Yayın tarihine göre

Eylül 2026: sömürülen ve yeni ciddi CVE kayıtları

7.957 kayıt · 32 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 4 / 80

CVE kayıtları
Aksiyon	CVE	Zafiyet	Ciddiyet	KEV	EPSS	Yayın
28İzleyin	CVE-2026-19453İstismar yok	JetBackup 3.1.7.9 - 3.1.23.3 - Subscriber+ Privilege Escalation via Restore Admin User Selectionunknown · jetbackup · CWE-269	Yüksek7,1	—	%0,1	2 Eyl 2026
28İzleyin	CVE-2026-19723İstismar yok	Social Media Share Buttons & Social Sharing Icons < 3.0.1 - Reflected XSS via Pin It Share Handlerunknown · social media share buttons & social sharing icons · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,1	2 Eyl 2026
19İzleyin	CVE-2026-77788İstismar yok	Rank Math SEO < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite via updateSchemasunknown · rank math seo · CWE-639 Erişim denetimi (IDOR)	Orta4,9	—	%0,3	2 Eyl 2026
30İzleyin	CVE-2026-77792İstismar yok	RegistrationMagic < 6.0.9.9 - Unauthenticated Stored XSS via Rating Fieldunknown · registrationmagic · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,5	—	%0,3	2 Eyl 2026
39İzleyin	CVE-2026-78657İstismar yok	SigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Fieldbdthemes · sigmaforms pro – ai generated forms · CWE-22 Girişsiz RCE Yol geçişi	Kritik9,8	—	%1,0	2 Eyl 2026
32İzleyin	CVE-2026-80467Kavram kanıtı	Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Actionunknown · advanced custom fields: extended · CWE-269 Kimlik doğrulamasız	Yüksek8,1	—	%0,3	2 Eyl 2026
21İzleyin	CVE-2026-81199Kavram kanıtı	MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Routeunknown · masterstudy lms wordpress plugin · CWE-200 Kimlik doğrulamasız Bilgi sızıntısı	Orta5,3	—	%0,4	2 Eyl 2026
35İzleyin	CVE-2026-81737İstismar yok	FAQ Builder AYS 1.6.3 - 1.8.4 - Unauthenticated Stored XSS via ays_get_user_informationunknown · faq builder ays · CWE-79 Kimlik doğrulamasız XSS	Yüksek8,8	—	%0,4	2 Eyl 2026
35İzleyin	CVE-2026-81807İstismar yok	Simple Ajax Chat < 20260827 - Unauthenticated Stored XSS via Chat Message Linkificationunknown · simple ajax chat · CWE-79 Kimlik doğrulamasız XSS	Yüksek8,8	—	%0,5	2 Eyl 2026
32İzleyin	CVE-2026-82183İstismar yok	OAuth Single Sign On 6.25.0 - 7.0.0 - Unauthenticated Account Takeover via Unverified Steam OpenID Assertionunknown · oauth single sign on · CWE-287 Kimlik doğrulamasız Kimlik doğrulama atlatma	Yüksek8,1	—	%0,3	2 Eyl 2026
28İzleyin	CVE-2026-82883İstismar yok	WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerabilitymarcus · login with ajax · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,2	2 Eyl 2026
35İzleyin	CVE-2026-14828İstismar yok	Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405 zohocorp · manageengine password manager pro · CWE-89 SQL enjeksiyonu	Yüksek8,8	—	%1,4	2 Eyl 2026
28İzleyin	CVE-2026-75528İstismar yok	Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Logwpmudev · broken link checker · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,2	—	%0,5	2 Eyl 2026
34İzleyin	CVE-2026-19754İstismar yok	Baserow 2.2.0 through 2.3.3 - SQL injection in formula index() JSONB array extractionbaserow · baserow · CWE-89 SQL enjeksiyonu	Yüksek8,6	—	%0,3	2 Eyl 2026
30İzleyin	CVE-2025-46418İstismar yok	Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition.westermo · weos · CWE-78 RCE Komut enjeksiyonu	Yüksek7,6	—	%0,6	2 Eyl 2026
30İzleyin	CVE-2026-18672İstismar yok	RadImageEditor ClientState Unauthenticated Arbitrary File Read Vulnerability in Telerik UI for ASP.NET AJAXprogress software · telerik ui for asp.net ajax · CWE-22 Kimlik doğrulamasız Yol geçişi	Yüksek7,5	—	%0,3	2 Eyl 2026
32İzleyin	CVE-2026-19219İstismar yok	DialogHandler UploadPaths Tampering Vulnerability in Telerik UI for ASP.NET AJAXprogress software · telerik ui for asp.net ajax · CWE-345 Girişsiz RCE	Yüksek8,1	—	%0,1	2 Eyl 2026
30İzleyin	CVE-2026-82958İstismar yok	In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command byeclipse foundation · eclipse ditto · CWE-74	Yüksek7,6	—	%0,4	2 Eyl 2026
35İzleyin	CVE-2026-81283İstismar yok	WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerabilitywedevs · wp user frontend · CWE-502 Deserializasyon	Yüksek8,8	—	%0,5	2 Eyl 2026
37İzleyin	CVE-2026-81286İstismar yok	WordPress WCFM Marketplace plugin <= 3.8.1 - SQL Injection vulnerabilitywc lovers · wcfm marketplace · CWE-89 Kimlik doğrulamasız SQL enjeksiyonu	Kritik9,3	—	%0,4	2 Eyl 2026
28İzleyin	CVE-2026-81288İstismar yok	WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerabilitywp swings · upsell order bump offer for woocommerce · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,2	2 Eyl 2026
