Yayın tarihine göre

Eylül 2026: sömürülen ve yeni ciddi CVE kayıtları

7.957 kayıt · 32 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 35 / 80

CVE kayıtları
Aksiyon	CVE	Zafiyet	Ciddiyet	KEV	EPSS	Yayın
30İzleyin	CVE-2026-54567İstismar yok	Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)jugmac00 · flask-reuploaded · CWE-178	Yüksek7,5	—	%0,6	14 Eyl 2026
30İzleyin	CVE-2026-55091İstismar yok	flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id keyjoaonuno · flat-to-nested-js · CWE-915 Kimlik doğrulamasız Prototype pollution	Yüksek7,5	—	%0,4	14 Eyl 2026
30İzleyin	CVE-2026-55253İstismar yok	LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposurelangchain-ai · langchain-mongodb · CWE-943 SQL enjeksiyonu	Yüksek7,7	—	%0,5	14 Eyl 2026
32İzleyin	CVE-2026-57577İstismar yok	DotVVM: ReDOS in routingriganti · dotvvm · CWE-1333 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek8,2	—	%0,5	14 Eyl 2026
36İzleyin	CVE-2026-57578İstismar yok	DotVVM: Missing authorization in AuthorizeActionFilterriganti · dotvvm · CWE-862 Kimlik doğrulamasız Erişim denetimi (IDOR)	Kritik9,2	—	%0,6	14 Eyl 2026
29İzleyin	CVE-2026-70658İstismar yok	pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifierpay-rails · pay · CWE-208 Kimlik doğrulamasız	Yüksek7,4	—	%0,5	14 Eyl 2026
29İzleyin	CVE-2026-73494İstismar yok	blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parserhttp4s · blaze · CWE-444 Kimlik doğrulamasız	Yüksek7,4	—	%0,6	14 Eyl 2026
32İzleyin	CVE-2026-85921İstismar yok	Windows Secure Kernel Mode Elevation of Privilege Vulnerabilitymicrosoft · windows 11 26h1 · CWE-415 Yerel yetki yükseltme Bellek hatası	Yüksek8,2	—	%0,3	14 Eyl 2026
29İzleyin	CVE-2026-18116Kavram kanıtı	Concrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval Notificationsconcretecms · concrete cms · CWE-79 XSS	Yüksek7,3	—	%0,1	14 Eyl 2026
39İzleyin	CVE-2026-59178İstismar yok	ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgradeesphome · device-builder · CWE-306 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,8	—	%0,7	14 Eyl 2026
33İzleyin	CVE-2026-82049İstismar yok	tarfile extraction filters allow file modification and content disclosure via hard link to symlinkpython software foundation · cpython · CWE-59	Yüksek8,4	—	%0,1	14 Eyl 2026
34İzleyin	CVE-2026-86830İstismar yok	Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Centeraws · iam-identity-center-team · CWE-266	Yüksek8,6	—	%0,6	14 Eyl 2026
29İzleyin	CVE-2026-81900İstismar yok	Concrete CMS before 9.5.3 is vulnerable to Stored XSS in the YouTube block (vWidth/vHeight)concretecms · concrete cms · CWE-79 XSS	Yüksek7,3	—	%0,2	14 Eyl 2026
28İzleyin	CVE-2026-91197İstismar yok	Flowable flowable-engine through 8.0.0 XXE via ProcessDiagramLayoutFactoryflowable · flowable-engine · CWE-611 XXE	Yüksek7,1	—	%0,4	14 Eyl 2026
34İzleyin	CVE-2026-91200İstismar yok	DevSpace through 6.3.21 Path Traversal via tar extractiondevspace · devspace · CWE-22 Kimlik doğrulamasız Yol geçişi	Yüksek8,7	—	%0,6	14 Eyl 2026
35İzleyin	CVE-2026-16335İstismar yok	DataStage on Cloud Pak for Data has several vulnerabilities due to open source softwareibm · datastage on cloud pak for data · CWE-22 Yol geçişi	Yüksek8,8	—	%0,4	14 Eyl 2026
35İzleyin	CVE-2026-16338İstismar yok	DataStage on Cloud Pak for Data has several vulnerabilities due to open source softwareibm · datastage on cloud pak for data · CWE-73 Yol geçişi	Yüksek8,8	—	%0,4	14 Eyl 2026
35İzleyin	CVE-2026-16428İstismar yok	DataStage on Cloud Pak for Data has several vulnerabilities due to open source softwareibm · datastage on cloud pak for data · CWE-94 RCE	Yüksek8,8	—	%0,5	14 Eyl 2026
35İzleyin	CVE-2026-16466İstismar yok	DataStage on Cloud Pak for Data has several vulnerabilities due to open source softwareibm · datastage on cloud pak for data · CWE-78 RCE Komut enjeksiyonu	Yüksek8,8	—	%0,9	14 Eyl 2026
35İzleyin	CVE-2026-16673İstismar yok	DataStage on Cloud Pak for Data has several vulnerabilities due to open source softwareibm · datastage on cloud pak for data · CWE-78 RCE Komut enjeksiyonu	Yüksek8,8	—	%0,4	14 Eyl 2026
29İzleyin	CVE-2026-47253İstismar yok	Anyquery: Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory Deletionjulien040 · anyquery · CWE-22 Yol geçişi	Yüksek7,3	—	%0,4	14 Eyl 2026
36İzleyin	CVE-2026-50006İstismar yok	Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Modejulien040 · anyquery · CWE-22 Girişsiz RCE Yol geçişi	Kritik9,1	—	%0,9	14 Eyl 2026
39İzleyin	CVE-2026-54333İstismar yok	UEFI Firmware Parser: Stack out-of-bounds write in tiano decompressor MakeTabletheopolis · uefi-firmware-parser · CWE-787 Kimlik doğrulamasız Bellek hatası	Kritik9,8	—	%0,8	14 Eyl 2026
39İzleyin	CVE-2026-54334İstismar yok	UEFI Firmware Parser: Heap out-of-bounds write in tiano decompressor `ReadCLen`theopolis · uefi-firmware-parser · CWE-787 Kimlik doğrulamasız Bellek hatası	Kritik9,8	—	%0,8	14 Eyl 2026
