Yayın tarihine göre
Eylül 2026: sömürülen ve yeni ciddi CVE kayıtları
7.955 kayıt · 32 KEV. Yayın sırasıyla.
Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.
Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.
Sayfa 33 / 80
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
20İzleyin | CVE-2026-90957İstismar yok | MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Picturesmisp · misp · CWE-79 | Orta5,1 | — | %0,3 | 14 Eyl 2026 |
29İzleyin | CVE-2026-73195İstismar yok | Apache Syncope: CSV export spreadsheet formula injectionapache software foundation · apache syncope · CWE-116 | Yüksek7,3 | — | %0,3 | 14 Eyl 2026 |
30İzleyin | CVE-2026-73236İstismar yok | Apache Syncope: Cross-Realm authorization bypass in delegated administrationapache software foundation · apache syncope · CWE-863 | Yüksek7,5 | — | %0,3 | 14 Eyl 2026 |
39İzleyin | CVE-2026-73370İstismar yok | Apache Syncope: Cross-Realm boundaries reconciliation bypassapache software foundation · apache syncope · CWE-863 | Kritik9,8 | — | %0,5 | 14 Eyl 2026 |
39İzleyin | CVE-2026-82439İstismar yok | Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPCapache software foundation · apache storm drpc · CWE-770 | Kritik9,8 | — | %0,3 | 14 Eyl 2026 |
36İzleyin | CVE-2026-82441İstismar yok | Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keysapache software foundation · apache storm nimbus · CWE-20 | Kritik9,1 | — | %0,2 | 14 Eyl 2026 |
28İzleyin | CVE-2026-90939İstismar yok | novel-plus through 5.3.3 Missing Authorization on the Admin /sys/user/list Endpoint201206030 · novel-plus · CWE-862 | Yüksek7,1 | — | %0,4 | 14 Eyl 2026 |
37İzleyin | CVE-2026-90961İstismar yok | MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentialsmisp · misp · CWE-20 | Kritik9,3 | — | %0,6 | 14 Eyl 2026 |
34İzleyin | CVE-2026-15600İstismar yok | SQL Injection in Alior Bank raty PrestaShop modulealior bank · raty · CWE-89 | Yüksek8,6 | — | %0,2 | 14 Eyl 2026 |
32İzleyin | CVE-2026-25687İstismar yok | ZCC race condition in ZPA tunnel handlerzscaler · client connector · CWE-366 | Yüksek8,1 | — | %0,3 | 14 Eyl 2026 |
26İzleyin | CVE-2026-57115İstismar yok | PraisonAI: SpiderTools redirect-target SSRF protection bypassmervinpraison · praisonai · CWE-918 | Orta6,5 | — | %0,4 | 14 Eyl 2026 |
39İzleyin | CVE-2026-57123İstismar yok | PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired inmervinpraison · praisonaiagents · CWE-306 | Kritik9,8 | — | %0,9 | 14 Eyl 2026 |
39İzleyin | CVE-2026-57125İstismar yok | PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypassmervinpraison · praisonai · CWE-306 | Kritik9,8 | — | %0,6 | 14 Eyl 2026 |
34İzleyin | CVE-2026-57126İstismar yok | praisonaiagents: SSRF guard validates literal IPs only and never resolves DNSmervinpraison · praisonai · CWE-918 | Yüksek8,5 | — | %0,3 | 14 Eyl 2026 |
28İzleyin | CVE-2026-8821İstismar yok | Playbooks run owner channel membership permission bypassmattermost · mattermost server · CWE-862 | Yüksek7,1 | — | %0,2 | 14 Eyl 2026 |
32İzleyin | CVE-2026-57130İstismar yok | PraisonAI: IMAP Command Injection via Unsanitized Email Search Parametersmervinpraison · praisonaiagents · CWE-20 | Yüksek8,1 | — | %0,4 | 14 Eyl 2026 |
32İzleyin | CVE-2026-59569İstismar yok | Android ZCC VPN API method privilege escalationzscaler · client connector · CWE-20 | Yüksek8,1 | — | %0,1 | 14 Eyl 2026 |
30İzleyin | CVE-2026-59570İstismar yok | Android ZCC denial of servicezscaler · client connector · CWE-20 | Yüksek7,5 | — | %0,1 | 14 Eyl 2026 |
34İzleyin | CVE-2026-7848İstismar yok | SQL Injection in Alior Bank raty PrestaShop modulealior bank · raty · CWE-89 | Yüksek8,6 | — | %0,3 | 14 Eyl 2026 |
31İzleyin | CVE-2026-82427İstismar yok | Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Nameapache software foundation · apache storm nimbus · CWE-22 | Yüksek7,8 | — | %0,1 | 14 Eyl 2026 |
35İzleyin | CVE-2026-82428İstismar yok | Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keysapache software foundation · apache storm client · CWE-22 | Yüksek8,8 | — | %0,6 | 14 Eyl 2026 |
31İzleyin | CVE-2026-82429İstismar yok | Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcherapache software foundation · apache storm worker launcher · CWE-367 | Yüksek7,8 | — | %0,1 | 14 Eyl 2026 |
