Yayın tarihine göre

Eylül 2026: sömürülen ve yeni ciddi CVE kayıtları

7.963 kayıt · 32 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 51 / 80

CVE kayıtları
Aksiyon	CVE	Zafiyet	Ciddiyet	KEV	EPSS	Yayın
28İzleyin	CVE-2026-25278İstismar yok	Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive Software platform based on QNXqualcomm · lemans au lgit firmware · CWE-367 Yarış durumu	Yüksek7,0	—	%0,0	17 Eyl 2026
31İzleyin	CVE-2026-25280İstismar yok	Out-of-bounds Write in DSP Servicequalcomm · wsa8845h firmware · CWE-787 Bellek hatası	Yüksek7,8	—	%0,1	17 Eyl 2026
29İzleyin	CVE-2026-25281İstismar yok	Allocation of Resources Without Limits or Throttling in OOBMqualcomm · cologne firmware · CWE-770 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek7,4	—	%0,1	17 Eyl 2026
31İzleyin	CVE-2026-25282İstismar yok	Out-of-bounds Read in OOBMqualcomm · cologne firmware · CWE-125 Bellek hatası	Yüksek7,9	—	%0,0	17 Eyl 2026
35İzleyin	CVE-2026-25283İstismar yok	Stack-based Buffer Overflow in OOBMqualcomm · cologne firmware · CWE-121 Bellek hatası	Yüksek8,8	—	%0,1	17 Eyl 2026
29İzleyin	CVE-2026-25284İstismar yok	Buffer Over-read in OOBMqualcomm · cologne firmware · CWE-126	Yüksek7,3	—	%0,0	17 Eyl 2026
31İzleyin	CVE-2026-25290İstismar yok	Integer Overflow or Wraparound in OOBMqualcomm · cologne firmware · CWE-190 Bellek hatası	Yüksek7,8	—	%0,1	17 Eyl 2026
29İzleyin	CVE-2026-25294İstismar yok	Buffer Over-read in WLAN Firmwarequalcomm · cologne firmware · CWE-126 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek7,4	—	%0,1	17 Eyl 2026
39İzleyin	CVE-2026-87796Kavram kanıtı	Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Uploadsh1zen · multi uploader for gravity forms · CWE-434 Girişsiz RCE Dosya yükleme	Kritik9,8	—	%1,1	17 Eyl 2026
32İzleyin	CVE-2026-87935İstismar yok	Paid Downloads <= 3.15 - Unauthenticated Arbitrary File Upload via 'paiddownloads_update_file' Actionichurakov · paid downloads · CWE-434 Girişsiz RCE Dosya yükleme	Yüksek8,1	—	%0,9	17 Eyl 2026
30İzleyin	CVE-2026-85128İstismar yok	Choose User Role at Registration for WooCommerce < 1.3.3 - Unauthenticated Privilege Escalation via Registration Role Requestunknown · choose user role at registration · CWE-269 Kimlik doğrulamasız	Yüksek7,5	—	%0,3	17 Eyl 2026
35İzleyin	CVE-2026-85130İstismar yok	WPLP Cookie Consent < 4.4.4 - Unauthenticated Stored XSS via Consent Logsunknown · wplp cookie consent · CWE-79 Kimlik doğrulamasız XSS	Yüksek8,8	—	%0,5	17 Eyl 2026
39İzleyin	CVE-2026-86707İstismar yok	Private Feed Key <= 0.1 - Unauthenticated Authentication Bypass via 'feedkey' Parameterunknown · private feed key · CWE-287 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,8	—	%0,4	17 Eyl 2026
39İzleyin	CVE-2026-86709İstismar yok	The Pressengine <= 1.0 - Unauthenticated Authentication Bypassunknown · the pressengine · CWE-287 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,8	—	%0,6	17 Eyl 2026
39İzleyin	CVE-2026-86710İstismar yok	Login with QR <= 1.0.0 - Unauthenticated Authentication Bypass via 'autologin_code' Parameterunknown · login with qr · CWE-287 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,8	—	%0,4	17 Eyl 2026
35İzleyin	CVE-2026-87786İstismar yok	Dewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout Coordinatesunknown · dewa kirim · CWE-79 Kimlik doğrulamasız XSS	Yüksek8,8	—	%0,5	17 Eyl 2026
35İzleyin	CVE-2026-88792İstismar yok	Dictionary <= 1.0 - Unauthenticated Stored XSS via Direct Dictionary Updateunknown · dictionary · CWE-79 Kimlik doğrulamasız XSS	Yüksek8,8	—	%0,5	17 Eyl 2026
36İzleyin	CVE-2026-88795İstismar yok	wpShopGermany IT-RECHT KANZLEI < 2.4 - Unauthenticated RCE via Predictable API Tokenunknown · wpshopgermany it-recht kanzlei · CWE-94 Girişsiz RCE	Kritik9,0	—	%0,8	17 Eyl 2026
35İzleyin	CVE-2026-88904İstismar yok	PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalationunknown · puppyfw · CWE-269	Yüksek8,8	—	%0,4	17 Eyl 2026