28İzleyin	CVE-2026-81289İstismar yok	WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.13.1 - Cross Site Scripting (XSS) vulnerabilitysonaar · mp3 audio player for music, radio & podcast by sonaar · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,2	2 Eyl 2026
39İzleyin	CVE-2026-81294Kavram kanıtı	WordPress Authorizer plugin <= 3.15.1 - Privilege Escalation vulnerabilitypaul ryan · authorizer · CWE-266 Kimlik doğrulamasız	Kritik9,8	—	%0,4	2 Eyl 2026
35İzleyin	CVE-2026-81769İstismar yok	WordPress Booking Hub plugin <= 1.3.1 - Privilege Escalation vulnerabilityliquidthemes · booking hub · CWE-266	Yüksek8,8	—	%0,4	2 Eyl 2026
28İzleyin	CVE-2026-81770İstismar yok	WordPress Interactive Geo Maps plugin <= 1.6.30 - Reflected Cross Site Scripting (XSS) vulnerabilitymapgeo · interactive geo maps · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,2	2 Eyl 2026
28İzleyin	CVE-2026-81771İstismar yok	WordPress TrustedSite plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerabilitytrustedsite · trustedsite · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,2	2 Eyl 2026
35İzleyin	CVE-2026-81772İstismar yok	WordPress Ninja Forms - Layout & Styles plugin <= 3.0.31 - PHP Object Injection vulnerabilitysaturday drive · ninja forms - layout & styles · CWE-502 Kimlik doğrulamasız Deserializasyon	Yüksek8,8	—	%0,4	2 Eyl 2026
28İzleyin	CVE-2026-81775İstismar yok	WordPress Estatik plugin <= 4.3.4 - Cross Site Scripting (XSS) vulnerabilityestatik · estatik · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,2	2 Eyl 2026
28İzleyin	CVE-2026-84759İstismar yok	WordPress Activity Log plugin <= 2.13.1 - Cross Site Request Forgery (CSRF) vulnerabilityelementor · activity log · CWE-352 Kimlik doğrulamasız CSRF	Yüksek7,1	—	%0,1	2 Eyl 2026
35İzleyin	CVE-2026-84764İstismar yok	WordPress Simply Schedule Appointments plugin <= 1.6.12.23 - Cross Site Request Forgery (CSRF) vulnerabilitynsquared · simply schedule appointments · CWE-352 Kimlik doğrulamasız CSRF	Yüksek8,8	—	%0,2	2 Eyl 2026
35İzleyin	CVE-2026-84770İstismar yok	WordPress Mang Board WP plugin <= 2.3.8 - Cross Site Request Forgery (CSRF) vulnerabilitykitae park · mang board wp · CWE-352 Kimlik doğrulamasız CSRF	Yüksek8,8	—	%0,2	2 Eyl 2026
28İzleyin	CVE-2026-84794İstismar yok	Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-assetcraftcms · cms · CWE-862 Erişim denetimi (IDOR)	Yüksek7,1	—	%0,3	2 Eyl 2026
36İzleyin	CVE-2026-84795İstismar yok	Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritancecraftcms · cms · CWE-269 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,2	—	%0,5	2 Eyl 2026
34İzleyin	CVE-2026-84796İstismar yok	Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypasscraftcms · cms · CWE-639 Erişim denetimi (IDOR)	Yüksek8,7	—	%0,4	2 Eyl 2026
28İzleyin	CVE-2026-84798İstismar yok	Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSitecraftcms · cms · CWE-862 Erişim denetimi (IDOR)	Yüksek7,1	—	%0,3	2 Eyl 2026
28İzleyin	CVE-2026-84800İstismar yok	Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-filecraftcms · cms · CWE-862 Erişim denetimi (IDOR)	Yüksek7,1	—	%0,3	2 Eyl 2026
34İzleyin	CVE-2026-84801İstismar yok	Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUserscraftcms · cms · CWE-862 Kimlik doğrulama atlatma Erişim denetimi (IDOR)	Yüksek8,7	—	%0,4	2 Eyl 2026
34İzleyin	CVE-2026-84803İstismar yok	SiYuan before v3.8.2 Stored XSS via incomplete asset blocklistsiyuan-note · siyuan · CWE-79 XSS	Yüksek8,6	—	%0,4	2 Eyl 2026
36İzleyin	CVE-2026-73475İstismar yok	Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095centarro · commerce paypal · CWE-863 Kimlik doğrulamasız Erişim denetimi (IDOR)	Kritik9,1	—	%0,4	2 Eyl 2026
29İzleyin	CVE-2026-76759İstismar yok	Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102drupal · screenshot · CWE-79 XSS	Yüksek7,3	—	%0,2	2 Eyl 2026
30İzleyin	CVE-2024-7956İstismar yok	Sensitive Data Exposure and Escalating Privileges Vulnerabilities in DataMosaix™ Private Cloudrockwell automation · datamosaix™ private cloud · CWE-287 Kimlik doğrulama atlatma	Yüksek7,6	—	%0,2	2 Eyl 2026
40Planlayın	CVE-2026-4357İstismar yok	Embed HTML5 Game <= 1.3 - Unauthenticated Arbitrary File Uploadunknown · embed html5 game · CWE-434 Kimlik doğrulamasız Dosya yükleme	Kritik10,0	—	%0,5	2 Eyl 2026
39İzleyin	CVE-2026-77009İstismar yok	WatchMan-Site7 3.1.1 - 4.2.0 - Subscriber+ RCE via Debug Consoleunknown · watchman-site7 · CWE-94 RCE	Kritik9,9	—	%0,5	2 Eyl 2026
29İzleyin	CVE-2026-78590İstismar yok	Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resourceselastic · kibana · CWE-22 Yol geçişi	Yüksek7,3	—	%0,4	2 Eyl 2026