31İzleyin | CVE-2026-82430İstismar yok | Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenantapache software foundation · apache storm worker launcher · CWE-367 | Yüksek7,8 | — | %0,1 | 14 Eyl 2026 |
39İzleyin | CVE-2026-82431İstismar yok | Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.usersapache software foundation · apache storm client · CWE-863 | Kritik9,8 | — | %0,3 | 14 Eyl 2026 |
32İzleyin | CVE-2026-82432İstismar yok | Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overridesapache software foundation · apache storm nimbus · CWE-863 | Yüksek8,1 | — | %0,3 | 14 Eyl 2026 |
40Planlayın | CVE-2026-82434İstismar yok | Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logsapache software foundation · apache storm nimbus · CWE-522 | Kritik10,0 | — | %0,5 | 14 Eyl 2026 |
39İzleyin | CVE-2026-82435İstismar yok | Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoderapache software foundation · apache storm worker · CWE-789 | Kritik9,8 | — | %0,6 | 14 Eyl 2026 |
32İzleyin | CVE-2026-82438İstismar yok | Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Originsapache software foundation · apache storm webapp · CWE-346 | Yüksek8,1 | — | %0,2 | 14 Eyl 2026 |
30İzleyin | CVE-2026-47701İstismar yok | OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer authopen-telemetry · opentelemetry-operator · CWE-200 | Yüksek7,7 | — | %0,4 | 14 Eyl 2026 |
29İzleyin | CVE-2026-56839İstismar yok | PraisonAI Code agent tools fail open without a workspace boundarymervinpraison · praisonai · CWE-22 | Yüksek7,3 | — | %0,3 | 14 Eyl 2026 |
30İzleyin | CVE-2026-57119İstismar yok | PraisonAI: Unauthenticated Local File Inclusion via agent_file path in the Jobs APImervinpraison · praisonai · CWE-22 | Yüksek7,5 | — | %0,5 | 14 Eyl 2026 |
34İzleyin | CVE-2026-57122İstismar yok | PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)mervinpraison · praisonai · CWE-345 | Yüksek8,6 | — | %0,1 | 14 Eyl 2026 |
39İzleyin | CVE-2026-57124İstismar yok | PraisonAI UI MCP connect endpoint allows unauthenticated local command executionmervinpraison · praisonai · CWE-78 | Kritik9,8 | — | %1,0 | 14 Eyl 2026 |
39İzleyin | CVE-2026-57127İstismar yok | praisonai: recipe serve auth middleware silently disables itself when no secret is setmervinpraison · praisonai · CWE-306 | Kritik9,8 | — | %0,9 | 14 Eyl 2026 |
39İzleyin | CVE-2026-57131İstismar yok | praisonai: Jobs API exposes agent-execution endpoints with no authenticationmervinpraison · praisonai · CWE-94 | Kritik9,8 | — | %0,9 | 14 Eyl 2026 |
32İzleyin | CVE-2026-57132İstismar yok | PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authenticationmervinpraison · praisonai · CWE-287 | Yüksek8,2 | — | %0,5 | 14 Eyl 2026 |
36İzleyin | CVE-2026-57145İstismar yok | PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validationmervinpraison · praisonai · CWE-22 | Kritik9,1 | — | %0,5 | 14 Eyl 2026 |
34İzleyin | CVE-2026-81301İstismar yok | Ekia File Manager 1.2.7 - Exported ContentProvider allows unauthorized file accessekia · file manager · CWE-926 | Yüksek8,5 | — | %0,1 | 14 Eyl 2026 |
37İzleyin | CVE-2026-90943İstismar yok | parallax filament-comments through 3.0.0 Stored XSS via Comment Bodyparallax · filament-comments · CWE-79 | Kritik9,3 | — | %0,4 | 14 Eyl 2026 |
33İzleyin | CVE-2024-58383İstismar yok | Froxlor before 2.2.0 Insecure File Permissions mysql.conffroxlor · froxlor · CWE-732 | Yüksek8,4 | — | %0,1 | 14 Eyl 2026 |
39İzleyin | CVE-2026-20353İstismar yok | Cisco Secure Email Gateway Security Hardening Releasecisco · cisco secure email · CWE-664 | Kritik9,8 | — | %0,3 | 14 Eyl 2026 |
34İzleyin | CVE-2026-55072İstismar yok | Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table namepimcore · pimcore · CWE-20 | Yüksek8,5 | — | %0,4 | 14 Eyl 2026 |
35İzleyin | CVE-2026-55416İstismar yok | Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterizationpimcore · pimcore · CWE-89 | Yüksek8,8 | — | %0,6 | 14 Eyl 2026 |
39İzleyin | CVE-2026-76440İstismar yok | Cisco Secure Email Gateway Security Hardening Releasecisco · cisco secure email · CWE-23 | Kritik9,8 | — | %0,6 | 14 Eyl 2026 |
39İzleyin | CVE-2026-76441İstismar yok | Cisco Secure Email Gateway Security Hardening Releasecisco · cisco secure email and web manager · CWE-284 | Kritik9,8 | — | %0,5 | 14 Eyl 2026 |
30İzleyin | CVE-2026-76442İstismar yok | Cisco Secure Email Gateway Security Hardening Releasecisco · cisco secure email · CWE-1284 | Yüksek7,5 | — | %0,4 | 14 Eyl 2026 |