33İzleyin	CVE-2026-54447İstismar yok	garminconnect: Insecure Permission Assignment for Garmin OAuth Token Storecyberjunky · python-garminconnect · CWE-732 Yerel yetki yükseltme	Yüksek8,4	—	%0,1	14 Eyl 2026
34İzleyin	CVE-2026-54628İstismar yok	Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Modejulien040 · anyquery · CWE-284 Kimlik doğrulamasız SSRF Erişim denetimi (IDOR)	Yüksek8,6	—	%0,5	14 Eyl 2026
30İzleyin	CVE-2026-54629İstismar yok	Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Modejulien040 · anyquery · CWE-22 Kimlik doğrulamasız Kimlik doğrulama atlatma Yol geçişi	Yüksek7,5	—	%0,9	14 Eyl 2026
30İzleyin	CVE-2026-54632İstismar yok	SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)sipsorcery-org · sipsorcery · CWE-20 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek7,5	—	%0,7	14 Eyl 2026
39İzleyin	CVE-2026-55209İstismar yok	resdata insufficiently validates untrusted GRDECL filesequinor · resdata · CWE-120 Kimlik doğrulamasız Bellek hatası	Kritik9,8	—	%0,7	14 Eyl 2026
30İzleyin	CVE-2026-73496İstismar yok	MCP Atlassian: Arbitrary server-side file read via attachment uploadsooperset · mcp-atlassian · CWE-22 Yol geçişi	Yüksek7,7	—	%0,4	14 Eyl 2026
35İzleyin	CVE-2026-90847Kavram kanıtı	EFM ipTIME C200E System Setup iux_set.cgi os command injectionefm · iptime c200e · CWE-77 RCE Komut enjeksiyonu	Yüksek8,5	—	%3,3	14 Eyl 2026
28İzleyin	CVE-2026-91750İstismar yok	WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirectstencent · weknora · CWE-918 SSRF	Yüksek7,1	—	%0,4	14 Eyl 2026
28İzleyin	CVE-2026-91751İstismar yok	Flextype CMS through 1.0.0-alpha.3 Path Traversal via Entries REST APIflextype · flextype · CWE-22 Yol geçişi	Yüksek7,2	—	%0,5	14 Eyl 2026
34İzleyin	CVE-2026-91752İstismar yok	GNU libextractor before 1.15 Stack Overflow via OLE2gnu · libextractor · CWE-789 Kimlik doğrulamasız	Yüksek8,7	—	%0,7	14 Eyl 2026
36İzleyin	CVE-2026-53713İstismar yok	Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosureenvoyproxy · gateway · CWE-20 Kimlik doğrulama atlatma	Kritik9,1	—	%0,4	14 Eyl 2026
29İzleyin	CVE-2026-53714İstismar yok	Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceModeenvoyproxy · gateway · CWE-306 Kimlik doğrulamasız Kimlik doğrulama atlatma	Yüksek7,4	—	%0,3	14 Eyl 2026
31İzleyin	CVE-2026-84506İstismar yok	A use after free issue was addressed with improved memory management.apple · macos · CWE-416 Bellek hatası	Yüksek7,8	—	%0,1	14 Eyl 2026
28İzleyin	CVE-2026-91770İstismar yok	IceHRM before 36.0.0 Broken Access Control via Employee IDgamonoid · icehrm · CWE-639 Erişim denetimi (IDOR)	Yüksek7,1	—	%0,4	14 Eyl 2026
34İzleyin	CVE-2026-91771İstismar yok	Weights & Biases wandb before 0.29.0 Path Traversal via File Downloadwandb · wandb · CWE-22 Kimlik doğrulamasız Yol geçişi	Yüksek8,7	—	%1,1	14 Eyl 2026
29İzleyin	CVE-2026-18117İstismar yok	Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Custom Page Alias Nameconcretecms · concrete cms · CWE-79 XSS	Yüksek7,3	—	%0,1	14 Eyl 2026
34İzleyin	CVE-2026-88262İstismar yok	Insufficient session expiration vulnerability in bizwell xClick allows Authentication Bypass.bizwell · xclick · CWE-613 Kimlik doğrulamasız Kimlik doğrulama atlatma	Yüksek8,7	—	%0,5	14 Eyl 2026
23İzleyin	CVE-2026-17495İstismar yok	moment vulnerable to Path Traversal via crafted non-string locale namemoment · moment · CWE-27 Kimlik doğrulamasız Yol geçişi	Orta5,9	—	%0,3	15 Eyl 2026
34İzleyin	CVE-2026-91001İstismar yok	D-Link DI-8400 DDNS Configuration ddns.asp ddns_asp stack-based overflowd-link · di-8400 · CWE-119 Bellek hatası	Yüksek8,6	—	%0,9	15 Eyl 2026
34İzleyin	CVE-2026-91003İstismar yok	D-Link DI-8300 CGI Service rzgl.asp rzgl_asp stack-based overflowd-link · di-8300 · CWE-119 Bellek hatası	Yüksek8,5	—	%0,9	15 Eyl 2026
30İzleyin	CVE-2026-75983İstismar yok	Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filterarraytics · eventin – event calendar, tickets, registration, booking & woocommerce · CWE-269	Yüksek7,5	—	%0,7	15 Eyl 2026
36İzleyin	CVE-2026-90711İstismar yok	proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnetproxy-addr · proxy-addr · CWE-290 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,1	—	%0,2	15 Eyl 2026
28İzleyin	CVE-2026-91778İstismar yok	In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including theoctopus deploy · octopus server · CWE-863 RCE Erişim denetimi (IDOR)	Yüksek7,2	—	%0,4	15 Eyl 2026
27İzleyin	CVE-2026-91819İstismar yok	MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponentmisp · misp · CWE-20 CSRF	Orta6,9	—	%0,1	15 Eyl 2026
29İzleyin	CVE-2026-75092İstismar yok	Leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan_mysql runs mysqld --validate-config as root and can load mysql-writable pluginsred hat · red hat enterprise linux 9 · CWE-250 Yerel yetki yükseltme	Yüksek7,3	—	%0,1	15 Eyl 2026