31İzleyin	CVE-2026-78604İstismar yok	Incorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEMelastic · elastic agent · CWE-732 Yerel yetki yükseltme	Yüksek7,8	—	%0,1	2 Eyl 2026
34İzleyin	CVE-2026-79989İstismar yok	Arbitrary user password reset leading to administrator account takeovercraftcms · cms · CWE-285 Erişim denetimi (IDOR)	Yüksek8,7	—	%0,4	2 Eyl 2026
34İzleyin	CVE-2026-79990İstismar yok	GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/deletecraftcms · cms · CWE-639 Erişim denetimi (IDOR)	Yüksek8,7	—	%0,4	2 Eyl 2026
28İzleyin	CVE-2026-79991İstismar yok	Authenticated SQL Injection via nested eager-loading criteriacraftcms · cms · CWE-89 SQL enjeksiyonu	Yüksek7,1	—	%0,5	2 Eyl 2026
36İzleyin	CVE-2026-82955İstismar yok	In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Gaeclipse foundation · eclipse aerios · CWE-295 Kimlik doğrulamasız Zayıf kripto	Kritik9,0	—	%0,1	2 Eyl 2026
30İzleyin	CVE-2026-81774İstismar yok	WordPress WooCommerce Product Attachment plugin <= 2.3.4 - Sensitive Data Exposure vulnerabilitydotstore · woocommerce product attachment · CWE-497 Kimlik doğrulamasız Bilgi sızıntısı	Yüksek7,5	—	%0,4	2 Eyl 2026
32İzleyin	CVE-2026-14199İstismar yok	Session takeover via Auth Proxy cache key collisiongrafana · grafana · CWE-290 Kimlik doğrulama atlatma	Yüksek8,1	—	%0,3	2 Eyl 2026
29İzleyin	CVE-2026-18058İstismar yok	The mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps.motorola · smart connect application · CWE-862 Yerel yetki yükseltme Erişim denetimi (IDOR)	Yüksek7,3	—	%0,0	2 Eyl 2026
35İzleyin	CVE-2026-18329İstismar yok	NGINX ngx_http_js_module vulnerabilityf5 · nginx javascript · CWE-636 Kimlik doğrulamasız	Yüksek8,8	—	%0,3	2 Eyl 2026
40Planlayın	CVE-2026-53611İstismar yok	Looking Glass: Remote Code Execution via Unanchored Regular Expression in BGPASPath Input Validationas203038 · looking-glass · CWE-78 Girişsiz RCE Komut enjeksiyonu	Kritik9,8	—	%1,9	2 Eyl 2026
34İzleyin	CVE-2026-66362İstismar yok	Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX configf5 · nginx gateway fabric · CWE-76	Yüksek8,6	—	%0,5	2 Eyl 2026
34İzleyin	CVE-2026-66842İstismar yok	BIG-IP and BIG-IQ Configuration utility vulnerabilityf5 · big-ip · CWE-918 SSRF	Yüksek8,7	—	%0,4	2 Eyl 2026
34İzleyin	CVE-2026-77180İstismar yok	NGINX Ingress Controller vulnerabilityf5 · nginx ingress controller · CWE-76	Yüksek8,7	—	%0,4	2 Eyl 2026
34İzleyin	CVE-2026-78222İstismar yok	NGINX ngx_http_js_module vulnerabilityf5 · nginx javascript · CWE-476 Kimlik doğrulamasız Bellek hatası	Yüksek8,7	—	%0,6	2 Eyl 2026
36İzleyin	CVE-2026-78689İstismar yok	NGINX ngx_http_js_module vulnerablilityf5 · nginx javascript · CWE-122 Kimlik doğrulamasız Bellek hatası	Kritik9,2	—	%0,7	2 Eyl 2026
35İzleyin	CVE-2026-84645İstismar yok	In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level confijenkins · jenkins · CWE-94 RCE	Yüksek8,8	—	%0,7	2 Eyl 2026
35İzleyin	CVE-2026-84647İstismar yok	In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier,jenkins project · jenkins · CWE-502 Deserializasyon	Yüksek8,8	—	%0,5	2 Eyl 2026
35İzleyin	CVE-2026-84648İstismar yok	In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timestajenkins · jenkins · CWE-79 Kimlik doğrulamasız XSS	Yüksek8,8	—	%0,5	2 Eyl 2026
35İzleyin	CVE-2026-84649İstismar yok	In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.447 thjenkins project · jenkins · CWE-352 Kimlik doğrulamasız CSRF	Yüksek8,8	—	%0,2	2 Eyl 2026
35İzleyin	CVE-2026-84650İstismar yok	In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to jenkins · jenkins · CWE-502 Deserializasyon	Yüksek8,8	—	%0,4	2 Eyl 2026
29İzleyin	CVE-2026-84652İstismar yok	In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember mejenkins · jenkins · CWE-384	Yüksek7,3	—	%0,4	2 Eyl 2026
32İzleyin	CVE-2026-84665İstismar yok	Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scannerjenkins project · jenkins sonarqube scanner plugin · CWE-79 XSS	Yüksek8,0	—	%0,4	2 Eyl 2026
28İzleyin	CVE-2026-84667İstismar yok	Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing attajenkins project · jenkins thinbackup plugin · CWE-22 Yol geçişi	Yüksek7,1	—	%0,3	2 Eyl 2026
35İzleyin	CVE-2026-84668İstismar yok	Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data bindijenkins project · jenkins saml plugin · CWE-284 Erişim denetimi (IDOR)	Yüksek8,8	—	%0,4	2 Eyl 2026
35İzleyin	CVE-2026-84669İstismar yok	A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish Ajenkins project · jenkins allure plugin · CWE-22 Yol geçişi	Yüksek8,8	—	%0,5	2 Eyl 2026