39İzleyin | CVE-2026-76443İstismar yok | Cisco Secure Email Gateway Security Hardening Releasecisco · cisco secure email · CWE-707 | Kritik9,8 | — | %0,5 | 14 Eyl 2026 |
78Bu hafta | CVE-2026-76461Silahlaştırılmış | Cisco Secure Email Gateway SQL Injection Vulnerabilitycisco · asyncos · CWE-89 | Kritik9,8 | KEV | %29,5 | 14 Eyl 2026 |
34İzleyin | CVE-2026-84445İstismar yok | gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS serversgrpc · grpc-go · CWE-129 | Yüksek8,7 | — | %0,6 | 14 Eyl 2026 |
31İzleyin | CVE-2026-90948İstismar yok | Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensionsred hat · red hat enterprise linux 6 · CWE-787 | Yüksek7,8 | — | %0,2 | 14 Eyl 2026 |
31İzleyin | CVE-2026-90949İstismar yok | Gimp: gimp: heap-based buffer overflow in psp loader due to selection-channel geometry mismatchred hat · red hat enterprise linux 6 · CWE-787 | Yüksek7,8 | — | %0,3 | 14 Eyl 2026 |
30İzleyin | CVE-2026-19499İstismar yok | Buffer overflow in strfmon and strfmon_l right-justification paddingthe gnu c library · glibc · CWE-122 | Yüksek7,7 | — | %0,2 | 14 Eyl 2026 |
30İzleyin | CVE-2026-50276İstismar yok | dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoSdatadog · dd-trace-rb · CWE-770 | Yüksek7,5 | — | %0,7 | 14 Eyl 2026 |
31İzleyin | CVE-2026-85892İstismar yok | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerabilitymicrosoft · edge chromium · CWE-362 | Yüksek7,8 | — | %0,2 | 14 Eyl 2026 |
33İzleyin | CVE-2026-86836İstismar yok | In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predictaeclipse foundation · eclipse ankaios · CWE-276 | Yüksek8,4 | — | %0,1 | 14 Eyl 2026 |
37İzleyin | CVE-2026-90942İstismar yok | Casdoor through 4.4.0 Private Key Exposure via Certificate Endpointscasdoor · casdoor · CWE-863 | Kritik9,3 | — | %0,2 | 14 Eyl 2026 |
35İzleyin | CVE-2026-90944İstismar yok | Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parsekrayin · laravel-crm · CWE-306 | Yüksek8,8 | — | %0,6 | 14 Eyl 2026 |
37İzleyin | CVE-2026-90945İstismar yok | Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secretcrawlab-team · crawlab · CWE-321 | Kritik9,3 | — | %0,7 | 14 Eyl 2026 |
34İzleyin | CVE-2026-90946İstismar yok | DeepWiki-Open through commit d92819a Arbitrary File Read via /ws/chat WebSocketasyncfuncai · deepwiki-open · CWE-73 | Yüksek8,7 | — | %0,5 | 14 Eyl 2026 |
34İzleyin | CVE-2026-91080İstismar yok | webhook through 2.8.3 Memory Exhaustion via Oversized Request Bodyadnanh · webhook · CWE-770 | Yüksek8,7 | — | %0,6 | 14 Eyl 2026 |
37İzleyin | CVE-2026-12985İstismar yok | Mattermost DCR redirect URI allowlist bypass via improper URL component validationmattermost · mattermost server · CWE-601 | Kritik9,3 | — | %0,2 | 14 Eyl 2026 |
30İzleyin | CVE-2026-57129İstismar yok | PraisonAI: Arbitrary File Read via `@file:` Mention Path Traversalmervinpraison · praisonaiagents · CWE-22 | Yüksek7,5 | — | %0,5 | 14 Eyl 2026 |
28İzleyin | CVE-2026-77884İstismar yok | Gallery - Private Photo Vault 1.0.41 - Unauthenticated local-network HTTP file exposurebrain trust · gallery - private photo vault · CWE-552 | Yüksek7,1 | — | %0,2 | 14 Eyl 2026 |
28İzleyin | CVE-2026-82035İstismar yok | PyMuPDF 1.28.2 Path Traversal via extract_objects() Font Branchpymupdf · pymupdf · CWE-22 | Yüksek7,1 | — | %0,3 | 14 Eyl 2026 |
35İzleyin | CVE-2026-89023İstismar yok | ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST APIthemeatelier · domain for sale · CWE-862 | Yüksek8,8 | — | %0,3 | 14 Eyl 2026 |
30İzleyin | CVE-2026-15955İstismar yok | IBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of file pathsibm · db2 · CWE-22 | Yüksek7,5 | — | %0,3 | 14 Eyl 2026 |
31İzleyin | CVE-2026-17133İstismar yok | IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEsibm · app connect enterprise · CWE-78 | Yüksek7,8 | — | %0,1 | 14 Eyl 2026 |
31İzleyin | CVE-2026-17156İstismar yok | IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEsibm · app connect enterprise · CWE-502 | Yüksek7,8 | — | %0,1 | 14 Eyl 2026 |
31İzleyin | CVE-2026-17416İstismar yok | IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEsibm · app connect enterprise · CWE-502 | Yüksek7,8 | — | %0,1 | 14 Eyl 2026 |
32İzleyin | CVE-2026-17467İstismar yok | Vulnerabilities exists in IBM Cloud Pak for Data Systemibm · cloud pak for data system (yosemite 1.0) · CWE-327 | Yüksek8,2 | — | %0,2 | 14 Eyl 2026 |