28İzleyin	CVE-2026-76159İstismar yok	Duplicati for Windows - Incorrect Permission Assignment for Critical Resourceduplicati · duplicati · CWE-732 Yerel yetki yükseltme	Yüksek7,0	—	%0,1	15 Eyl 2026
35İzleyin	CVE-2026-77853İstismar yok	Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in FF-RFI079I4 and FF-RFI078I4.lite-on technology corporation · ff-rfi079i4 · CWE-78 RCE Komut enjeksiyonu	Yüksek8,7	—	%1,8	15 Eyl 2026
34İzleyin	CVE-2026-80217İstismar yok	Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode olite-on technology corporation · ff-rfi079i4 · CWE-912 RCE	Yüksek8,7	—	%0,5	15 Eyl 2026
28İzleyin	CVE-2026-91825İstismar yok	MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Editmisp · misp · CWE-862 Erişim denetimi (IDOR)	Yüksek7,1	—	%0,3	15 Eyl 2026
28İzleyin	CVE-2026-91846İstismar yok	MISP Collection Element Add Missing Authorization on Referenced Object UUIDmisp · misp · CWE-639 Erişim denetimi (IDOR)	Yüksek7,1	—	%0,3	15 Eyl 2026
28İzleyin	CVE-2026-19515İstismar yok	OS Command Injection via Unit Test Execution in WSO2 Integrator MI VS Code Extension Allows Arbitrary Command Executionwso2 · wso2 integrator: mi for visual studio code · CWE-78 RCE Yerel yetki yükseltme Komut enjeksiyonu	Yüksek7,0	—	%0,1	15 Eyl 2026
28İzleyin	CVE-2026-41573İstismar yok	OpenAM LDAP Injection via `_queryId` Parameteropenidentityplatform · openam · CWE-90	Yüksek7,1	—	%0,4	15 Eyl 2026
33İzleyin	CVE-2026-44203İstismar yok	OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)openidentityplatform · openam · CWE-79 Kimlik doğrulamasız XSS	Yüksek8,3	—	%0,5	15 Eyl 2026
28İzleyin	CVE-2026-44793İstismar yok	OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget`openidentityplatform · openam · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,0	—	%0,5	15 Eyl 2026
34İzleyin	CVE-2026-45048İstismar yok	OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPCopenidentityplatform · openam · CWE-200 Bilgi sızıntısı	Yüksek8,5	—	%0,4	15 Eyl 2026
36İzleyin	CVE-2026-45051İstismar yok	OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storageopenidentityplatform · openam · CWE-502 Girişsiz RCE Deserializasyon	Kritik9,2	—	%0,6	15 Eyl 2026
30İzleyin	CVE-2026-46498İstismar yok	OpenAM Arbitrary OAuth Token Minting via Push Registrationopenidentityplatform · openam · CWE-639 Erişim denetimi (IDOR)	Yüksek7,6	—	%0,4	15 Eyl 2026
37İzleyin	CVE-2026-46619İstismar yok	OpenAM Authentication Bypass via MSISDN LDAP Injectionopenidentityplatform · openam · CWE-90 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,3	—	%0,9	15 Eyl 2026
29İzleyin	CVE-2026-46623İstismar yok	OpenAM Account Takeover via Unverified Password Change in OAuth2 Moduleopenidentityplatform · openam · CWE-620 Kimlik doğrulamasız	Yüksek7,4	—	%0,6	15 Eyl 2026
30İzleyin	CVE-2026-47424İstismar yok	OpenAM Authenticated RCE via Groovy Sandbox Escapeopenidentityplatform · openam · CWE-693 RCE	Yüksek7,5	—	%0,4	15 Eyl 2026
30İzleyin	CVE-2026-47426İstismar yok	OpenAM OAuth Client Impersonation via JWKS Resolver Cacheopenidentityplatform · openam · CWE-287 Kimlik doğrulama atlatma	Yüksek7,6	—	%0,5	15 Eyl 2026
36İzleyin	CVE-2026-48717İstismar yok	OpenAM OAuth Authorization Bypass via PKCE Challengeopenidentityplatform · openam · CWE-285 Kimlik doğrulamasız Erişim denetimi (IDOR)	Kritik9,1	—	%0,5	15 Eyl 2026
29İzleyin	CVE-2026-53660İstismar yok	OpenAM Insecure SSO Cookie Initializationopenidentityplatform · openam · CWE-1004 Kimlik doğrulamasız XSS CSRF	Yüksek7,4	—	%0,4	15 Eyl 2026
36İzleyin	CVE-2026-62263İstismar yok	OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypassopenidentityplatform · openam · CWE-502 Girişsiz RCE Deserializasyon	Kritik9,2	—	%0,8	15 Eyl 2026
39İzleyin	CVE-2026-62379İstismar yok	OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallbackopenidentityplatform · openam · CWE-94 Girişsiz RCE Kimlik doğrulama atlatma Deserializasyon	Kritik9,8	—	%1,0	15 Eyl 2026
33İzleyin	CVE-2026-1758İstismar yok	Session fixation vulnerability in Secomea GateManager (webserver module) allows Session Fixation.secomea · gatemanager · CWE-384 Kimlik doğrulamasız	Yüksek8,3	—	%0,2	15 Eyl 2026
33İzleyin	CVE-2026-57112İstismar yok	PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered toolsmervinpraison · praisonai · CWE-306 Kimlik doğrulamasız Kimlik doğrulama atlatma	Yüksek8,3	—	%0,2	15 Eyl 2026
35İzleyin	CVE-2026-57133İstismar yok	PraisonAI utility shell safe-command wrapper allowlist bypass via shell chainingmervinpraison · praisonai · CWE-78 RCE Komut enjeksiyonu	Yüksek8,8	—	%0,8	15 Eyl 2026
32İzleyin	CVE-2026-57134İstismar yok	PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validationmervinpraison · praisonai · CWE-287 Kimlik doğrulamasız Kimlik doğrulama atlatma	Yüksek8,2	—	%0,4	15 Eyl 2026