35İzleyin	CVE-2026-84670İstismar yok	Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cachedjenkins project · jenkins performance plugin · CWE-502 RCE Deserializasyon	Yüksek8,8	—	%0,6	2 Eyl 2026
35İzleyin	CVE-2026-84671İstismar yok	Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to arbitrary locations on the Jenkins controller file sysjenkins project · jenkins file parameter plugin · CWE-22 RCE Yol geçişi	Yüksek8,8	—	%0,8	2 Eyl 2026
35İzleyin	CVE-2026-84672İstismar yok	Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions using both the group'sjenkins project · jenkins microsoft entra id (previously azure ad) plugin · CWE-639 Erişim denetimi (IDOR)	Yüksek8,8	—	%0,4	2 Eyl 2026
35İzleyin	CVE-2026-84673İstismar yok	Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configuration through Staplerjenkins project · jenkins customizable header plugin · CWE-79 XSS	Yüksek8,8	—	%0,5	2 Eyl 2026
29İzleyin	CVE-2026-84675İstismar yok	OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable vjenkins project · jenkins tics plugin · CWE-78 RCE Komut enjeksiyonu	Yüksek7,4	—	%1,1	2 Eyl 2026
39İzleyin	CVE-2026-20212Kavram kanıtı	Cisco Nexus 3000 and 9000 Series Switches Silicon One Hardware Abstraction Layer Remote Code Execution Vulnerabilitycisco · cisco nx-os software · CWE-1327 Girişsiz RCE	Kritik9,8	—	%0,7	2 Eyl 2026
39İzleyin	CVE-2026-20274İstismar yok	Cisco IOS XR Software Security Hardening Release: September 2026cisco · ios xr · CWE-664 Kimlik doğrulamasız	Kritik9,8	—	%0,7	2 Eyl 2026
35İzleyin	CVE-2026-20275İstismar yok	Cisco IOS XR Software Security Hardening Release: September 2026cisco · cisco ios xr software · CWE-682 Kimlik doğrulamasız	Yüksek8,8	—	%0,1	2 Eyl 2026
34İzleyin	CVE-2026-20276İstismar yok	Cisco IOS XR Software Security Hardening Release: September 2026cisco · ios xr · CWE-691 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek8,6	—	%0,2	2 Eyl 2026
32İzleyin	CVE-2026-20277İstismar yok	Cisco IOS XR Software Security Hardening Release: September 2026cisco · cisco ios xr software · CWE-693 Kimlik doğrulamasız	Yüksek8,2	—	%0,2	2 Eyl 2026
35İzleyin	CVE-2026-20278İstismar yok	Cisco IOS XR Software Security Hardening Release: September 2026cisco · cisco ios xr software · CWE-707	Yüksek8,8	—	%0,2	2 Eyl 2026
39İzleyin	CVE-2026-20279İstismar yok	Cisco IOS XR Software Security Hardening Release: September 2026cisco · cisco ios xr software · CWE-284 Kimlik doğrulamasız Erişim denetimi (IDOR)	Kritik9,8	—	%0,3	2 Eyl 2026
35İzleyin	CVE-2026-20280İstismar yok	Cisco IOS XR Software Security Hardening Release: September 2026cisco · ios xr · CWE-703	Yüksek8,8	—	%0,2	2 Eyl 2026
30İzleyin	CVE-2026-20281İstismar yok	Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Denial of Service Vulnerabilitycisco · cisco session initiation protocol (sip) software · CWE-401 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek7,5	—	%0,3	2 Eyl 2026
33İzleyin	CVE-2026-45730İstismar yok	Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any projectnuclio · nuclio · CWE-862 Erişim denetimi (IDOR)	Yüksek8,3	—	%0,4	2 Eyl 2026
32İzleyin	CVE-2026-52831İstismar yok	Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCEnuclio · nuclio · CWE-78 RCE Komut enjeksiyonu	Yüksek8,0	—	%0,5	2 Eyl 2026
19İzleyin	CVE-2026-52832Kavram kanıtı	Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard containernuclio · nuclio · CWE-22 Kimlik doğrulama atlatma Yol geçişi	Orta4,9	—	%0,5	2 Eyl 2026
32İzleyin	CVE-2026-52833İstismar yok	Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCEnuclio · nuclio · CWE-94 RCE	Yüksek8,0	—	%0,5	2 Eyl 2026
30İzleyin	CVE-2026-53635İstismar yok	Open edX Platform: Insufficient Permission on set_course_mode_price()openedx · openedx-platform · CWE-862 Erişim denetimi (IDOR)	Yüksek7,6	—	%0,3	2 Eyl 2026
28İzleyin	CVE-2026-79754İstismar yok	Nuclio: Kaniko build tempDir command injectionnuclio · nuclio · CWE-77 RCE Komut enjeksiyonu	Yüksek7,1	—	%0,7	2 Eyl 2026
32İzleyin	CVE-2026-79755İstismar yok	Nuclio: Unauthenticated OS command injection via function namespace in docker ps --filter label (local Docker platform)nuclio · nuclio · CWE-78 RCE Komut enjeksiyonu	Yüksek8,0	—	%0,6	2 Eyl 2026
36İzleyin	CVE-2026-79756İstismar yok	Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platformnuclio · nuclio · CWE-78 Girişsiz RCE Komut enjeksiyonu	Yüksek8,7	—	%7,5	2 Eyl 2026
33İzleyin	CVE-2026-82404İstismar yok	TOON: Prototype pollution when decoding untrusted TOON inputtoon-format · toon · CWE-1321 Kimlik doğrulamasız Prototype pollution	Yüksek8,3	—	%0,6	2 Eyl 2026