28İzleyin | CVE-2026-18119İstismar yok | Concrete CMS below 9.5.3 is vulnerable to Stored XSS via unsanitized inline block custom style valuesconcretecms · concrete cms · CWE-79 | Yüksek7,0 | — | %0,3 | 14 Eyl 2026 |
31İzleyin | CVE-2026-19624İstismar yok | NetworkManager-l2tp: local privilege escalation via ipsec.conf injectionfedora · fedora · CWE-88 | Yüksek7,8 | — | %0,1 | 14 Eyl 2026 |
28İzleyin | CVE-2026-19816İstismar yok | PackageKit: dnf5 backend ignores SIMULATE on RepoRemovefedora · fedora · CWE-863 | Yüksek7,1 | — | %0,1 | 14 Eyl 2026 |
32İzleyin | CVE-2026-65838İstismar yok | Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload zalando · skipper · CWE-754 | Yüksek8,2 | — | %0,4 | 14 Eyl 2026 |
34İzleyin | CVE-2026-82028İstismar yok | Magistrala < 1.0.0 SQL Injection via format Parameter in Reader APIabsmach · magistrala · CWE-89 | Yüksek8,7 | — | %0,5 | 14 Eyl 2026 |
36İzleyin | CVE-2026-61534İstismar yok | Yayson: Prototype pollution in the Store/LegacyStore deserializationconfetti · yayson · CWE-1321 | Kritik9,1 | — | %0,8 | 14 Eyl 2026 |
31İzleyin | CVE-2026-90947İstismar yok | Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset filered hat · red hat enterprise linux 6 · CWE-787 | Yüksek7,8 | — | %0,1 | 14 Eyl 2026 |
28İzleyin | CVE-2026-13107İstismar yok | Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026ibm · business automation workflow containers and traditional · CWE-611 | Yüksek7,1 | — | %0,2 | 14 Eyl 2026 |
30İzleyin | CVE-2026-13260İstismar yok | Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Accessibm · verify identity access · CWE-770 | Yüksek7,5 | — | %0,4 | 14 Eyl 2026 |
28İzleyin | CVE-2026-13275İstismar yok | IBM MQ Managed File Transfer is vulnerable to XML external entity injectionibm · mq · CWE-611 | Yüksek7,1 | — | %0,2 | 14 Eyl 2026 |
28İzleyin | CVE-2026-13285İstismar yok | IBM MQ Managed File Transfer is vulnerable to XML external entity injectionibm · mq · CWE-611 | Yüksek7,1 | — | %0,3 | 14 Eyl 2026 |
28İzleyin | CVE-2026-13287İstismar yok | IBM MQ Managed File Transfer is vulnerable to XML external entity injectionibm · mq · CWE-611 | Yüksek7,1 | — | %0,3 | 14 Eyl 2026 |
35İzleyin | CVE-2026-13293İstismar yok | IBM MQ Java messaging is vulnerable to remote code executionibm · mq · CWE-502 | Yüksek8,8 | — | %0,6 | 14 Eyl 2026 |
30İzleyin | CVE-2026-19290İstismar yok | IBM Sterling File Gateway is Vulnerable to Improper Access Controlibm · sterling file gateway · CWE-284 | Yüksek7,5 | — | %0,4 | 14 Eyl 2026 |
28İzleyin | CVE-2026-20683İstismar yok | An authentication issue was addressed with improved state management.apple · ipados · CWE-287 | Yüksek7,1 | — | %0,1 | 14 Eyl 2026 |
30İzleyin | CVE-2026-28935İstismar yok | The issue was addressed with improved memory handling.apple · ipados · CWE-119 | Yüksek7,5 | — | %0,4 | 14 Eyl 2026 |
30İzleyin | CVE-2026-28938İstismar yok | A privacy issue was addressed by moving sensitive data.apple · ipados · CWE-359 | Yüksek7,5 | — | %0,3 | 14 Eyl 2026 |
30İzleyin | CVE-2026-28960İstismar yok | A denial-of-service issue was addressed with improved validation.apple · ipados · CWE-20 | Yüksek7,5 | — | %0,5 | 14 Eyl 2026 |
28İzleyin | CVE-2026-43683İstismar yok | An out-of-bounds read was addressed with improved bounds checking.apple · macos · CWE-125 | Yüksek7,1 | — | %0,1 | 14 Eyl 2026 |
31İzleyin | CVE-2026-43684İstismar yok | A use-after-free issue was addressed with improved memory management.apple · ipados · CWE-416 | Yüksek7,8 | — | %0,1 | 14 Eyl 2026 |
35İzleyin | CVE-2026-43686İstismar yok | A use-after-free issue was addressed with improved memory management.apple · ipados · CWE-416 | Yüksek8,8 | — | %0,5 | 14 Eyl 2026 |
26İzleyin | CVE-2026-43687Kavram kanıtı | The issue was addressed with improved memory handling.apple · ipados · CWE-200 | Orta6,5 | — | %0,4 | 14 Eyl 2026 |
31İzleyin | CVE-2026-43688İstismar yok | A memory corruption issue was addressed with improved input validation.apple · ipados · CWE-1021 | Yüksek7,8 | — | %0,1 | 14 Eyl 2026 |
31İzleyin | CVE-2026-43689İstismar yok | A permissions issue was addressed with additional restrictions.apple · ipados · CWE-862 | Yüksek7,8 | — | %0,1 | 14 Eyl 2026 |
31İzleyin | CVE-2026-43691İstismar yok | A path handling issue was addressed with improved validation.apple · macos · CWE-22 | Yüksek7,8 | — | %0,1 | 14 Eyl 2026 |