28İzleyin	CVE-2026-91014İstismar yok	Realtyna Organic IDX plugin + WPL Real Estate < 5.4.2 - Reflected XSS via Location Selector Endpointunknown · realtyna organic idx plugin + wpl real estate · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,2	17 Eyl 2026
35İzleyin	CVE-2026-86801İstismar yok	To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, File Listing and Deletion via Unprotected Upload Handlerunknown · to do list member · CWE-306 Kimlik doğrulamasız Kimlik doğrulama atlatma XSS	Yüksek8,8	—	%0,5	17 Eyl 2026
34İzleyin	CVE-2026-87963İstismar yok	Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameterunknown · yo · CWE-89 Kimlik doğrulamasız SQL enjeksiyonu	Yüksek8,6	—	%0,4	17 Eyl 2026
29İzleyin	CVE-2026-50605İstismar yok	Privilege Escalation Vulnerability in NitroSense and PredatorSense Softwareacer · agent serivce · CWE-284 Yerel yetki yükseltme Erişim denetimi (IDOR)	Yüksek7,4	—	%0,1	17 Eyl 2026
29İzleyin	CVE-2026-50609İstismar yok	Unauthorized Registry Modification Vulnerability in NitroSense and PredatorSense Softwareacer · system monitoring · CWE-284 Yerel yetki yükseltme Erişim denetimi (IDOR)	Yüksek7,4	—	%0,1	17 Eyl 2026
29İzleyin	CVE-2026-50610İstismar yok	Improper Access control Vulnerability in NitroSense and PredatorSense Softwareacer · system monitoring · CWE-284 Yerel yetki yükseltme Erişim denetimi (IDOR)	Yüksek7,4	—	%0,1	17 Eyl 2026
31İzleyin	CVE-2025-59607İstismar yok	Untrusted Pointer Dereference in Windows Computequalcomm · cologne firmware · CWE-822	Yüksek7,8	—	%0,1	17 Eyl 2026
28İzleyin	CVE-2025-15697İstismar yok	Dictionary <= 1.0 - Reflected XSS via Multiple Parametersunknown · dictionary · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,2	17 Eyl 2026
30İzleyin	CVE-2026-78425İstismar yok	SAML Audience Confusion Allows Cross-SP Authenticationsuse · github.com/neuvector/neuvector · CWE-287 Kimlik doğrulama atlatma	Yüksek7,6	—	%0,3	17 Eyl 2026
35İzleyin	CVE-2026-78428İstismar yok	Flaw in Neuvector can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrentlysuse · neuvector · CWE-384 Kimlik doğrulamasız	Yüksek8,8	—	%0,2	17 Eyl 2026
32İzleyin	CVE-2026-92903İstismar yok	Improper Input Validation in Snowflake CLI Versions Allow Unsanitized User-Controlled Values to be Interpolated into SQL Stringssnowflake · snowflake cli · CWE-89 SQL enjeksiyonu Yerel yetki yükseltme	Yüksek8,2	—	%0,1	17 Eyl 2026
31İzleyin	CVE-2026-86320İstismar yok	Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)red hat · red hat enterprise linux 10 · CWE-94 RCE Yerel yetki yükseltme	Yüksek7,8	—	%0,2	17 Eyl 2026
39İzleyin	CVE-2026-90822İstismar yok	FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain an OS command injection vulnerabilifatpipe networks · mpvpn · CWE-78 Girişsiz RCE Komut enjeksiyonu	Kritik9,8	—	%1,4	17 Eyl 2026
39İzleyin	CVE-2026-90823İstismar yok	FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /ufatpipe networks · mpvpn · CWE-121 Girişsiz RCE Bellek hatası	Kritik9,8	—	%0,6	17 Eyl 2026
37İzleyin	CVE-2026-92860İstismar yok	rcourtman Pulse Quick Security Setup quick-setup fmt.Sprintf input validationrcourtman · pulse · CWE-20	Kritik9,4	—	%0,8	17 Eyl 2026
33İzleyin	CVE-2026-92912İstismar yok	AVideo Cryptographically Weak PRNG via uniqid Stream Keywwbn · avideo · CWE-330 Kimlik doğrulamasız Zayıf kripto	Yüksek8,3	—	%0,3	17 Eyl 2026
36İzleyin	CVE-2026-92913İstismar yok	AVideo Weak PRNG Activation Code Authentication Bypasswwbn · avideo · CWE-330 Kimlik doğrulamasız Kimlik doğrulama atlatma Zayıf kripto	Kritik9,1	—	%0,5	17 Eyl 2026
34İzleyin	CVE-2026-92914İstismar yok	AVideo LoginControl PGP Second Factor Authentication Bypasswwbn · avideo · CWE-287 Kimlik doğrulama atlatma	Yüksek8,6	—	%0,4	17 Eyl 2026
34İzleyin	CVE-2026-92917İstismar yok	Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_rgetgrav · grav · CWE-200 Kimlik doğrulamasız Bilgi sızıntısı	Yüksek8,7	—	%0,4	17 Eyl 2026
36İzleyin	CVE-2026-15688İstismar yok	Password Authentication Bypass Vulnerability in GX Works3 and Motion Control Settingmitsubishi electric corporation · gx works3 · CWE-303 Kimlik doğrulama atlatma	Kritik9,2	—	%0,1	17 Eyl 2026