28İzleyin	CVE-2026-84809İstismar yok	Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecodetencent · ai-infra-guard · CWE-693 Kimlik doğrulamasız	Yüksek7,1	—	%0,5	2 Eyl 2026
28İzleyin	CVE-2026-84810İstismar yok	claude-skill-antivirus Analysis Bypass via Manifest-Only Local Directory Scanclaude-world · claude-skill-antivirus · CWE-693 Kimlik doğrulamasız	Yüksek7,1	—	%0,3	2 Eyl 2026
28İzleyin	CVE-2026-84811İstismar yok	agentverus-scanner Companion Code Analysis Bypass via Excluded Python Bytecodeagentverus · agentverus-scanner · CWE-693 Girişsiz RCE	Yüksek7,1	—	%0,5	2 Eyl 2026
29İzleyin	CVE-2026-76782İstismar yok	Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102drupal · screenshot · CWE-434 Dosya yükleme	Yüksek7,3	—	%0,2	2 Eyl 2026
28İzleyin	CVE-2026-49249İstismar yok	Boruta: Authenticated atom-exhaustion DoS in BorutaIdentityWeb.UserSettingsController.update/2malach-it · boruta-server · CWE-400 Hizmet dışı bırakma	Yüksek7,1	—	%0,3	2 Eyl 2026
32İzleyin	CVE-2026-49832İstismar yok	DSpace: Remote Code Execution (RCE) possible in Velocity Templates used by LDNdspace · dspace · CWE-94 RCE	Yüksek8,0	—	%0,8	2 Eyl 2026
38İzleyin	CVE-2026-53649İstismar yok	Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCEbishopfox · joro · CWE-306 Girişsiz RCE Kimlik doğrulama atlatma	Kritik9,6	—	%0,3	2 Eyl 2026
37İzleyin	CVE-2026-53670İstismar yok	PREVAIL: Non-singleton typeset in add() skips offset update, allowing OOB access to pass eBPF verificationvbpf · prevail · CWE-682 Kimlik doğrulamasız	Kritik9,3	—	%0,5	2 Eyl 2026

CVE-2026-19453
28İzleyin
JetBackup 3.1.7.9 - 3.1.23.3 - Subscriber+ Privilege Escalation via Restore Admin User Selection
YüksekCVSS 7,1İstismar yokEPSS %0
unknown · jetbackup2 Eyl 2026
CVE-2026-19723
28İzleyin
Social Media Share Buttons & Social Sharing Icons < 3.0.1 - Reflected XSS via Pin It Share Handler
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
unknown · social media share buttons & social sharing icons2 Eyl 2026
CVE-2026-77788
19İzleyin
Rank Math SEO < 1.0.277 - Author+ Arbitrary Post and User Metadata Overwrite via updateSchemas
OrtaCVSS 4,9İstismar yokEPSS %0
- Erişim denetimi (IDOR)
unknown · rank math seo2 Eyl 2026
CVE-2026-77792
30İzleyin
RegistrationMagic < 6.0.9.9 - Unauthenticated Stored XSS via Rating Field
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
unknown · registrationmagic2 Eyl 2026
CVE-2026-78657
39İzleyin
SigmaForms Pro <= 1.4.11 - Unauthenticated Arbitrary File Deletion via Path Traversal in File Upload Field
KritikCVSS 9,8İstismar yokEPSS %1
- Girişsiz RCE
- Yol geçişi
bdthemes · sigmaforms pro – ai generated forms2 Eyl 2026
CVE-2026-80467
32İzleyin
Advanced Custom Fields: Extended 0.9.2.2 - 0.9.2.6 - Unauthenticated Privilege Escalation via Front-End User Insert Action
YüksekCVSS 8,1Kavram kanıtıEPSS %0
- Kimlik doğrulamasız
unknown · advanced custom fields: extended2 Eyl 2026
CVE-2026-81199
21İzleyin
MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure via student/stats REST Route
OrtaCVSS 5,3Kavram kanıtıEPSS %0
- Kimlik doğrulamasız
- Bilgi sızıntısı
unknown · masterstudy lms wordpress plugin2 Eyl 2026
CVE-2026-81737
35İzleyin
FAQ Builder AYS 1.6.3 - 1.8.4 - Unauthenticated Stored XSS via ays_get_user_information
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
unknown · faq builder ays2 Eyl 2026
CVE-2026-81807
35İzleyin
Simple Ajax Chat < 20260827 - Unauthenticated Stored XSS via Chat Message Linkification
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
unknown · simple ajax chat2 Eyl 2026
CVE-2026-82183
32İzleyin
OAuth Single Sign On 6.25.0 - 7.0.0 - Unauthenticated Account Takeover via Unverified Steam OpenID Assertion
YüksekCVSS 8,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
unknown · oauth single sign on2 Eyl 2026
CVE-2026-82883
28İzleyin
WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
marcus · login with ajax2 Eyl 2026
CVE-2026-14828
35İzleyin
Zohocorp ManageEngine Password Manager Pro versions before 13235, PAM360 versions before 8561, and Access Manager Plus versions before 4405
YüksekCVSS 8,8İstismar yokEPSS %1
- SQL enjeksiyonu
zohocorp · manageengine password manager pro2 Eyl 2026
CVE-2026-75528
28İzleyin
Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log
YüksekCVSS 7,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
wpmudev · broken link checker2 Eyl 2026
CVE-2026-19754
34İzleyin
Baserow 2.2.0 through 2.3.3 - SQL injection in formula index() JSONB array extraction
YüksekCVSS 8,6İstismar yokEPSS %0
- SQL enjeksiyonu
baserow · baserow2 Eyl 2026
CVE-2025-46418
30İzleyin
Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition.