35İzleyin | CVE-2026-43692İstismar yok | A validation issue was addressed with improved input sanitization.apple · macos · CWE-20 | Yüksek8,8 | — | %0,6 | 14 Eyl 2026 |
28İzleyin | CVE-2026-43697İstismar yok | An out-of-bounds read was addressed with improved bounds checking.apple · macos · CWE-125 | Yüksek7,1 | — | %0,3 | 14 Eyl 2026 |
31İzleyin | CVE-2026-43702İstismar yok | The issue was addressed with improved memory handling.apple · ipados · CWE-119 | Yüksek7,8 | — | %0,1 | 14 Eyl 2026 |
31İzleyin | CVE-2026-43783Kavram kanıtı | A race condition was addressed with improved locking.apple · macos · CWE-362 | Yüksek7,8 | — | %0,1 | 14 Eyl 2026 |
31İzleyin | CVE-2026-43786Kavram kanıtı | This issue was addressed with additional entitlement checks.apple · macos · CWE-280 | Yüksek7,8 | — | %0,1 | 14 Eyl 2026 |
- CVE-2026-9095720İzleyin
MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures
OrtaCVSS 5,1İstismar yokEPSS %0misp · misp14 Eyl 2026
- CVE-2026-7319529İzleyin
Apache Syncope: CSV export spreadsheet formula injection
YüksekCVSS 7,3İstismar yokEPSS %0apache software foundation · apache syncope14 Eyl 2026
- CVE-2026-7323630İzleyin
Apache Syncope: Cross-Realm authorization bypass in delegated administration
YüksekCVSS 7,5İstismar yokEPSS %0apache software foundation · apache syncope14 Eyl 2026
- CVE-2026-7337039İzleyin
Apache Syncope: Cross-Realm boundaries reconciliation bypass
KritikCVSS 9,8İstismar yokEPSS %0apache software foundation · apache syncope14 Eyl 2026
- CVE-2026-8243939İzleyin
Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC
KritikCVSS 9,8İstismar yokEPSS %0apache software foundation · apache storm drpc14 Eyl 2026
- CVE-2026-8244136İzleyin
Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys
KritikCVSS 9,1İstismar yokEPSS %0apache software foundation · apache storm nimbus14 Eyl 2026
- CVE-2026-9093928İzleyin
novel-plus through 5.3.3 Missing Authorization on the Admin /sys/user/list Endpoint
YüksekCVSS 7,1İstismar yokEPSS %0201206030 · novel-plus14 Eyl 2026
- CVE-2026-9096137İzleyin
MISP LdapAuth and LinOTPAuth Authentication Bypass via Empty or Non-String Credentials
KritikCVSS 9,3İstismar yokEPSS %0misp · misp14 Eyl 2026
- CVE-2026-1560034İzleyin
SQL Injection in Alior Bank raty PrestaShop module
YüksekCVSS 8,6İstismar yokEPSS %0alior bank · raty14 Eyl 2026
- CVE-2026-2568732İzleyin
ZCC race condition in ZPA tunnel handler
YüksekCVSS 8,1İstismar yokEPSS %0zscaler · client connector14 Eyl 2026
- CVE-2026-5711526İzleyin
PraisonAI: SpiderTools redirect-target SSRF protection bypass
OrtaCVSS 6,5İstismar yokEPSS %0mervinpraison · praisonai14 Eyl 2026
- CVE-2026-5712339İzleyin
PraisonAI: MCP SSE transport binds 0.0.0.0 with no authentication and no Origin validation; bundled SecurityConfig is never wired in
KritikCVSS 9,8İstismar yokEPSS %0mervinpraison · praisonaiagents14 Eyl 2026
- CVE-2026-5712539İzleyin
PraisonAI: Unauthenticated RCE via Jobs API + Approval Bypass
KritikCVSS 9,8İstismar yokEPSS %0mervinpraison · praisonai14 Eyl 2026
- CVE-2026-5712634İzleyin
praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS
YüksekCVSS 8,5İstismar yokEPSS %0mervinpraison · praisonai14 Eyl 2026
- CVE-2026-882128İzleyin
Playbooks run owner channel membership permission bypass
YüksekCVSS 7,1İstismar yokEPSS %0mattermost · mattermost server14 Eyl 2026
- CVE-2026-5713032İzleyin
PraisonAI: IMAP Command Injection via Unsanitized Email Search Parameters
YüksekCVSS 8,1İstismar yokEPSS %0mervinpraison · praisonaiagents14 Eyl 2026
- CVE-2026-5956932İzleyin
Android ZCC VPN API method privilege escalation
YüksekCVSS 8,1İstismar yokEPSS %0zscaler · client connector14 Eyl 2026
- CVE-2026-5957030İzleyin
Android ZCC denial of service
YüksekCVSS 7,5İstismar yokEPSS %0zscaler · client connector14 Eyl 2026
- CVE-2026-784834İzleyin
SQL Injection in Alior Bank raty PrestaShop module
YüksekCVSS 8,6İstismar yokEPSS %0alior bank · raty14 Eyl 2026
- CVE-2026-8242731İzleyin
Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name
YüksekCVSS 7,8İstismar yokEPSS %0apache software foundation · apache storm nimbus14 Eyl 2026
- CVE-2026-8242835İzleyin
Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys
YüksekCVSS 8,8İstismar yokEPSS %0apache software foundation · apache storm client14 Eyl 2026