30İzleyin	CVE-2026-57135İstismar yok	PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clientsmervinpraison · praisonai · CWE-653	Yüksek7,6	—	%0,4	15 Eyl 2026
35İzleyin	CVE-2026-57136İstismar yok	PraisonAI SandboxExecutor allowedCommands bypass via shell chainingmervinpraison · praisonai · CWE-78 RCE Komut enjeksiyonu	Yüksek8,8	—	%0,5	15 Eyl 2026
35İzleyin	CVE-2026-57137İstismar yok	PraisonAI AgentLoop onToolCall approval runs after tool executionmervinpraison · praisonai · CWE-693	Yüksek8,8	—	%0,5	15 Eyl 2026
39İzleyin	CVE-2026-57138İstismar yok	PraisonAI codeMode sandbox escape via Function constructormervinpraison · praisonai · CWE-184	Kritik9,9	—	%0,7	15 Eyl 2026
39İzleyin	CVE-2026-57139İstismar yok	PraisonAI MCPServer exposes unauthenticated HTTP tools/callmervinpraison · praisonai · CWE-306 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,8	—	%0,7	15 Eyl 2026
37İzleyin	CVE-2026-57140İstismar yok	PraisonAI AgentOS exposes unauthenticated agent listing and invocationmervinpraison · praisonai · CWE-306 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,4	—	%0,6	15 Eyl 2026
39İzleyin	CVE-2026-57141İstismar yok	PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Toolmervinpraison · praisonai · CWE-94 Girişsiz RCE	Kritik9,8	—	%0,7	15 Eyl 2026
39İzleyin	CVE-2026-57147İstismar yok	praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgerymervinpraison · praisonai · CWE-798 Kimlik doğrulamasız Gömülü kimlik bilgisi	Kritik9,8	—	%0,7	15 Eyl 2026
39İzleyin	CVE-2026-57148İstismar yok	praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)mervinpraison · praisonai · CWE-287 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,8	—	%0,6	15 Eyl 2026
19İzleyin	CVE-2026-86472İstismar yok	fast-uri vulnerable to inconsistent host case normalization via percent-encoded octetsfast-uri · fast-uri · CWE-178 Kimlik doğrulamasız	Orta4,8	—	%0,2	15 Eyl 2026
33İzleyin	CVE-2026-91923İstismar yok	KubeSphere through 4.1.3 SSRF via git credential verification endpointkubesphere · kubesphere · CWE-918 SSRF	Yüksek8,3	—	%0,4	15 Eyl 2026
33İzleyin	CVE-2026-91924İstismar yok	pgweb through 0.17.0 Missing Authorization on Direct Connect Endpointsosedoff · pgweb · CWE-862 Erişim denetimi (IDOR)	Yüksek8,4	—	%0,4	15 Eyl 2026
34İzleyin	CVE-2026-91925İstismar yok	Polyaxon through 2.16.4 Server-Side Template Injection via Unsandboxed Jinja2 Enginepolyaxon · polyaxon · CWE-1336 RCE SSTI	Yüksek8,7	—	%0,7	15 Eyl 2026
38İzleyin	CVE-2026-89308İstismar yok	Arbitrary command execution in TrxTimeATTENDANCEtrexom · trxtimeattendance · CWE-78 Girişsiz RCE Komut enjeksiyonu	Kritik9,3	—	%2,0	15 Eyl 2026
28İzleyin	CVE-2026-91994İstismar yok	Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requestssemaphoreui · semaphore · CWE-862 Erişim denetimi (IDOR)	Yüksek7,1	—	%0,4	15 Eyl 2026
37İzleyin	CVE-2026-91995İstismar yok	pig before 4.1.0 Unverified Password Change via /register/passwordpig-mesh · pig · CWE-620 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,3	—	%0,8	15 Eyl 2026
34İzleyin	CVE-2026-91996İstismar yok	lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpointdromara · lamp-cloud · CWE-306 Kimlik doğrulamasız Kimlik doğrulama atlatma	Yüksek8,7	—	%0,4	15 Eyl 2026
37İzleyin	CVE-2026-91998İstismar yok	Casdoor through 4.4.0 Cross-Organization User Administration via /api/mcpcasdoor · casdoor · CWE-863 Erişim denetimi (IDOR)	Kritik9,4	—	%0,5	15 Eyl 2026
35İzleyin	CVE-2026-14805İstismar yok	Consulting - Business, Finance WordPress Theme <= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation via AJAXstylemixthemes · consulting - business, finance wordpress theme · CWE-269	Yüksek8,8	—	%0,3	15 Eyl 2026
35İzleyin	CVE-2026-16140İstismar yok	OpenBMC IPMI Privilege Escalation via Retargeted RAKP 1openbmc · phosphor-net-ipmid · CWE-863 Erişim denetimi (IDOR)	Yüksek8,8	—	%0,2	15 Eyl 2026
32İzleyin	CVE-2026-16141İstismar yok	OpenBMC IPMI Authentication Bypass via Default userKey and Stale Challenge Valueopenbmc · phosphor-net-ipmid · CWE-457 Kimlik doğrulamasız Kimlik doğrulama atlatma	Yüksek8,1	—	%0,3	15 Eyl 2026
37İzleyin	CVE-2026-45052İstismar yok	OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpointsopenidentityplatform · openam · CWE-285 Kimlik doğrulamasız Erişim denetimi (IDOR)	Kritik9,3	—	%0,7	15 Eyl 2026
30İzleyin	CVE-2026-45794İstismar yok	OpenAM Unsafe Java Deserialization via SNSopenidentityplatform · openam · CWE-502 RCE Deserializasyon	Yüksek7,7	—	%0,6	15 Eyl 2026
37İzleyin	CVE-2026-77179Kavram kanıtı	Docker Sandboxes guest can write arbitrary macOS host files via a symlink in the virtio-fs stored-path fallbackdocker · docker sandboxes · CWE-59	Kritik9,4	—	%0,1	15 Eyl 2026
36İzleyin	CVE-2026-52824Kavram kanıtı	Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeoverkimai · kimai · CWE-1188 Kimlik doğrulamasız	Kritik9,1	—	%1,3	15 Eyl 2026