34İzleyin	CVE-2026-92918İstismar yok	admin3 through 3.0.0 Session Token Disclosure via Audit Logcjbi · admin3 · CWE-532 Bilgi sızıntısı	Yüksek8,7	—	%0,6	17 Eyl 2026
28İzleyin	CVE-2026-92919İstismar yok	admin3 through 3.0.0 Arbitrary File Write via Path Traversal in Storage Upload Filenamecjbi · admin3 · CWE-22 Yol geçişi	Yüksek7,2	—	%0,5	17 Eyl 2026
35İzleyin	CVE-2026-14850İstismar yok	Weak password recovery mechanism for forgotten password in MobiAPParcmobiapparc · mobiapparc · CWE-640 Kimlik doğrulamasız	Yüksek8,8	—	%0,4	17 Eyl 2026
39İzleyin	CVE-2026-62101İstismar yok	WordPress EduAdmin Booking plugin <= 5.4.2 - Broken Authentication vulnerabilitychris åkerfeldt wendel · eduadmin booking · CWE-288 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,8	—	%0,6	17 Eyl 2026
40Planlayın	CVE-2026-62104İstismar yok	WordPress Migratico Lite plugin <= 2.6.8 - Remote Code Execution (RCE) vulnerabilitysuperweby · migratico lite · CWE-94 Girişsiz RCE	Kritik10,0	—	%0,8	17 Eyl 2026
39İzleyin	CVE-2026-62108İstismar yok	WordPress Headless Single Sign On plugin <= 1.7.0 - Broken Authentication vulnerabilityminiorange · headless single sign on · CWE-290 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,8	—	%0,6	17 Eyl 2026
28İzleyin	CVE-2026-66571İstismar yok	WordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.5 - Cross Site Request Forgery (CSRF) vulnerabilitygabe livan · asset cleanup: page speed booster · CWE-352 Kimlik doğrulamasız CSRF	Yüksek7,1	—	%0,1	17 Eyl 2026
34İzleyin	CVE-2026-66580İstismar yok	WordPress Product Feed Manager plugin <= 7.12.0 - SQL Injection vulnerabilityrextheme · product feed manager · CWE-89 SQL enjeksiyonu	Yüksek8,5	—	%0,3	17 Eyl 2026
30İzleyin	CVE-2026-66618İstismar yok	WordPress WP Maps plugin <= 4.9.9 - SQL Injection vulnerabilityflipper code · wp maps · CWE-89 SQL enjeksiyonu	Yüksek7,6	—	%0,3	17 Eyl 2026
30İzleyin	CVE-2026-66619İstismar yok	WordPress Newsletters plugin <= 4.18 - SQL Injection vulnerabilitytribulant software · newsletters · CWE-89 SQL enjeksiyonu	Yüksek7,6	—	%0,3	17 Eyl 2026
30İzleyin	CVE-2026-66624İstismar yok	WordPress WPMasterToolKit plugin <= 2.22.0 - SQL Injection vulnerabilityludwig you · wpmastertoolkit · CWE-89 SQL enjeksiyonu	Yüksek7,6	—	%0,3	17 Eyl 2026
30İzleyin	CVE-2026-66625İstismar yok	WordPress WC Vendors Marketplace plugin <= 2.7.2.1 - SQL Injection vulnerabilitywcvendors · wc vendors marketplace · CWE-89 SQL enjeksiyonu	Yüksek7,6	—	%0,3	17 Eyl 2026
30İzleyin	CVE-2026-66626İstismar yok	WordPress SKT Addons for Elementor plugin <= 4.0 - SQL Injection vulnerabilitysonal s sinha · skt addons for elementor · CWE-89 SQL enjeksiyonu	Yüksek7,6	—	%0,3	17 Eyl 2026
30İzleyin	CVE-2026-66628İstismar yok	WordPress WP-Lister Lite for eBay plugin <= 3.8.11 - SQL Injection vulnerabilitywp lab · wp-lister lite for ebay · CWE-89 SQL enjeksiyonu	Yüksek7,6	—	%0,3	17 Eyl 2026
30İzleyin	CVE-2026-66630İstismar yok	WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerabilitypublishpress · publishpress series · CWE-89 SQL enjeksiyonu	Yüksek7,6	—	%0,3	17 Eyl 2026
30İzleyin	CVE-2026-66631İstismar yok	WordPress MC Woocommerce Wishlist plugin <= 1.9.21 - SQL Injection vulnerabilitymoreconvert team · mc woocommerce wishlist · CWE-89 SQL enjeksiyonu	Yüksek7,6	—	%0,3	17 Eyl 2026
35İzleyin	CVE-2026-78295İstismar yok	WordPress Xagio SEO plugin <= 7.1.0.43 - Cross Site Request Forgery (CSRF) vulnerabilityxagio seo · xagio seo · CWE-352 Kimlik doğrulamasız CSRF	Yüksek8,8	—	%0,2	17 Eyl 2026
30İzleyin	CVE-2026-80218İstismar yok	Sign-in token minted for one resource accepted by another in AshAuthenticationteam-alembic · ash_authentication · CWE-287 Kimlik doğrulama atlatma	Yüksek7,6	—	%0,6	17 Eyl 2026
28İzleyin	CVE-2026-81632İstismar yok	Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenixteam-alembic · ash_authentication_phoenix · CWE-598	Yüksek7,2	—	%0,2	17 Eyl 2026