- CVE-2026-8242931İzleyin
Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher
YüksekCVSS 7,8İstismar yokEPSS %0apache software foundation · apache storm worker launcher14 Eyl 2026
- CVE-2026-8243031İzleyin
Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant
YüksekCVSS 7,8İstismar yokEPSS %0apache software foundation · apache storm worker launcher14 Eyl 2026
- CVE-2026-8243139İzleyin
Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users
KritikCVSS 9,8İstismar yokEPSS %0apache software foundation · apache storm client14 Eyl 2026
- CVE-2026-8243232İzleyin
Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides
YüksekCVSS 8,1İstismar yokEPSS %0apache software foundation · apache storm nimbus14 Eyl 2026
- CVE-2026-8243440Planlayın
Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs
KritikCVSS 10,0İstismar yokEPSS %0apache software foundation · apache storm nimbus14 Eyl 2026
- CVE-2026-8243539İzleyin
Apache Storm Worker: Unauthenticated Remote Memory Exhaustion in the Worker Messaging Decoder
KritikCVSS 9,8İstismar yokEPSS %0apache software foundation · apache storm worker14 Eyl 2026
- CVE-2026-8243832İzleyin
Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins
YüksekCVSS 8,1İstismar yokEPSS %0apache software foundation · apache storm webapp14 Eyl 2026
- CVE-2026-4770130İzleyin
OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth
YüksekCVSS 7,7İstismar yokEPSS %0open-telemetry · opentelemetry-operator14 Eyl 2026
- CVE-2026-5683929İzleyin
PraisonAI Code agent tools fail open without a workspace boundary
YüksekCVSS 7,3İstismar yokEPSS %0mervinpraison · praisonai14 Eyl 2026
- CVE-2026-5711930İzleyin
PraisonAI: Unauthenticated Local File Inclusion via agent_file path in the Jobs API
YüksekCVSS 7,5İstismar yokEPSS %0mervinpraison · praisonai14 Eyl 2026
- CVE-2026-5712234İzleyin
PraisonAI: Webhook signature verification skipped (fail-open) when secret unset, allowing forged inbound webhooks (WhatsApp & Linear bots)
YüksekCVSS 8,6İstismar yokEPSS %0mervinpraison · praisonai14 Eyl 2026
- CVE-2026-5712439İzleyin
PraisonAI UI MCP connect endpoint allows unauthenticated local command execution
KritikCVSS 9,8İstismar yokEPSS %1mervinpraison · praisonai14 Eyl 2026
- CVE-2026-5712739İzleyin
praisonai: recipe serve auth middleware silently disables itself when no secret is set
KritikCVSS 9,8İstismar yokEPSS %0mervinpraison · praisonai14 Eyl 2026
- CVE-2026-5713139İzleyin
praisonai: Jobs API exposes agent-execution endpoints with no authentication
KritikCVSS 9,8İstismar yokEPSS %0mervinpraison · praisonai14 Eyl 2026
- CVE-2026-5713232İzleyin
PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication
YüksekCVSS 8,2İstismar yokEPSS %0mervinpraison · praisonai14 Eyl 2026
- CVE-2026-5714536İzleyin
PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation
KritikCVSS 9,1İstismar yokEPSS %0mervinpraison · praisonai14 Eyl 2026
- CVE-2026-8130134İzleyin
Ekia File Manager 1.2.7 - Exported ContentProvider allows unauthorized file access
YüksekCVSS 8,5İstismar yokEPSS %0ekia · file manager14 Eyl 2026
- CVE-2026-9094337İzleyin
parallax filament-comments through 3.0.0 Stored XSS via Comment Body
KritikCVSS 9,3İstismar yokEPSS %0parallax · filament-comments14 Eyl 2026
- CVE-2024-5838333İzleyin
Froxlor before 2.2.0 Insecure File Permissions mysql.conf
YüksekCVSS 8,4İstismar yokEPSS %0froxlor · froxlor14 Eyl 2026
- CVE-2026-2035339İzleyin
Cisco Secure Email Gateway Security Hardening Release
KritikCVSS 9,8İstismar yokEPSS %0cisco · cisco secure email14 Eyl 2026
- CVE-2026-5507234İzleyin
Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name
YüksekCVSS 8,5İstismar yokEPSS %0pimcore · pimcore14 Eyl 2026
- CVE-2026-5541635İzleyin
Pimcore: SQL Injection in Mautic Custom Reports Bundle Due to Direct Concatenation of User-Controlled Configuration Fields Without Parameterization
YüksekCVSS 8,8İstismar yokEPSS %0pimcore · pimcore14 Eyl 2026
- CVE-2026-7644039İzleyin
Cisco Secure Email Gateway Security Hardening Release
KritikCVSS 9,8İstismar yokEPSS %0cisco · cisco secure email14 Eyl 2026
- CVE-2026-7644139İzleyin
Cisco Secure Email Gateway Security Hardening Release
KritikCVSS 9,8İstismar yokEPSS %0cisco · cisco secure email and web manager14 Eyl 2026
- CVE-2026-7644230İzleyin
Cisco Secure Email Gateway Security Hardening Release