28İzleyin	CVE-2026-52827İstismar yok	Kimai: Two-factor authentication bypass on the Kimai APIkimai · kimai · CWE-287 Kimlik doğrulama atlatma	Yüksek7,1	—	%0,5	15 Eyl 2026
37İzleyin	CVE-2026-39919İstismar yok	Ghostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapterartifex software · ghostscript · CWE-122 Kimlik doğrulamasız Bellek hatası	Kritik9,3	—	%0,7	15 Eyl 2026

CVE-2026-54567
30İzleyin
Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)
YüksekCVSS 7,5İstismar yokEPSS %0
jugmac00 · flask-reuploaded14 Eyl 2026
CVE-2026-55091
30İzleyin
flat-to-nested: Prototype pollution in flat-to-nested convert() via __proto__ parent/id key
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Prototype pollution
joaonuno · flat-to-nested-js14 Eyl 2026
CVE-2026-55253
30İzleyin
LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure
YüksekCVSS 7,7İstismar yokEPSS %0
- SQL enjeksiyonu
langchain-ai · langchain-mongodb14 Eyl 2026
CVE-2026-57577
32İzleyin
DotVVM: ReDOS in routing
YüksekCVSS 8,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
riganti · dotvvm14 Eyl 2026
CVE-2026-57578
36İzleyin
DotVVM: Missing authorization in AuthorizeActionFilter
KritikCVSS 9,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
riganti · dotvvm14 Eyl 2026
CVE-2026-70658
29İzleyin
pay-rails/pay: non-constant-time HMAC comparison in Paddle Billing webhook signature verifier
YüksekCVSS 7,4İstismar yokEPSS %0
- Kimlik doğrulamasız
pay-rails · pay14 Eyl 2026
CVE-2026-73494
29İzleyin
blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser
YüksekCVSS 7,4İstismar yokEPSS %0
- Kimlik doğrulamasız
http4s · blaze14 Eyl 2026
CVE-2026-85921
32İzleyin
Windows Secure Kernel Mode Elevation of Privilege Vulnerability
YüksekCVSS 8,2İstismar yokEPSS %0
- Yerel yetki yükseltme
- Bellek hatası
microsoft · windows 11 26h114 Eyl 2026
CVE-2026-18116
29İzleyin
Concrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval Notifications
YüksekCVSS 7,3Kavram kanıtıEPSS %0
- XSS
concretecms · concrete cms14 Eyl 2026
CVE-2026-59178
39İzleyin
ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
esphome · device-builder14 Eyl 2026
CVE-2026-82049
33İzleyin
tarfile extraction filters allow file modification and content disclosure via hard link to symlink
YüksekCVSS 8,4İstismar yokEPSS %0
python software foundation · cpython14 Eyl 2026
CVE-2026-86830
34İzleyin
Incorrect privilege assignment in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center
YüksekCVSS 8,6İstismar yokEPSS %0
aws · iam-identity-center-team14 Eyl 2026
CVE-2026-81900
29İzleyin
Concrete CMS before 9.5.3 is vulnerable to Stored XSS in the YouTube block (vWidth/vHeight)
YüksekCVSS 7,3İstismar yokEPSS %0
- XSS
concretecms · concrete cms14 Eyl 2026
CVE-2026-91197
28İzleyin
Flowable flowable-engine through 8.0.0 XXE via ProcessDiagramLayoutFactory
YüksekCVSS 7,1İstismar yokEPSS %0
- XXE
flowable · flowable-engine14 Eyl 2026
CVE-2026-91200
34İzleyin
DevSpace through 6.3.21 Path Traversal via tar extraction
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Yol geçişi
devspace · devspace14 Eyl 2026
CVE-2026-16335
35İzleyin
DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
YüksekCVSS 8,8İstismar yokEPSS %0
- Yol geçişi
ibm · datastage on cloud pak for data14 Eyl 2026
CVE-2026-16338
35İzleyin
DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
YüksekCVSS 8,8İstismar yokEPSS %0
- Yol geçişi
ibm · datastage on cloud pak for data14 Eyl 2026
CVE-2026-16428
35İzleyin
DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
YüksekCVSS 8,8İstismar yokEPSS %0
- RCE
ibm · datastage on cloud pak for data14 Eyl 2026
CVE-2026-16466
35İzleyin
DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
YüksekCVSS 8,8İstismar yokEPSS %0
- RCE
- Komut enjeksiyonu
ibm · datastage on cloud pak for data14 Eyl 2026
CVE-2026-16673
35İzleyin
DataStage on Cloud Pak for Data has several vulnerabilities due to open source software
YüksekCVSS 8,8İstismar yokEPSS %0
- RCE
- Komut enjeksiyonu
ibm · datastage on cloud pak for data14 Eyl 2026
CVE-2026-47253
29İzleyin
Anyquery: Path Traversal in `clear_plugin_cache` Allows Arbitrary Directory Deletion
YüksekCVSS 7,3İstismar yokEPSS %0
- Yol geçişi
julien040 · anyquery14 Eyl 2026
CVE-2026-50006
36İzleyin
Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode
KritikCVSS 9,1İstismar yokEPSS %0
- Girişsiz RCE
- Yol geçişi
julien040 · anyquery14 Eyl 2026
CVE-2026-54333
39İzleyin
UEFI Firmware Parser: Stack out-of-bounds write in tiano decompressor MakeTable
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
theopolis · uefi-firmware-parser14 Eyl 2026
CVE-2026-54334
39İzleyin
UEFI Firmware Parser: Heap out-of-bounds write in tiano decompressor `ReadCLen`
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
theopolis · uefi-firmware-parser14 Eyl 2026
CVE-2026-54447
33İzleyin