30İzleyin	CVE-2026-82685İstismar yok	Confirmation token accepted on any record in AshAuthenticationteam-alembic · ash_authentication · CWE-639 Erişim denetimi (IDOR)	Yüksek7,6	—	%0,6	17 Eyl 2026
32İzleyin	CVE-2026-82760İstismar yok	Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-inteam-alembic · ash_authentication · CWE-407 Kimlik doğrulamasız	Yüksek8,2	—	%0,7	17 Eyl 2026
36İzleyin	CVE-2026-82761İstismar yok	Magic link single-use tokens replayable via TOCTOU race in AshAuthenticationteam-alembic · ash_authentication · CWE-367 Kimlik doğrulamasız Yarış durumu	Kritik9,1	—	%0,5	17 Eyl 2026
36İzleyin	CVE-2026-85500İstismar yok	`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthenticationteam-alembic · ash_authentication · CWE-305 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,1	—	%0,7	17 Eyl 2026
36İzleyin	CVE-2026-86533İstismar yok	Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenixteam-alembic · ash_authentication · CWE-613 Kimlik doğrulamasız	Kritik9,1	—	%0,9	17 Eyl 2026
34İzleyin	CVE-2026-89418İstismar yok	Uncontrolled Recursion leading to Denial of Service in protobuf-javascript (google-protobuf)google · protobuf-javascript (aka google-protobuf npm package) · CWE-674 Kimlik doğrulamasız Deserializasyon Hizmet dışı bırakma	Yüksek8,7	—	%0,2	17 Eyl 2026
28İzleyin	CVE-2026-90887İstismar yok	WordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerabilitywp inventory · wp inventory manager · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,2	17 Eyl 2026
28İzleyin	CVE-2026-90986İstismar yok	WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.21 - Cross Site Scripting (XSS) vulnerabilitycodepress it solutions llc · visitor traffic real time statistics pro · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,2	17 Eyl 2026
38İzleyin	CVE-2026-92934İstismar yok	vm2 before 3.11.8 Sandbox Escape RCE via AggregateErrorpatriksimek · vm2 · CWE-693 Girişsiz RCE	Kritik9,5	—	%0,7	17 Eyl 2026
38İzleyin	CVE-2026-92935Kavram kanıtı	vm2 NodeVM Remote Code Execution via Array-Shaped Requirepatriksimek · vm2 · CWE-913 Girişsiz RCE	Kritik9,5	—	%0,6	17 Eyl 2026
40Planlayın	CVE-2026-92937İstismar yok	vm2 3.11.6 Remote Code Execution via Promise call/applypatriksimek · vm2 · CWE-94 Girişsiz RCE	Kritik10,0	—	%1,0	17 Eyl 2026
37İzleyin	CVE-2026-92938İstismar yok	vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlitepatriksimek · vm2 · CWE-693 RCE	Kritik9,4	—	%0,6	17 Eyl 2026
37İzleyin	CVE-2026-92939İstismar yok	vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEnginepatriksimek · vm2 · CWE-114	Kritik9,4	—	%0,6	17 Eyl 2026
40Planlayın	CVE-2026-92940İstismar yok	vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgentpatriksimek · vm2 · CWE-668 Kimlik doğrulamasız	Kritik10,0	—	%0,4	17 Eyl 2026
40Planlayın	CVE-2026-92941İstismar yok	vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulationpatriksimek · vm2 · CWE-732 Kimlik doğrulamasız	Kritik10,0	—	%0,2	17 Eyl 2026
34İzleyin	CVE-2026-92942İstismar yok	vm2 before 3.11.7 Timeout Bypass via FinalizationRegistrypatriksimek · vm2 · CWE-400 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek8,7	—	%0,4	17 Eyl 2026
37İzleyin	CVE-2026-92944İstismar yok	vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protectorpatriksimek · vm2 · CWE-693 Girişsiz RCE	Kritik9,3	—	%0,8	17 Eyl 2026
40Planlayın	CVE-2026-92946İstismar yok	vm2 before 3.11.7 Remote Code Execution via require.externalpatriksimek · vm2 · CWE-913 Girişsiz RCE	Kritik10,0	—	%0,7	17 Eyl 2026
40Planlayın	CVE-2026-92947İstismar yok	vm2 before 3.11.7 Memory Disclosure via Buffer Poolpatriksimek · vm2 · CWE-200 Kimlik doğrulamasız Bilgi sızıntısı	Kritik10,0	—	%0,4	17 Eyl 2026
37İzleyin	CVE-2026-92948İstismar yok	vm2 3.9.6 through 3.11.5 Sandbox Escape via node:testpatriksimek · vm2 · CWE-693	Kritik9,4	—	%0,6	17 Eyl 2026
37İzleyin	CVE-2026-92950İstismar yok	vm2 before 3.11.7 Sandbox Escape via CLI requirepatriksimek · vm2 · CWE-453 RCE	Kritik9,3	—	%0,1	17 Eyl 2026