YüksekCVSS 7,5İstismar yokEPSS %0cisco · cisco secure email14 Eyl 2026
- CVE-2026-7644339İzleyin
Cisco Secure Email Gateway Security Hardening Release
KritikCVSS 9,8İstismar yokEPSS %0cisco · cisco secure email14 Eyl 2026
- CVE-2026-7646178Bu hafta
Cisco Secure Email Gateway SQL Injection Vulnerability
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %29cisco · asyncos14 Eyl 2026
- CVE-2026-8444534İzleyin
gRPC-Go: Denial of Service (DoS) via crash due to missing `:authority` and `Host` headers in the xDS servers
YüksekCVSS 8,7İstismar yokEPSS %0grpc · grpc-go14 Eyl 2026
- CVE-2026-9094831İzleyin
Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions
YüksekCVSS 7,8İstismar yokEPSS %0red hat · red hat enterprise linux 614 Eyl 2026
- CVE-2026-9094931İzleyin
Gimp: gimp: heap-based buffer overflow in psp loader due to selection-channel geometry mismatch
YüksekCVSS 7,8İstismar yokEPSS %0red hat · red hat enterprise linux 614 Eyl 2026
- CVE-2026-1949930İzleyin
Buffer overflow in strfmon and strfmon_l right-justification padding
YüksekCVSS 7,7İstismar yokEPSS %0the gnu c library · glibc14 Eyl 2026
- CVE-2026-5027630İzleyin
dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS
YüksekCVSS 7,5İstismar yokEPSS %0datadog · dd-trace-rb14 Eyl 2026
- CVE-2026-8589231İzleyin
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
YüksekCVSS 7,8İstismar yokEPSS %0microsoft · edge chromium14 Eyl 2026
- CVE-2026-8683633İzleyin
In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predicta
YüksekCVSS 8,4İstismar yokEPSS %0eclipse foundation · eclipse ankaios14 Eyl 2026
- CVE-2026-9094237İzleyin
Casdoor through 4.4.0 Private Key Exposure via Certificate Endpoints
KritikCVSS 9,3İstismar yokEPSS %0casdoor · casdoor14 Eyl 2026
- CVE-2026-9094435İzleyin
Krayin CRM through 2.2.6 Unauthenticated Email Injection via inbound-parse
YüksekCVSS 8,8İstismar yokEPSS %0krayin · laravel-crm14 Eyl 2026
- CVE-2026-9094537İzleyin
Crawlab through 0.6.3 Authentication Bypass via Hard-coded JWT Secret
KritikCVSS 9,3İstismar yokEPSS %0crawlab-team · crawlab14 Eyl 2026
- CVE-2026-9094634İzleyin
DeepWiki-Open through commit d92819a Arbitrary File Read via /ws/chat WebSocket
YüksekCVSS 8,7İstismar yokEPSS %0asyncfuncai · deepwiki-open14 Eyl 2026
- CVE-2026-9108034İzleyin
webhook through 2.8.3 Memory Exhaustion via Oversized Request Body
YüksekCVSS 8,7İstismar yokEPSS %0adnanh · webhook14 Eyl 2026
- CVE-2026-1298537İzleyin
Mattermost DCR redirect URI allowlist bypass via improper URL component validation
KritikCVSS 9,3İstismar yokEPSS %0mattermost · mattermost server14 Eyl 2026
- CVE-2026-5712930İzleyin
PraisonAI: Arbitrary File Read via `@file:` Mention Path Traversal
YüksekCVSS 7,5İstismar yokEPSS %0mervinpraison · praisonaiagents14 Eyl 2026
- CVE-2026-7788428İzleyin
Gallery - Private Photo Vault 1.0.41 - Unauthenticated local-network HTTP file exposure
YüksekCVSS 7,1İstismar yokEPSS %0brain trust · gallery - private photo vault14 Eyl 2026
- CVE-2026-8203528İzleyin
PyMuPDF 1.28.2 Path Traversal via extract_objects() Font Branch
YüksekCVSS 7,1İstismar yokEPSS %0pymupdf · pymupdf14 Eyl 2026
- CVE-2026-8902335İzleyin
ThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST API
YüksekCVSS 8,8İstismar yokEPSS %0themeatelier · domain for sale14 Eyl 2026
- CVE-2026-1595530İzleyin
IBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths
YüksekCVSS 7,5İstismar yokEPSS %0ibm · db214 Eyl 2026
- CVE-2026-1713331İzleyin
IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs
YüksekCVSS 7,8İstismar yokEPSS %0ibm · app connect enterprise14 Eyl 2026
- CVE-2026-1715631İzleyin
IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs
YüksekCVSS 7,8İstismar yokEPSS %0ibm · app connect enterprise14 Eyl 2026
- CVE-2026-1741631İzleyin
IBM App Connect Enterprise Toolkit is vulnerable to arbitrary code execution due to multiple CVEs
YüksekCVSS 7,8İstismar yokEPSS %0ibm · app connect enterprise14 Eyl 2026
- CVE-2026-1746732İzleyin
Vulnerabilities exists in IBM Cloud Pak for Data System
YüksekCVSS 8,2İstismar yokEPSS %0ibm · cloud pak for data system (yosemite 1.0)14 Eyl 2026
- CVE-2026-1811928İzleyin
Concrete CMS below 9.5.3 is vulnerable to Stored XSS via unsanitized inline block custom style values
YüksekCVSS 7,0İstismar yokEPSS %0concretecms · concrete cms14 Eyl 2026
- CVE-2026-1962431İzleyin
NetworkManager-l2tp: local privilege escalation via ipsec.conf injection