garminconnect: Insecure Permission Assignment for Garmin OAuth Token Store
YüksekCVSS 8,4İstismar yokEPSS %0
- Yerel yetki yükseltme
cyberjunky · python-garminconnect14 Eyl 2026
CVE-2026-54628
34İzleyin
Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode
YüksekCVSS 8,6İstismar yokEPSS %0
- Kimlik doğrulamasız
- SSRF
- Erişim denetimi (IDOR)
julien040 · anyquery14 Eyl 2026
CVE-2026-54629
30İzleyin
Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
- Yol geçişi
julien040 · anyquery14 Eyl 2026
CVE-2026-54632
30İzleyin
SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
sipsorcery-org · sipsorcery14 Eyl 2026
CVE-2026-55209
39İzleyin
resdata insufficiently validates untrusted GRDECL files
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
equinor · resdata14 Eyl 2026
CVE-2026-73496
30İzleyin
MCP Atlassian: Arbitrary server-side file read via attachment upload
YüksekCVSS 7,7İstismar yokEPSS %0
- Yol geçişi
sooperset · mcp-atlassian14 Eyl 2026
CVE-2026-90847
35İzleyin
EFM ipTIME C200E System Setup iux_set.cgi os command injection
YüksekCVSS 8,5Kavram kanıtıEPSS %3
- RCE
- Komut enjeksiyonu
efm · iptime c200e14 Eyl 2026
CVE-2026-91750
28İzleyin
WeKnora before 0.7.0 SSRF via Unvalidated HTTP Redirects
YüksekCVSS 7,1İstismar yokEPSS %0
- SSRF
tencent · weknora14 Eyl 2026
CVE-2026-91751
28İzleyin
Flextype CMS through 1.0.0-alpha.3 Path Traversal via Entries REST API
YüksekCVSS 7,2İstismar yokEPSS %0
- Yol geçişi
flextype · flextype14 Eyl 2026
CVE-2026-91752
34İzleyin
GNU libextractor before 1.15 Stack Overflow via OLE2
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
gnu · libextractor14 Eyl 2026
CVE-2026-53713
36İzleyin
Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulama atlatma
envoyproxy · gateway14 Eyl 2026
CVE-2026-53714
29İzleyin
Envoy Gateway: xDS Control Plane Information Disclosure when Envoy Gateway operates in GatewayNamespaceMode
YüksekCVSS 7,4İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
envoyproxy · gateway14 Eyl 2026
CVE-2026-84506
31İzleyin
A use after free issue was addressed with improved memory management.
YüksekCVSS 7,8İstismar yokEPSS %0
- Bellek hatası
apple · macos14 Eyl 2026
CVE-2026-91770
28İzleyin
IceHRM before 36.0.0 Broken Access Control via Employee ID
YüksekCVSS 7,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
gamonoid · icehrm14 Eyl 2026
CVE-2026-91771
34İzleyin
Weights & Biases wandb before 0.29.0 Path Traversal via File Download
YüksekCVSS 8,7İstismar yokEPSS %1
- Kimlik doğrulamasız
- Yol geçişi
wandb · wandb14 Eyl 2026
CVE-2026-18117
29İzleyin
Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Custom Page Alias Name
YüksekCVSS 7,3İstismar yokEPSS %0
- XSS
concretecms · concrete cms14 Eyl 2026
CVE-2026-88262
34İzleyin
Insufficient session expiration vulnerability in bizwell xClick allows Authentication Bypass.
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
bizwell · xclick14 Eyl 2026
CVE-2026-17495
23İzleyin
moment vulnerable to Path Traversal via crafted non-string locale name
OrtaCVSS 5,9İstismar yokEPSS %0
- Kimlik doğrulamasız
- Yol geçişi
moment · moment15 Eyl 2026
CVE-2026-91001
34İzleyin
D-Link DI-8400 DDNS Configuration ddns.asp ddns_asp stack-based overflow
YüksekCVSS 8,6İstismar yokEPSS %0
- Bellek hatası
d-link · di-840015 Eyl 2026
CVE-2026-91003
34İzleyin
D-Link DI-8300 CGI Service rzgl.asp rzgl_asp stack-based overflow
YüksekCVSS 8,5İstismar yokEPSS %0
- Bellek hatası
d-link · di-830015 Eyl 2026
CVE-2026-75983
30İzleyin
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.23 - Authenticated (Subscriber+) Privilege Escalation via map_meta_cap Filter
YüksekCVSS 7,5İstismar yokEPSS %0
arraytics · eventin – event calendar, tickets, registration, booking & woocommerce15 Eyl 2026
CVE-2026-90711
36İzleyin
proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
proxy-addr · proxy-addr15 Eyl 2026
CVE-2026-91778
28İzleyin
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts on a worker (including the
YüksekCVSS 7,2İstismar yokEPSS %0
- RCE
- Erişim denetimi (IDOR)
octopus deploy · octopus server15 Eyl 2026
CVE-2026-91819
27İzleyin
MISP: HTTP Method Override Bypasses CSRF and Form Validation in BetterSecurityComponent
OrtaCVSS 6,9İstismar yokEPSS %0
- CSRF
misp · misp15 Eyl 2026
CVE-2026-75092
29İzleyin
Leapp-repository: leapp-upgrade-el9toel10: leapp-upgrade-el9toel10: scan_mysql runs mysqld --validate-config as root and can load mysql-writable plugins
YüksekCVSS 7,3İstismar yokEPSS %0
- Yerel yetki yükseltme
red hat · red hat enterprise linux 915 Eyl 2026
CVE-2026-76159
28İzleyin
Duplicati for Windows - Incorrect Permission Assignment for Critical Resource
YüksekCVSS 7,0İstismar yokEPSS %0
- Yerel yetki yükseltme
duplicati · duplicati15 Eyl 2026
CVE-2026-77853
35İzleyin
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in FF-RFI079I4 and FF-RFI078I4.