37İzleyin	CVE-2026-92951İstismar yok	vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolverpatriksimek · vm2 · CWE-706	Kritik9,4	—	%0,4	17 Eyl 2026
35İzleyin	CVE-2026-92952İstismar yok	vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypasspatriksimek · vm2 · CWE-669 Kimlik doğrulamasız	Yüksek8,9	—	%0,4	17 Eyl 2026
37İzleyin	CVE-2026-92953İstismar yok	vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArraypatriksimek · vm2 · CWE-913 Kimlik doğrulamasız Prototype pollution	Kritik9,3	—	%0,5	17 Eyl 2026
36İzleyin	CVE-2026-92954İstismar yok	vm2 3.10.0 through 3.11.7 Denial of Service via Host Promisepatriksimek · vm2 · CWE-248 Kimlik doğrulamasız	Kritik9,2	—	%0,4	17 Eyl 2026
40Planlayın	CVE-2026-92955İstismar yok	vm2 before 3.11.8 Sandbox Escape via NodeVMpatriksimek · vm2 · CWE-913 Kimlik doğrulamasız	Kritik10,0	—	%0,7	17 Eyl 2026
40Planlayın	CVE-2026-92956Kavram kanıtı	vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreamingpatriksimek · vm2 · CWE-693 Kimlik doğrulamasız	Kritik10,0	—	%0,5	17 Eyl 2026
37İzleyin	CVE-2026-92957İstismar yok	vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefixpatriksimek · vm2 · CWE-269	Kritik9,4	—	%0,5	17 Eyl 2026
33İzleyin	CVE-2026-92958İstismar yok	vm2 before 3.11.7 Denylist Bypass via fs/promisespatriksimek · vm2 · CWE-269	Yüksek8,4	—	%0,3	17 Eyl 2026
28İzleyin	CVE-2026-92959İstismar yok	vm2 before 3.11.8 allowAsync Bypass via Promise Thenablepatriksimek · vm2 · CWE-693	Yüksek7,1	—	%0,4	17 Eyl 2026
40Planlayın	CVE-2026-92960İstismar yok	vm2 before 3.11.6 Process-wide State Exposure via os and dnspatriksimek · vm2 · CWE-200 Kimlik doğrulamasız Bilgi sızıntısı	Kritik10,0	—	%0,4	17 Eyl 2026
34İzleyin	CVE-2026-92961İstismar yok	vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypasspatriksimek · vm2 · CWE-770 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek8,7	—	%0,5	17 Eyl 2026
34İzleyin	CVE-2026-92970İstismar yok	HUBzero CMS through 2.2.32 Path Traversal via File Uploadhubzero · hubzero-cms · CWE-22 Yol geçişi	Yüksek8,7	—	%0,8	17 Eyl 2026
34İzleyin	CVE-2026-92971İstismar yok	InternLM LMDeploy through 0.17.0 Assertion Denial of Serviceinternlm · lmdeploy · CWE-617 Kimlik doğrulamasız	Yüksek8,7	—	%0,7	17 Eyl 2026
35İzleyin	CVE-2026-92972İstismar yok	SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpointsgl-project · sglang · CWE-306 Kimlik doğrulamasız Kimlik doğrulama atlatma	Yüksek8,8	—	%0,4	17 Eyl 2026
34İzleyin	CVE-2026-63459İstismar yok	Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptionsvendurehq · vendure · CWE-79 XSS	Yüksek8,7	—	%0,4	17 Eyl 2026
30İzleyin	CVE-2026-63460İstismar yok	Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backendsvendurehq · vendure · CWE-1333 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek7,5	—	%0,6	17 Eyl 2026
36İzleyin	CVE-2026-63472İstismar yok	Vendure: External-authentication account takeover: external login linked to a pre-existing account by email without verificationvendurehq · vendure · CWE-287 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,1	—	%0,5	17 Eyl 2026
32İzleyin	CVE-2026-85077İstismar yok	Sanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responsessanic-org · sanic · CWE-113 Kimlik doğrulamasız	Yüksek8,2	—	%0,4	17 Eyl 2026
36İzleyin	CVE-2026-88952İstismar yok	OAuth2 sign-in attached to an existing account without an email comparison in AshAuthenticationteam-alembic · ash_authentication · CWE-287 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,1	—	%0,7	17 Eyl 2026
34İzleyin	CVE-2026-92983İstismar yok	InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID Mismatchinternlm · lmdeploy · CWE-772 Kimlik doğrulamasız	Yüksek8,7	—	%0,6	17 Eyl 2026
34İzleyin	CVE-2026-92984İstismar yok	HUBzero CMS through 2.2.32 Session Fixation via Query-String Session Identifierhubzero · hubzero-cms · CWE-384 Kimlik doğrulamasız	Yüksek8,5	—	%0,4	17 Eyl 2026

CVE-2026-25278
28İzleyin
Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive Software platform based on QNX
YüksekCVSS 7,0İstismar yokEPSS %0
- Yarış durumu
qualcomm · lemans au lgit firmware17 Eyl 2026
CVE-2026-25280
31İzleyin
Out-of-bounds Write in DSP Service
YüksekCVSS 7,8İstismar yokEPSS %0
- Bellek hatası
qualcomm · wsa8845h firmware17 Eyl 2026
CVE-2026-25281
29İzleyin
Allocation of Resources Without Limits or Throttling in OOBM
YüksekCVSS 7,4İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
qualcomm · cologne firmware17 Eyl 2026
CVE-2026-25282
31İzleyin
Out-of-bounds Read in OOBM
YüksekCVSS 7,9İstismar yokEPSS %0
- Bellek hatası
qualcomm · cologne firmware17 Eyl 2026
CVE-2026-25283
35İzleyin
Stack-based Buffer Overflow in OOBM
YüksekCVSS 8,8İstismar yokEPSS %0
- Bellek hatası
qualcomm · cologne firmware17 Eyl 2026
CVE-2026-25284
29İzleyin
Buffer Over-read in OOBM
YüksekCVSS 7,3İstismar yokEPSS %0
qualcomm · cologne firmware17 Eyl 2026
CVE-2026-25290
31İzleyin
Integer Overflow or Wraparound in OOBM
YüksekCVSS 7,8İstismar yokEPSS %0
- Bellek hatası
qualcomm · cologne firmware17 Eyl 2026
CVE-2026-25294
29İzleyin
Buffer Over-read in WLAN Firmware
YüksekCVSS 7,4İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
qualcomm · cologne firmware17 Eyl 2026
CVE-2026-87796
39İzleyin
Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload via Chunked File Upload
KritikCVSS 9,8Kavram kanıtıEPSS %1
- Girişsiz RCE
- Dosya yükleme
sh1zen · multi uploader for gravity forms17 Eyl 2026
CVE-2026-87935
32İzleyin
Paid Downloads <= 3.15 - Unauthenticated Arbitrary File Upload via 'paiddownloads_update_file' Action
YüksekCVSS 8,1İstismar yokEPSS %0
- Girişsiz RCE
- Dosya yükleme
ichurakov · paid downloads17 Eyl 2026
CVE-2026-85128
30İzleyin
Choose User Role at Registration for WooCommerce < 1.3.3 - Unauthenticated Privilege Escalation via Registration Role Request
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
unknown · choose user role at registration17 Eyl 2026
CVE-2026-85130
35İzleyin
WPLP Cookie Consent < 4.4.4 - Unauthenticated Stored XSS via Consent Logs
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
unknown · wplp cookie consent17 Eyl 2026
CVE-2026-86707
39İzleyin
Private Feed Key <= 0.1 - Unauthenticated Authentication Bypass via 'feedkey' Parameter
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
unknown · private feed key17 Eyl 2026
CVE-2026-86709
39İzleyin
The Pressengine <= 1.0 - Unauthenticated Authentication Bypass
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
unknown · the pressengine17 Eyl 2026
CVE-2026-86710
39İzleyin
Login with QR <= 1.0.0 - Unauthenticated Authentication Bypass via 'autologin_code' Parameter
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
unknown · login with qr17 Eyl 2026
CVE-2026-87786
35İzleyin
Dewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout Coordinates
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
unknown · dewa kirim17 Eyl 2026
CVE-2026-88792
35İzleyin
Dictionary <= 1.0 - Unauthenticated Stored XSS via Direct Dictionary Update
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
unknown · dictionary17 Eyl 2026
CVE-2026-88795
36İzleyin
wpShopGermany IT-RECHT KANZLEI < 2.4 - Unauthenticated RCE via Predictable API Token
KritikCVSS 9,0İstismar yokEPSS %0
- Girişsiz RCE
unknown · wpshopgermany it-recht kanzlei17 Eyl 2026
CVE-2026-88904
35İzleyin
PuppyFW <= 0.4.4 - Subscriber+ Arbitrary Blog Options Update and Deletion Leading to Privilege Escalation
YüksekCVSS 8,8İstismar yokEPSS %0
unknown · puppyfw17 Eyl 2026
CVE-2026-91014
28İzleyin
Realtyna Organic IDX plugin + WPL Real Estate < 5.4.2 - Reflected XSS via Location Selector Endpoint
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
unknown · realtyna organic idx plugin + wpl real estate17 Eyl 2026
CVE-2026-86801
35İzleyin
To Do List Member 1.4 - 1.6 - Unauthenticated Stored XSS, File Listing and Deletion via Unprotected Upload Handler
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
- XSS
