
KritikCVSS 9,4İstismar yokEPSS %0
- RCE
regularlabs.com · conditional content pro extension for joomla14 Eyl 2026
CVE-2026-85195
30İzleyin
Joomla Extension - regularlabs.com - Privileged stored XSS via link option in Articles Anywhere extension for Joomla < 20.0.0
YüksekCVSS 7,5İstismar yokEPSS %0
- XSS
regularlabs.com · articles anywhere (free, pro) extension for joomla14 Eyl 2026
CVE-2026-88852
30İzleyin
Joomla Extension - regularlabs.com - Privileged stored XSS via url option in Snippets Free extension for Joomla < 7.0.0, Snippets Pro extension for Joomla < 11.
YüksekCVSS 7,5İstismar yokEPSS %0
- XSS
regularlabs.com · snippets (free) extension for joomla14 Eyl 2026
CVE-2026-88853
30İzleyin
Joomla Extension - regularlabs.com - Privileged stored XSS via event handler option in Modals Pro extension for Joomla < 17.0.0
YüksekCVSS 7,5İstismar yokEPSS %0
- XSS
regularlabs.com · modals (pro) extension for joomla14 Eyl 2026
CVE-2026-90688
28İzleyin
Tenda W20E HTTP formIPMacBindAdd stack-based overflow
YüksekCVSS 7,1İstismar yokEPSS %0
- Bellek hatası
tenda · w20e14 Eyl 2026
CVE-2026-90689
34İzleyin
Tenda W20E formDelWebAuthWhiteUser stack-based overflow
YüksekCVSS 8,7İstismar yokEPSS %0
- Bellek hatası
tenda · w20e14 Eyl 2026
CVE-2026-90692
37İzleyin
D-Link DIR-878 Dynamic DNS IPv6 Settings SetDynamicDNSIPv6Settings stack-based overflow
KritikCVSS 9,4İstismar yokEPSS %0
- Bellek hatası
d-link · dir-87814 Eyl 2026
CVE-2026-12518
34İzleyin
Local privilege escalation in the Logi Options+ updater service on Windows
YüksekCVSS 8,5İstismar yokEPSS %0
- RCE
- Yerel yetki yükseltme
logitech · logi options+14 Eyl 2026
CVE-2026-90693
37İzleyin
D-Link DIR-878 WAN Settings SetWan3Settings stack-based overflow
KritikCVSS 9,4İstismar yokEPSS %0
- Bellek hatası
d-link · dir-87814 Eyl 2026
CVE-2026-90699
35İzleyin
D-Link DWR-M920 formPinManageSetup sub_41E60C os command injection
YüksekCVSS 8,6İstismar yokEPSS %3
- RCE
- Komut enjeksiyonu
d-link · dwr-m92014 Eyl 2026
CVE-2026-72524
35İzleyin
Apache Doris: Authorization bypass allowing a low-privilege user to read/write/drop arbitrary tables
YüksekCVSS 8,8İstismar yokEPSS %0
- Erişim denetimi (IDOR)
apache software foundation · apache doris14 Eyl 2026
CVE-2026-90702
35İzleyin
D-Link DWR-M921 formDiskFormat system os command injection
YüksekCVSS 8,5İstismar yokEPSS %3
- RCE
- Komut enjeksiyonu
d-link · dwr-m92114 Eyl 2026
CVE-2026-90703
35İzleyin
D-Link DWR-M921 formDiskCreateShare system os command injection
YüksekCVSS 8,5İstismar yokEPSS %3
- RCE
- Komut enjeksiyonu
d-link · dwr-m92114 Eyl 2026
CVE-2026-90894
31İzleyin
Parallels Desktop local privilege escalation via appliance extract argument injection
YüksekCVSS 7,8İstismar yokEPSS %0
- RCE
- Yerel yetki yükseltme
- Komut enjeksiyonu
parallels · parallels desktop for mac14 Eyl 2026
CVE-2026-90895
33İzleyin
MISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection
YüksekCVSS 8,4İstismar yokEPSS %0
misp · misp14 Eyl 2026
CVE-2026-20773
34İzleyin
Improper Authorization in PingFederate Administrative Expression Evaluation Endpoint
YüksekCVSS 8,5İstismar yokEPSS %0
- Erişim denetimi (IDOR)
ping identity · pingfederate14 Eyl 2026
CVE-2026-78375
34İzleyin
Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6.9.0
YüksekCVSS 8,6İstismar yokEPSS %0
- SQL enjeksiyonu
joomshaper.com · sp page builder (free and pro) extension for joomla14 Eyl 2026
CVE-2026-81564
28İzleyin
Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0
YüksekCVSS 7,0İstismar yokEPSS %0
- Yol geçişi
joomshaper.com · sp page builder (free and pro) extension for joomla14 Eyl 2026
CVE-2026-82232
39İzleyin
Apache Syncope: SQL injection via sort parameter in Task search
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- SQL enjeksiyonu
apache software foundation · apache syncope14 Eyl 2026
CVE-2026-86460
39İzleyin
Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- SQL enjeksiyonu
apache software foundation · apache syncope14 Eyl 2026
CVE-2026-87779
30İzleyin
Apache Syncope: AES Secret Key disclosure via log output
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bilgi sızıntısı
apache software foundation · apache syncope14 Eyl 2026
CVE-2026-87785
36İzleyin
Apache Syncope: JWT subject spoofing
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
apache software foundation · apache syncope14 Eyl 2026
CVE-2026-87802
36İzleyin
Apache Syncope: SRA OAuth2 JWT signature verification bypass
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- Zayıf kripto