YüksekCVSS 8,7İstismar yokEPSS %1
- RCE
- Komut enjeksiyonu
lite-on technology corporation · ff-rfi079i415 Eyl 2026
CVE-2026-80217
34İzleyin
Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode o
YüksekCVSS 8,7İstismar yokEPSS %0
- RCE
lite-on technology corporation · ff-rfi079i415 Eyl 2026
CVE-2026-91825
28İzleyin
MISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit
YüksekCVSS 7,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
misp · misp15 Eyl 2026
CVE-2026-91846
28İzleyin
MISP Collection Element Add Missing Authorization on Referenced Object UUID
YüksekCVSS 7,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
misp · misp15 Eyl 2026
CVE-2026-19515
28İzleyin
OS Command Injection via Unit Test Execution in WSO2 Integrator MI VS Code Extension Allows Arbitrary Command Execution
YüksekCVSS 7,0İstismar yokEPSS %0
- RCE
- Yerel yetki yükseltme
- Komut enjeksiyonu
wso2 · wso2 integrator: mi for visual studio code15 Eyl 2026
CVE-2026-41573
28İzleyin
OpenAM LDAP Injection via `_queryId` Parameter
YüksekCVSS 7,1İstismar yokEPSS %0
openidentityplatform · openam15 Eyl 2026
CVE-2026-44203
33İzleyin
OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl)
YüksekCVSS 8,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
openidentityplatform · openam15 Eyl 2026
CVE-2026-44793
28İzleyin
OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget`
YüksekCVSS 7,0İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
openidentityplatform · openam15 Eyl 2026
CVE-2026-45048
34İzleyin
OpenAM Authenticated Privilege Escalation via Raw Token Disclosure Session RPC
YüksekCVSS 8,5İstismar yokEPSS %0
- Bilgi sızıntısı
openidentityplatform · openam15 Eyl 2026
CVE-2026-45051
36İzleyin
OpenAM Pre-auth RCE via Java Deserialization in WebAuthn Authenticator Storage
KritikCVSS 9,2İstismar yokEPSS %0
- Girişsiz RCE
- Deserializasyon
openidentityplatform · openam15 Eyl 2026
CVE-2026-46498
30İzleyin
OpenAM Arbitrary OAuth Token Minting via Push Registration
YüksekCVSS 7,6İstismar yokEPSS %0
- Erişim denetimi (IDOR)
openidentityplatform · openam15 Eyl 2026
CVE-2026-46619
37İzleyin
OpenAM Authentication Bypass via MSISDN LDAP Injection
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
openidentityplatform · openam15 Eyl 2026
CVE-2026-46623
29İzleyin
OpenAM Account Takeover via Unverified Password Change in OAuth2 Module
YüksekCVSS 7,4İstismar yokEPSS %0
- Kimlik doğrulamasız
openidentityplatform · openam15 Eyl 2026
CVE-2026-47424
30İzleyin
OpenAM Authenticated RCE via Groovy Sandbox Escape
YüksekCVSS 7,5İstismar yokEPSS %0
- RCE
openidentityplatform · openam15 Eyl 2026
CVE-2026-47426
30İzleyin
OpenAM OAuth Client Impersonation via JWKS Resolver Cache
YüksekCVSS 7,6İstismar yokEPSS %0
- Kimlik doğrulama atlatma
openidentityplatform · openam15 Eyl 2026
CVE-2026-48717
36İzleyin
OpenAM OAuth Authorization Bypass via PKCE Challenge
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
openidentityplatform · openam15 Eyl 2026
CVE-2026-53660
29İzleyin
OpenAM Insecure SSO Cookie Initialization
YüksekCVSS 7,4İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
- CSRF
openidentityplatform · openam15 Eyl 2026
CVE-2026-62263
36İzleyin
OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass
KritikCVSS 9,2İstismar yokEPSS %0
- Girişsiz RCE
- Deserializasyon
openidentityplatform · openam15 Eyl 2026
CVE-2026-62379
39İzleyin
OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback
KritikCVSS 9,8İstismar yokEPSS %1
- Girişsiz RCE
- Kimlik doğrulama atlatma
- Deserializasyon
openidentityplatform · openam15 Eyl 2026
CVE-2026-1758
33İzleyin
Session fixation vulnerability in Secomea GateManager (webserver module) allows Session Fixation.