unknown · to do list member17 Eyl 2026
CVE-2026-87963
34İzleyin
Yo 1.1 - 1.3.1 - Unauthenticated SQL Injection via username Parameter
YüksekCVSS 8,6İstismar yokEPSS %0
- Kimlik doğrulamasız
- SQL enjeksiyonu
unknown · yo17 Eyl 2026
CVE-2026-50605
29İzleyin
Privilege Escalation Vulnerability in NitroSense and PredatorSense Software
YüksekCVSS 7,4İstismar yokEPSS %0
- Yerel yetki yükseltme
- Erişim denetimi (IDOR)
acer · agent serivce17 Eyl 2026
CVE-2026-50609
29İzleyin
Unauthorized Registry Modification Vulnerability in NitroSense and PredatorSense Software
YüksekCVSS 7,4İstismar yokEPSS %0
- Yerel yetki yükseltme
- Erişim denetimi (IDOR)
acer · system monitoring17 Eyl 2026
CVE-2026-50610
29İzleyin
Improper Access control Vulnerability in NitroSense and PredatorSense Software
YüksekCVSS 7,4İstismar yokEPSS %0
- Yerel yetki yükseltme
- Erişim denetimi (IDOR)
acer · system monitoring17 Eyl 2026
CVE-2025-59607
31İzleyin
Untrusted Pointer Dereference in Windows Compute
YüksekCVSS 7,8İstismar yokEPSS %0
qualcomm · cologne firmware17 Eyl 2026
CVE-2025-15697
28İzleyin
Dictionary <= 1.0 - Reflected XSS via Multiple Parameters
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
unknown · dictionary17 Eyl 2026
CVE-2026-78425
30İzleyin
SAML Audience Confusion Allows Cross-SP Authentication
YüksekCVSS 7,6İstismar yokEPSS %0
- Kimlik doğrulama atlatma
suse · github.com/neuvector/neuvector17 Eyl 2026
CVE-2026-78428
35İzleyin
Flaw in Neuvector can result in one user receiving another user's authenticated session when multiple SSO login attempts occur concurrently
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
suse · neuvector17 Eyl 2026
CVE-2026-92903
32İzleyin
Improper Input Validation in Snowflake CLI Versions Allow Unsanitized User-Controlled Values to be Interpolated into SQL Strings
YüksekCVSS 8,2İstismar yokEPSS %0
- SQL enjeksiyonu
- Yerel yetki yükseltme
snowflake · snowflake cli17 Eyl 2026
CVE-2026-86320
31İzleyin
Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`)
YüksekCVSS 7,8İstismar yokEPSS %0
- RCE
- Yerel yetki yükseltme
red hat · red hat enterprise linux 1017 Eyl 2026
CVE-2026-90822
39İzleyin
FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain an OS command injection vulnerabili
KritikCVSS 9,8İstismar yokEPSS %1
- Girişsiz RCE
- Komut enjeksiyonu
fatpipe networks · mpvpn17 Eyl 2026
CVE-2026-90823
39İzleyin
FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /u
KritikCVSS 9,8İstismar yokEPSS %0
- Girişsiz RCE
- Bellek hatası
fatpipe networks · mpvpn17 Eyl 2026
CVE-2026-92860
37İzleyin
rcourtman Pulse Quick Security Setup quick-setup fmt.Sprintf input validation
KritikCVSS 9,4İstismar yokEPSS %0
rcourtman · pulse17 Eyl 2026
CVE-2026-92912
33İzleyin
AVideo Cryptographically Weak PRNG via uniqid Stream Key
YüksekCVSS 8,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Zayıf kripto
wwbn · avideo17 Eyl 2026
CVE-2026-92913
36İzleyin
AVideo Weak PRNG Activation Code Authentication Bypass
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
- Zayıf kripto
wwbn · avideo17 Eyl 2026
CVE-2026-92914
34İzleyin
AVideo LoginControl PGP Second Factor Authentication Bypass
YüksekCVSS 8,6İstismar yokEPSS %0
- Kimlik doğrulama atlatma
wwbn · avideo17 Eyl 2026
CVE-2026-92917
34İzleyin
Grav 2.0.0-rc.1 through 2.0.21 Configuration Disclosure via print_r
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bilgi sızıntısı
getgrav · grav17 Eyl 2026
CVE-2026-15688
36İzleyin
Password Authentication Bypass Vulnerability in GX Works3 and Motion Control Setting
KritikCVSS 9,2İstismar yokEPSS %0
- Kimlik doğrulama atlatma
mitsubishi electric corporation · gx works317 Eyl 2026
CVE-2026-92918
34İzleyin
admin3 through 3.0.0 Session Token Disclosure via Audit Log
YüksekCVSS 8,7İstismar yokEPSS %0
- Bilgi sızıntısı
cjbi · admin317 Eyl 2026
CVE-2026-92919
28İzleyin
admin3 through 3.0.0 Arbitrary File Write via Path Traversal in Storage Upload Filename
YüksekCVSS 7,2İstismar yokEPSS %0