YüksekCVSS 7,6İstismar yokEPSS %0
- RCE
- Komut enjeksiyonu
westermo · weos2 Eyl 2026
CVE-2026-18672
30İzleyin
RadImageEditor ClientState Unauthenticated Arbitrary File Read Vulnerability in Telerik UI for ASP.NET AJAX
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Yol geçişi
progress software · telerik ui for asp.net ajax2 Eyl 2026
CVE-2026-19219
32İzleyin
DialogHandler UploadPaths Tampering Vulnerability in Telerik UI for ASP.NET AJAX
YüksekCVSS 8,1İstismar yokEPSS %0
- Girişsiz RCE
progress software · telerik ui for asp.net ajax2 Eyl 2026
CVE-2026-82958
30İzleyin
In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by
YüksekCVSS 7,6İstismar yokEPSS %0
eclipse foundation · eclipse ditto2 Eyl 2026
CVE-2026-81283
35İzleyin
WordPress WP User Frontend plugin <= 4.3.10 - PHP Object Injection vulnerability
YüksekCVSS 8,8İstismar yokEPSS %0
- Deserializasyon
wedevs · wp user frontend2 Eyl 2026
CVE-2026-81286
37İzleyin
WordPress WCFM Marketplace plugin <= 3.8.1 - SQL Injection vulnerability
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- SQL enjeksiyonu
wc lovers · wcfm marketplace2 Eyl 2026
CVE-2026-81288
28İzleyin
WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
wp swings · upsell order bump offer for woocommerce2 Eyl 2026
CVE-2026-81289
28İzleyin
WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.13.1 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
sonaar · mp3 audio player for music, radio & podcast by sonaar2 Eyl 2026
CVE-2026-81294
39İzleyin
WordPress Authorizer plugin <= 3.15.1 - Privilege Escalation vulnerability
KritikCVSS 9,8Kavram kanıtıEPSS %0
- Kimlik doğrulamasız
paul ryan · authorizer2 Eyl 2026
CVE-2026-81769
35İzleyin
WordPress Booking Hub plugin <= 1.3.1 - Privilege Escalation vulnerability
YüksekCVSS 8,8İstismar yokEPSS %0
liquidthemes · booking hub2 Eyl 2026
CVE-2026-81770
28İzleyin
WordPress Interactive Geo Maps plugin <= 1.6.30 - Reflected Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
mapgeo · interactive geo maps2 Eyl 2026
CVE-2026-81771
28İzleyin
WordPress TrustedSite plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
trustedsite · trustedsite2 Eyl 2026
CVE-2026-81772
35İzleyin
WordPress Ninja Forms - Layout & Styles plugin <= 3.0.31 - PHP Object Injection vulnerability
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Deserializasyon
saturday drive · ninja forms - layout & styles2 Eyl 2026
CVE-2026-81775
28İzleyin
WordPress Estatik plugin <= 4.3.4 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
estatik · estatik2 Eyl 2026
CVE-2026-84759
28İzleyin
WordPress Activity Log plugin <= 2.13.1 - Cross Site Request Forgery (CSRF) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- CSRF
elementor · activity log2 Eyl 2026
CVE-2026-84764
35İzleyin
WordPress Simply Schedule Appointments plugin <= 1.6.12.23 - Cross Site Request Forgery (CSRF) vulnerability
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- CSRF
nsquared · simply schedule appointments2 Eyl 2026
CVE-2026-84770
35İzleyin
WordPress Mang Board WP plugin <= 2.3.8 - Cross Site Request Forgery (CSRF) vulnerability
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- CSRF
kitae park · mang board wp2 Eyl 2026
CVE-2026-84794
28İzleyin
Craft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset
YüksekCVSS 7,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
craftcms · cms2 Eyl 2026
CVE-2026-84795
36İzleyin
Craft CMS before 5.10.11 Authentication Bypass via Admin Flag Inheritance
KritikCVSS 9,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
craftcms · cms2 Eyl 2026
CVE-2026-84796
34İzleyin
Craft CMS 5.0.0-RC1 before 5.10.11 GraphQL Entry Mutation Site Scope Bypass
YüksekCVSS 8,7İstismar yokEPSS %0
- Erişim denetimi (IDOR)
craftcms · cms2 Eyl 2026
CVE-2026-84798
28İzleyin
Craft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite
YüksekCVSS 7,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
craftcms · cms2 Eyl 2026
CVE-2026-84800
28İzleyin
Craft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file
YüksekCVSS 7,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
craftcms · cms2 Eyl 2026
CVE-2026-84801
34İzleyin
Craft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulama atlatma
- Erişim denetimi (IDOR)
craftcms · cms2 Eyl 2026
CVE-2026-84803
34İzleyin
SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist
YüksekCVSS 8,6İstismar yokEPSS %0
- XSS
siyuan-note · siyuan2 Eyl 2026
CVE-2026-73475
36İzleyin
Commerce PayPal - Moderately critical - Access bypass - SA-CONTRIB-2026-095
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
centarro · commerce paypal2 Eyl 2026
CVE-2026-76759
29İzleyin
Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102
YüksekCVSS 7,3İstismar yokEPSS %0
- XSS
drupal · screenshot2 Eyl 2026
CVE-2024-7956
30İzleyin
Sensitive Data Exposure and Escalating Privileges Vulnerabilities in DataMosaix™ Private Cloud
YüksekCVSS 7,6İstismar yokEPSS %0
- Kimlik doğrulama atlatma
rockwell automation · datamosaix™ private cloud2 Eyl 2026
CVE-2026-4357
40Planlayın
Embed HTML5 Game <= 1.3 - Unauthenticated Arbitrary File Upload
KritikCVSS 10,0İstismar yokEPSS %0
- Kimlik doğrulamasız
- Dosya yükleme
unknown · embed html5 game2 Eyl 2026
CVE-2026-77009
39İzleyin
WatchMan-Site7 3.1.1 - 4.2.0 - Subscriber+ RCE via Debug Console
KritikCVSS 9,9İstismar yokEPSS %0
- RCE
unknown · watchman-site72 Eyl 2026
CVE-2026-78590
29İzleyin
Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources
YüksekCVSS 7,3İstismar yokEPSS %0
- Yol geçişi
elastic · kibana2 Eyl 2026
CVE-2026-78604
31İzleyin
Incorrect Permission Assignment for Critical Resource in Elastic Agent Leading to Local Privilege Escalation to SYSTEM
YüksekCVSS 7,8İstismar yokEPSS %0
- Yerel yetki yükseltme
elastic · elastic agent2 Eyl 2026
CVE-2026-79989
34İzleyin
Arbitrary user password reset leading to administrator account takeover
YüksekCVSS 8,7İstismar yokEPSS %0
- Erişim denetimi (IDOR)
craftcms · cms2 Eyl 2026
CVE-2026-79990
34İzleyin
GQL entry mutation `siteId` bypasses schema site scope, enabling cross-site content read/write/delete
YüksekCVSS 8,7İstismar yokEPSS %0
- Erişim denetimi (IDOR)
craftcms · cms2 Eyl 2026
CVE-2026-79991
28İzleyin
Authenticated SQL Injection via nested eager-loading criteria
YüksekCVSS 7,1İstismar yokEPSS %0
- SQL enjeksiyonu
craftcms · cms2 Eyl 2026
CVE-2026-82955
36İzleyin
In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Ga
KritikCVSS 9,0İstismar yokEPSS %0
- Kimlik doğrulamasız
- Zayıf kripto
eclipse foundation · eclipse aerios2 Eyl 2026
CVE-2026-81774
30İzleyin
WordPress WooCommerce Product Attachment plugin <= 2.3.4 - Sensitive Data Exposure vulnerability
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bilgi sızıntısı
dotstore · woocommerce product attachment2 Eyl 2026
CVE-2026-14199
32İzleyin
Session takeover via Auth Proxy cache key collision
YüksekCVSS 8,1İstismar yokEPSS %0
- Kimlik doğrulama atlatma
grafana · grafana2 Eyl 2026
CVE-2026-18058
29İzleyin
The mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps.