YüksekCVSS 8,3İstismar yokEPSS %0
- Kimlik doğrulamasız
secomea · gatemanager15 Eyl 2026
CVE-2026-57112
33İzleyin
PraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools
YüksekCVSS 8,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
mervinpraison · praisonai15 Eyl 2026
CVE-2026-57133
35İzleyin
PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining
YüksekCVSS 8,8İstismar yokEPSS %0
- RCE
- Komut enjeksiyonu
mervinpraison · praisonai15 Eyl 2026
CVE-2026-57134
32İzleyin
PraisonAI MCPSecurity Basic/OAuth authentication policies accept invalid credentials without validation
YüksekCVSS 8,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
mervinpraison · praisonai15 Eyl 2026
CVE-2026-57135
30İzleyin
PraisonAI SandboxExecutor network-isolated mode does not block non-proxy-aware network clients
YüksekCVSS 7,6İstismar yokEPSS %0
mervinpraison · praisonai15 Eyl 2026
CVE-2026-57136
35İzleyin
PraisonAI SandboxExecutor allowedCommands bypass via shell chaining
YüksekCVSS 8,8İstismar yokEPSS %0
- RCE
- Komut enjeksiyonu
mervinpraison · praisonai15 Eyl 2026
CVE-2026-57137
35İzleyin
PraisonAI AgentLoop onToolCall approval runs after tool execution
YüksekCVSS 8,8İstismar yokEPSS %0
mervinpraison · praisonai15 Eyl 2026
CVE-2026-57138
39İzleyin
PraisonAI codeMode sandbox escape via Function constructor
KritikCVSS 9,9İstismar yokEPSS %0
mervinpraison · praisonai15 Eyl 2026
CVE-2026-57139
39İzleyin
PraisonAI MCPServer exposes unauthenticated HTTP tools/call
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
mervinpraison · praisonai15 Eyl 2026
CVE-2026-57140
37İzleyin
PraisonAI AgentOS exposes unauthenticated agent listing and invocation
KritikCVSS 9,4İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
mervinpraison · praisonai15 Eyl 2026
CVE-2026-57141
39İzleyin
PraisonAI: Remote Code Execution via Sandbox Escape in `codeMode` Tool
KritikCVSS 9,8İstismar yokEPSS %0
- Girişsiz RCE
mervinpraison · praisonai15 Eyl 2026
CVE-2026-57147
39İzleyin
praisonai-platform: default JWT signing secret 'dev-secret-change-me' enables token forgery
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Gömülü kimlik bilgisi
mervinpraison · praisonai15 Eyl 2026
CVE-2026-57148
39İzleyin
praisonai-platform 0.1.4 still boots on the hardcoded JWT secret dev-secret-change-me (default-open production guard)
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
mervinpraison · praisonai15 Eyl 2026
CVE-2026-86472
19İzleyin
fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets
OrtaCVSS 4,8İstismar yokEPSS %0
- Kimlik doğrulamasız
fast-uri · fast-uri15 Eyl 2026
CVE-2026-91923
33İzleyin
KubeSphere through 4.1.3 SSRF via git credential verification endpoint
YüksekCVSS 8,3İstismar yokEPSS %0
- SSRF
kubesphere · kubesphere15 Eyl 2026
CVE-2026-91924
33İzleyin
pgweb through 0.17.0 Missing Authorization on Direct Connect Endpoint
YüksekCVSS 8,4İstismar yokEPSS %0
- Erişim denetimi (IDOR)
sosedoff · pgweb15 Eyl 2026
CVE-2026-91925
34İzleyin
Polyaxon through 2.16.4 Server-Side Template Injection via Unsandboxed Jinja2 Engine
YüksekCVSS 8,7İstismar yokEPSS %0
- RCE
- SSTI
polyaxon · polyaxon15 Eyl 2026
CVE-2026-89308
38İzleyin
Arbitrary command execution in TrxTimeATTENDANCE
KritikCVSS 9,3İstismar yokEPSS %2
- Girişsiz RCE
- Komut enjeksiyonu
trexom · trxtimeattendance15 Eyl 2026
CVE-2026-91994
28İzleyin
Semaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests
YüksekCVSS 7,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
semaphoreui · semaphore15 Eyl 2026
CVE-2026-91995
37İzleyin
pig before 4.1.0 Unverified Password Change via /register/password
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
pig-mesh · pig15 Eyl 2026
CVE-2026-91996
34İzleyin
lamp-cloud through 5.10.0 Missing Authentication for JVM Properties Endpoint
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
dromara · lamp-cloud15 Eyl 2026
CVE-2026-91998
37İzleyin
Casdoor through 4.4.0 Cross-Organization User Administration via /api/mcp
KritikCVSS 9,4İstismar yokEPSS %0
- Erişim denetimi (IDOR)
casdoor · casdoor15 Eyl 2026
CVE-2026-14805
35İzleyin
Consulting - Business, Finance WordPress Theme <= 6.7.16 - Authenticated (Subscriber+) Privilege Escalation via AJAX
YüksekCVSS 8,8İstismar yokEPSS %0
stylemixthemes · consulting - business, finance wordpress theme15 Eyl 2026
CVE-2026-16140
35İzleyin
OpenBMC IPMI Privilege Escalation via Retargeted RAKP 1
YüksekCVSS 8,8İstismar yokEPSS %0
- Erişim denetimi (IDOR)
openbmc · phosphor-net-ipmid15 Eyl 2026
CVE-2026-16141
32İzleyin
OpenBMC IPMI Authentication Bypass via Default userKey and Stale Challenge Value
YüksekCVSS 8,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
openbmc · phosphor-net-ipmid15 Eyl 2026
CVE-2026-45052
37İzleyin
OpenAM Pre-auth User Profile Tampering via Anonymous SOAP Authn in Liberty IDPP/Discovery Endpoints
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
openidentityplatform · openam15 Eyl 2026
CVE-2026-45794
30İzleyin
OpenAM Unsafe Java Deserialization via SNS
YüksekCVSS 7,7İstismar yokEPSS %0
- RCE
- Deserializasyon
openidentityplatform · openam15 Eyl 2026
CVE-2026-77179
37İzleyin
Docker Sandboxes guest can write arbitrary macOS host files via a symlink in the virtio-fs stored-path fallback
KritikCVSS 9,4Kavram kanıtıEPSS %0
docker · docker sandboxes15 Eyl 2026
CVE-2026-52824
36İzleyin
Kimai: Default APP_SECRET in Docker Image Enables Cookie Forgery and Account Takeover
KritikCVSS 9,1Kavram kanıtıEPSS %1
- Kimlik doğrulamasız
kimai · kimai15 Eyl 2026
CVE-2026-52827
28İzleyin
Kimai: Two-factor authentication bypass on the Kimai API
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulama atlatma
kimai · kimai15 Eyl 2026
CVE-2026-39919
37İzleyin
Ghostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
artifex software · ghostscript15 Eyl 2026