apache software foundation · apache syncope14 Eyl 2026
CVE-2026-89180
34İzleyin
Thinking Software Technology｜EFence - SQL Injection
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- SQL enjeksiyonu
thinking software technology · efence14 Eyl 2026
CVE-2026-90898
40Planlayın
Bifrost unauthenticated remote code execution via MCP stdio client registration
KritikCVSS 9,8Kavram kanıtıEPSS %2
- Girişsiz RCE
- Erişim denetimi (IDOR)
maximhq · bifrost14 Eyl 2026
CVE-2026-21391
38İzleyin
Improper Claim Validation in PingAM OIDC Provider
KritikCVSS 9,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
ping identity · pingam14 Eyl 2026
CVE-2026-90919
37İzleyin
LightLLM through 1.2.0 Unauthenticated Remote Code Execution via Config Server Pickle Deserialization
KritikCVSS 9,3İstismar yokEPSS %1
- Girişsiz RCE
- Deserializasyon
modeltc · lightllm14 Eyl 2026
CVE-2026-12258
36İzleyin
Inadequate access control in the Hiperdino REST API
KritikCVSS 9,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
hiperdino · rest api14 Eyl 2026
CVE-2026-73178
30İzleyin
Apache Syncope: JWT Access Token takeover
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bilgi sızıntısı
apache software foundation · apache syncope14 Eyl 2026
CVE-2026-73470
39İzleyin
Apache Syncope: Delegating users can grant unowned Roles
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
apache software foundation · apache syncope14 Eyl 2026
CVE-2026-73579
39İzleyin
Apache Syncope: Non-recursive Any search could skip Realms restrictions
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
apache software foundation · apache syncope14 Eyl 2026
CVE-2026-73668
39İzleyin
Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
apache software foundation · apache syncope14 Eyl 2026
CVE-2026-75030
39İzleyin
Apache Syncope: Incomplete authorization checks for Group members deprovisioning
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
apache software foundation · apache syncope14 Eyl 2026
CVE-2026-77051
39İzleyin
Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- SQL enjeksiyonu
apache software foundation · apache syncope14 Eyl 2026
CVE-2026-77181
39İzleyin
Apache Syncope: ClientApp update entitlement not effective
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
apache software foundation · apache syncope14 Eyl 2026
CVE-2026-78299
36İzleyin
In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract f
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- Yol geçişi
eclipse foundation · eclipse embedded cdt (c/c++ development tools)14 Eyl 2026
CVE-2026-78330
39İzleyin
Apache Syncope: Privilege escalation for admin user via JWT authentication
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
apache software foundation · apache syncope14 Eyl 2026
CVE-2026-78336
30İzleyin
Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
apache software foundation · apache syncope14 Eyl 2026
CVE-2026-90927
28İzleyin
filebrowser through 2.63.23 Denial of Service via unbounded WebSocket message
YüksekCVSS 7,1İstismar yokEPSS %0
- Hizmet dışı bırakma
filebrowser · filebrowser14 Eyl 2026
CVE-2026-90928
28İzleyin
File Browser through 2.63.23 Memory Exhaustion via subtitle endpoint
YüksekCVSS 7,1İstismar yokEPSS %0
- Hizmet dışı bırakma
filebrowser · filebrowser14 Eyl 2026
CVE-2026-90929
28İzleyin
File Browser 2.5.0 Directory Deletion via Upload Failure Cleanup
YüksekCVSS 7,2İstismar yokEPSS %0
- Erişim denetimi (IDOR)
filebrowser · filebrowser14 Eyl 2026
CVE-2026-90930
30İzleyin
File Browser through 2.63.23 Path Traversal via Symlink Alias
YüksekCVSS 7,6İstismar yokEPSS %0
- Yol geçişi
filebrowser · filebrowser14 Eyl 2026
CVE-2026-90932
34İzleyin
LaraDashboard 0.9.2 through 1.2.2 Path Traversal RCE
YüksekCVSS 8,6İstismar yokEPSS %0
- RCE
- Yol geçişi
laradashboard · laradashboard14 Eyl 2026
CVE-2026-90933
28İzleyin
laradashboard through 1.2.2 Missing Authorization via License API
YüksekCVSS 7,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
laradashboard · laradashboard14 Eyl 2026
CVE-2026-90934
34İzleyin
EspoCRM before 10.0.4 Field-level Security Bypass via Attendees
YüksekCVSS 8,7İstismar yokEPSS %0
- Erişim denetimi (IDOR)
espocrm · espocrm14 Eyl 2026
CVE-2026-90937
37İzleyin
froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL
KritikCVSS 9,4İstismar yokEPSS %0
froxlor · froxlor14 Eyl 2026
CVE-2026-90938
35İzleyin
LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocket
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
langbot-app · langbot14 Eyl 2026