YüksekCVSS 7,3İstismar yokEPSS %0
- Yerel yetki yükseltme
- Erişim denetimi (IDOR)
motorola · smart connect application2 Eyl 2026
CVE-2026-18329
35İzleyin
NGINX ngx_http_js_module vulnerability
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
f5 · nginx javascript2 Eyl 2026
CVE-2026-53611
40Planlayın
Looking Glass: Remote Code Execution via Unanchored Regular Expression in BGPASPath Input Validation
KritikCVSS 9,8İstismar yokEPSS %1
- Girişsiz RCE
- Komut enjeksiyonu
as203038 · looking-glass2 Eyl 2026
CVE-2026-66362
34İzleyin
Description: When NGINX Plus is configured as the data plane for NGINX Gateway Fabric, an injection vulnerability exists in the NGINX config
YüksekCVSS 8,6İstismar yokEPSS %0
f5 · nginx gateway fabric2 Eyl 2026
CVE-2026-66842
34İzleyin
BIG-IP and BIG-IQ Configuration utility vulnerability
YüksekCVSS 8,7İstismar yokEPSS %0
- SSRF
f5 · big-ip2 Eyl 2026
CVE-2026-77180
34İzleyin
NGINX Ingress Controller vulnerability
YüksekCVSS 8,7İstismar yokEPSS %0
f5 · nginx ingress controller2 Eyl 2026
CVE-2026-78222
34İzleyin
NGINX ngx_http_js_module vulnerability
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
f5 · nginx javascript2 Eyl 2026
CVE-2026-78689
36İzleyin
NGINX ngx_http_js_module vulnerablility
KritikCVSS 9,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
f5 · nginx javascript2 Eyl 2026
CVE-2026-84645
35İzleyin
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level confi
YüksekCVSS 8,8İstismar yokEPSS %0
- RCE
jenkins · jenkins2 Eyl 2026
CVE-2026-84647
35İzleyin
In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier,
YüksekCVSS 8,8İstismar yokEPSS %0
- Deserializasyon
jenkins project · jenkins2 Eyl 2026
CVE-2026-84648
35İzleyin
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timesta
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
jenkins · jenkins2 Eyl 2026
CVE-2026-84649
35İzleyin
In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.447 th
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- CSRF
jenkins project · jenkins2 Eyl 2026
CVE-2026-84650
35İzleyin
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to
YüksekCVSS 8,8İstismar yokEPSS %0
- Deserializasyon
jenkins · jenkins2 Eyl 2026
CVE-2026-84652
29İzleyin
In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me
YüksekCVSS 7,3İstismar yokEPSS %0
jenkins · jenkins2 Eyl 2026
CVE-2026-84665
32İzleyin
Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner
YüksekCVSS 8,0İstismar yokEPSS %0
- XSS
jenkins project · jenkins sonarqube scanner plugin2 Eyl 2026
CVE-2026-84667
28İzleyin
Jenkins ThinBackup Plugin 2.1.4 and earlier allows overwriting the plugin's backup configuration through Stapler data binding, allowing atta
YüksekCVSS 7,1İstismar yokEPSS %0
- Yol geçişi
jenkins project · jenkins thinbackup plugin2 Eyl 2026
CVE-2026-84668
35İzleyin
Jenkins SAML Plugin 4.618.v441a_27fa_46d2 and earlier allows overwriting the SAML identity provider metadata file through Stapler data bindi
YüksekCVSS 8,8İstismar yokEPSS %0
- Erişim denetimi (IDOR)
jenkins project · jenkins saml plugin2 Eyl 2026
CVE-2026-84669
35İzleyin
A path traversal vulnerability in Jenkins Allure Plugin 2.35.2 and earlier allows attackers with Item/Read permission on jobs that publish A
YüksekCVSS 8,8İstismar yokEPSS %0
- Yol geçişi
jenkins project · jenkins allure plugin2 Eyl 2026
CVE-2026-84670
35İzleyin
Jenkins Performance Plugin 1015.v09ca_52b_3370e and earlier does not restrict the classes that can be instantiated when deserializing cached
YüksekCVSS 8,8İstismar yokEPSS %0
- RCE
- Deserializasyon
jenkins project · jenkins performance plugin2 Eyl 2026
CVE-2026-84671
35İzleyin
Jenkins File Parameter Plugin 425.v3fa_801681b_5e and earlier allows writing files to arbitrary locations on the Jenkins controller file sys
YüksekCVSS 8,8İstismar yokEPSS %0
- RCE
- Yol geçişi
jenkins project · jenkins file parameter plugin2 Eyl 2026
CVE-2026-84672
35İzleyin
Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0b_ff8e9cc2d2 and earlier grants Entra group permissions using both the group's
YüksekCVSS 8,8İstismar yokEPSS %0
- Erişim denetimi (IDOR)
jenkins project · jenkins microsoft entra id (previously azure ad) plugin2 Eyl 2026
CVE-2026-84673
35İzleyin
Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows overwriting the plugin's appearance configuration through Stapler
YüksekCVSS 8,8İstismar yokEPSS %0
- XSS
jenkins project · jenkins customizable header plugin2 Eyl 2026
CVE-2026-84675
29İzleyin
OS command injection vulnerability in Jenkins TICS Plugin 2025.1.1 and earlier allows attackers able to control build environment variable v
YüksekCVSS 7,4İstismar yokEPSS %1
- RCE
- Komut enjeksiyonu
jenkins project · jenkins tics plugin2 Eyl 2026
CVE-2026-20212
39İzleyin
Cisco Nexus 3000 and 9000 Series Switches Silicon One Hardware Abstraction Layer Remote Code Execution Vulnerability