YüksekCVSS 7,8İstismar yokEPSS %0fedora · fedora14 Eyl 2026
- CVE-2026-1981628İzleyin
PackageKit: dnf5 backend ignores SIMULATE on RepoRemove
YüksekCVSS 7,1İstismar yokEPSS %0fedora · fedora14 Eyl 2026
- CVE-2026-6583832İzleyin
Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload
YüksekCVSS 8,2İstismar yokEPSS %0zalando · skipper14 Eyl 2026
- CVE-2026-8202834İzleyin
Magistrala < 1.0.0 SQL Injection via format Parameter in Reader API
YüksekCVSS 8,7İstismar yokEPSS %0absmach · magistrala14 Eyl 2026
- CVE-2026-6153436İzleyin
Yayson: Prototype pollution in the Store/LegacyStore deserialization
KritikCVSS 9,1İstismar yokEPSS %0confetti · yayson14 Eyl 2026
- CVE-2026-9094731İzleyin
Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file
YüksekCVSS 7,8İstismar yokEPSS %0red hat · red hat enterprise linux 614 Eyl 2026
- CVE-2026-1310728İzleyin
Multiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 2026
YüksekCVSS 7,1İstismar yokEPSS %0ibm · business automation workflow containers and traditional14 Eyl 2026
- CVE-2026-1326030İzleyin
Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
YüksekCVSS 7,5İstismar yokEPSS %0ibm · verify identity access14 Eyl 2026
- CVE-2026-1327528İzleyin
IBM MQ Managed File Transfer is vulnerable to XML external entity injection
YüksekCVSS 7,1İstismar yokEPSS %0ibm · mq14 Eyl 2026
- CVE-2026-1328528İzleyin
IBM MQ Managed File Transfer is vulnerable to XML external entity injection
YüksekCVSS 7,1İstismar yokEPSS %0ibm · mq14 Eyl 2026
- CVE-2026-1328728İzleyin
IBM MQ Managed File Transfer is vulnerable to XML external entity injection
YüksekCVSS 7,1İstismar yokEPSS %0ibm · mq14 Eyl 2026
- CVE-2026-1329335İzleyin
IBM MQ Java messaging is vulnerable to remote code execution
YüksekCVSS 8,8İstismar yokEPSS %0ibm · mq14 Eyl 2026
- CVE-2026-1929030İzleyin
IBM Sterling File Gateway is Vulnerable to Improper Access Control
YüksekCVSS 7,5İstismar yokEPSS %0ibm · sterling file gateway14 Eyl 2026
- CVE-2026-2068328İzleyin
An authentication issue was addressed with improved state management.
YüksekCVSS 7,1İstismar yokEPSS %0apple · ipados14 Eyl 2026
- CVE-2026-2893530İzleyin
The issue was addressed with improved memory handling.
YüksekCVSS 7,5İstismar yokEPSS %0apple · ipados14 Eyl 2026
- CVE-2026-2893830İzleyin
A privacy issue was addressed by moving sensitive data.
YüksekCVSS 7,5İstismar yokEPSS %0apple · ipados14 Eyl 2026
- CVE-2026-2896030İzleyin
A denial-of-service issue was addressed with improved validation.
YüksekCVSS 7,5İstismar yokEPSS %0apple · ipados14 Eyl 2026
- CVE-2026-4368328İzleyin
An out-of-bounds read was addressed with improved bounds checking.
YüksekCVSS 7,1İstismar yokEPSS %0apple · macos14 Eyl 2026
- CVE-2026-4368431İzleyin
A use-after-free issue was addressed with improved memory management.
YüksekCVSS 7,8İstismar yokEPSS %0apple · ipados14 Eyl 2026
- CVE-2026-4368635İzleyin
A use-after-free issue was addressed with improved memory management.
YüksekCVSS 8,8İstismar yokEPSS %0apple · ipados14 Eyl 2026
- CVE-2026-4368726İzleyin
The issue was addressed with improved memory handling.
OrtaCVSS 6,5Kavram kanıtıEPSS %0apple · ipados14 Eyl 2026
- CVE-2026-4368831İzleyin
A memory corruption issue was addressed with improved input validation.
YüksekCVSS 7,8İstismar yokEPSS %0apple · ipados14 Eyl 2026
- CVE-2026-4368931İzleyin
A permissions issue was addressed with additional restrictions.
YüksekCVSS 7,8İstismar yokEPSS %0apple · ipados14 Eyl 2026
- CVE-2026-4369131İzleyin
A path handling issue was addressed with improved validation.
YüksekCVSS 7,8İstismar yokEPSS %0apple · macos14 Eyl 2026
- CVE-2026-4369235İzleyin
A validation issue was addressed with improved input sanitization.
YüksekCVSS 8,8İstismar yokEPSS %0apple · macos14 Eyl 2026
- CVE-2026-4369728İzleyin
An out-of-bounds read was addressed with improved bounds checking.
YüksekCVSS 7,1İstismar yokEPSS %0apple · macos14 Eyl 2026
- CVE-2026-4370231İzleyin
The issue was addressed with improved memory handling.
YüksekCVSS 7,8İstismar yokEPSS %0apple · ipados14 Eyl 2026
- CVE-2026-4378331İzleyin
A race condition was addressed with improved locking.
YüksekCVSS 7,8Kavram kanıtıEPSS %0apple · macos14 Eyl 2026
- CVE-2026-4378631İzleyin
This issue was addressed with additional entitlement checks.
YüksekCVSS 7,8Kavram kanıtıEPSS %0apple · macos14 Eyl 2026