KritikCVSS 9,8Kavram kanıtıEPSS %0
- Girişsiz RCE
cisco · cisco nx-os software2 Eyl 2026
CVE-2026-20274
39İzleyin
Cisco IOS XR Software Security Hardening Release: September 2026
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
cisco · ios xr2 Eyl 2026
CVE-2026-20275
35İzleyin
Cisco IOS XR Software Security Hardening Release: September 2026
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
cisco · cisco ios xr software2 Eyl 2026
CVE-2026-20276
34İzleyin
Cisco IOS XR Software Security Hardening Release: September 2026
YüksekCVSS 8,6İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
cisco · ios xr2 Eyl 2026
CVE-2026-20277
32İzleyin
Cisco IOS XR Software Security Hardening Release: September 2026
YüksekCVSS 8,2İstismar yokEPSS %0
- Kimlik doğrulamasız
cisco · cisco ios xr software2 Eyl 2026
CVE-2026-20278
35İzleyin
Cisco IOS XR Software Security Hardening Release: September 2026
YüksekCVSS 8,8İstismar yokEPSS %0
cisco · cisco ios xr software2 Eyl 2026
CVE-2026-20279
39İzleyin
Cisco IOS XR Software Security Hardening Release: September 2026
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
cisco · cisco ios xr software2 Eyl 2026
CVE-2026-20280
35İzleyin
Cisco IOS XR Software Security Hardening Release: September 2026
YüksekCVSS 8,8İstismar yokEPSS %0
cisco · ios xr2 Eyl 2026
CVE-2026-20281
30İzleyin
Cisco Desk Phone 9800 Series, IP Phone 7800 and 8800 Series, and Video Phone 8875 with SIP Software Denial of Service Vulnerability
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
cisco · cisco session initiation protocol (sip) software2 Eyl 2026
CVE-2026-45730
33İzleyin
Nuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project
YüksekCVSS 8,3İstismar yokEPSS %0
- Erişim denetimi (IDOR)
nuclio · nuclio2 Eyl 2026
CVE-2026-52831
32İzleyin
Nuclio: Unsanitized cron trigger event headers/body injected into CronJob shell command leads to persistent RCE
YüksekCVSS 8,0İstismar yokEPSS %0
- RCE
- Komut enjeksiyonu
nuclio · nuclio2 Eyl 2026
CVE-2026-52832
19İzleyin
Nuclio: Unauthenticated path traversal in spec.handler allows arbitrary file write in Dashboard container
OrtaCVSS 4,9Kavram kanıtıEPSS %0
- Kimlik doğrulama atlatma
- Yol geçişi
nuclio · nuclio2 Eyl 2026
CVE-2026-52833
32İzleyin
Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE
YüksekCVSS 8,0İstismar yokEPSS %0
- RCE
nuclio · nuclio2 Eyl 2026
CVE-2026-53635
30İzleyin
Open edX Platform: Insufficient Permission on set_course_mode_price()
YüksekCVSS 7,6İstismar yokEPSS %0
- Erişim denetimi (IDOR)
openedx · openedx-platform2 Eyl 2026
CVE-2026-79754
28İzleyin
Nuclio: Kaniko build tempDir command injection
YüksekCVSS 7,1İstismar yokEPSS %0
- RCE
- Komut enjeksiyonu
nuclio · nuclio2 Eyl 2026
CVE-2026-79755
32İzleyin
Nuclio: Unauthenticated OS command injection via function namespace in docker ps --filter label (local Docker platform)
YüksekCVSS 8,0İstismar yokEPSS %0
- RCE
- Komut enjeksiyonu
nuclio · nuclio2 Eyl 2026
CVE-2026-79756
36İzleyin
Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform
YüksekCVSS 8,7İstismar yokEPSS %7
- Girişsiz RCE
- Komut enjeksiyonu
nuclio · nuclio2 Eyl 2026
CVE-2026-82404
33İzleyin
TOON: Prototype pollution when decoding untrusted TOON input
YüksekCVSS 8,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Prototype pollution
toon-format · toon2 Eyl 2026
CVE-2026-84809
28İzleyin
Tencent AI-Infra-Guard skill-scan Analysis Bypass via Excluded Python Bytecode
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
tencent · ai-infra-guard2 Eyl 2026
CVE-2026-84810
28İzleyin
claude-skill-antivirus Analysis Bypass via Manifest-Only Local Directory Scan
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
claude-world · claude-skill-antivirus2 Eyl 2026
CVE-2026-84811
28İzleyin
agentverus-scanner Companion Code Analysis Bypass via Excluded Python Bytecode
YüksekCVSS 7,1İstismar yokEPSS %0
- Girişsiz RCE
agentverus · agentverus-scanner2 Eyl 2026
CVE-2026-76782
29İzleyin
Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102
YüksekCVSS 7,3İstismar yokEPSS %0
- Dosya yükleme
drupal · screenshot2 Eyl 2026
CVE-2026-49249
28İzleyin
Boruta: Authenticated atom-exhaustion DoS in BorutaIdentityWeb.UserSettingsController.update/2
YüksekCVSS 7,1İstismar yokEPSS %0
- Hizmet dışı bırakma
malach-it · boruta-server2 Eyl 2026
CVE-2026-49832
32İzleyin
DSpace: Remote Code Execution (RCE) possible in Velocity Templates used by LDN
YüksekCVSS 8,0İstismar yokEPSS %0
- RCE
dspace · dspace2 Eyl 2026
CVE-2026-53649
38İzleyin
Joro: Unauthenticated Cross-Origin Plugin Upload Leads to RCE
KritikCVSS 9,6İstismar yokEPSS %0
- Girişsiz RCE
- Kimlik doğrulama atlatma
bishopfox · joro2 Eyl 2026
CVE-2026-53670
37İzleyin
PREVAIL: Non-singleton typeset in add() skips offset update, allowing OOB access to pass eBPF verification
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
vbpf · prevail2 Eyl 2026