- Yol geçişi
cjbi · admin317 Eyl 2026
CVE-2026-14850
35İzleyin
Weak password recovery mechanism for forgotten password in MobiAPParc
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
mobiapparc · mobiapparc17 Eyl 2026
CVE-2026-62101
39İzleyin
WordPress EduAdmin Booking plugin <= 5.4.2 - Broken Authentication vulnerability
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
chris åkerfeldt wendel · eduadmin booking17 Eyl 2026
CVE-2026-62104
40Planlayın
WordPress Migratico Lite plugin <= 2.6.8 - Remote Code Execution (RCE) vulnerability
KritikCVSS 10,0İstismar yokEPSS %0
- Girişsiz RCE
superweby · migratico lite17 Eyl 2026
CVE-2026-62108
39İzleyin
WordPress Headless Single Sign On plugin <= 1.7.0 - Broken Authentication vulnerability
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
miniorange · headless single sign on17 Eyl 2026
CVE-2026-66571
28İzleyin
WordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.5 - Cross Site Request Forgery (CSRF) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- CSRF
gabe livan · asset cleanup: page speed booster17 Eyl 2026
CVE-2026-66580
34İzleyin
WordPress Product Feed Manager plugin <= 7.12.0 - SQL Injection vulnerability
YüksekCVSS 8,5İstismar yokEPSS %0
- SQL enjeksiyonu
rextheme · product feed manager17 Eyl 2026
CVE-2026-66618
30İzleyin
WordPress WP Maps plugin <= 4.9.9 - SQL Injection vulnerability
YüksekCVSS 7,6İstismar yokEPSS %0
- SQL enjeksiyonu
flipper code · wp maps17 Eyl 2026
CVE-2026-66619
30İzleyin
WordPress Newsletters plugin <= 4.18 - SQL Injection vulnerability
YüksekCVSS 7,6İstismar yokEPSS %0
- SQL enjeksiyonu
tribulant software · newsletters17 Eyl 2026
CVE-2026-66624
30İzleyin
WordPress WPMasterToolKit plugin <= 2.22.0 - SQL Injection vulnerability
YüksekCVSS 7,6İstismar yokEPSS %0
- SQL enjeksiyonu
ludwig you · wpmastertoolkit17 Eyl 2026
CVE-2026-66625
30İzleyin
WordPress WC Vendors Marketplace plugin <= 2.7.2.1 - SQL Injection vulnerability
YüksekCVSS 7,6İstismar yokEPSS %0
- SQL enjeksiyonu
wcvendors · wc vendors marketplace17 Eyl 2026
CVE-2026-66626
30İzleyin
WordPress SKT Addons for Elementor plugin <= 4.0 - SQL Injection vulnerability
YüksekCVSS 7,6İstismar yokEPSS %0
- SQL enjeksiyonu
sonal s sinha · skt addons for elementor17 Eyl 2026
CVE-2026-66628
30İzleyin
WordPress WP-Lister Lite for eBay plugin <= 3.8.11 - SQL Injection vulnerability
YüksekCVSS 7,6İstismar yokEPSS %0
- SQL enjeksiyonu
wp lab · wp-lister lite for ebay17 Eyl 2026
CVE-2026-66630
30İzleyin
WordPress PublishPress Series plugin <= 3.1.3 - SQL Injection vulnerability
YüksekCVSS 7,6İstismar yokEPSS %0
- SQL enjeksiyonu
publishpress · publishpress series17 Eyl 2026
CVE-2026-66631
30İzleyin
WordPress MC Woocommerce Wishlist plugin <= 1.9.21 - SQL Injection vulnerability
YüksekCVSS 7,6İstismar yokEPSS %0
- SQL enjeksiyonu
moreconvert team · mc woocommerce wishlist17 Eyl 2026
CVE-2026-78295
35İzleyin
WordPress Xagio SEO plugin <= 7.1.0.43 - Cross Site Request Forgery (CSRF) vulnerability
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- CSRF
xagio seo · xagio seo17 Eyl 2026
CVE-2026-80218
30İzleyin
Sign-in token minted for one resource accepted by another in AshAuthentication
YüksekCVSS 7,6İstismar yokEPSS %0
- Kimlik doğrulama atlatma
team-alembic · ash_authentication17 Eyl 2026
CVE-2026-81632
28İzleyin
Single-use sign-in token placed in a redirect query string in AshAuthenticationPhoenix
YüksekCVSS 7,2İstismar yokEPSS %0
team-alembic · ash_authentication_phoenix17 Eyl 2026
CVE-2026-82685
30İzleyin
Confirmation token accepted on any record in AshAuthentication
YüksekCVSS 7,6İstismar yokEPSS %0
- Erişim denetimi (IDOR)
team-alembic · ash_authentication17 Eyl 2026
CVE-2026-82760
32İzleyin
Superlinear base62 decoding exhausts CPU and memory in AshAuthentication API key sign-in
YüksekCVSS 8,2İstismar yokEPSS %0
- Kimlik doğrulamasız
team-alembic · ash_authentication17 Eyl 2026
CVE-2026-82761
36İzleyin
Magic link single-use tokens replayable via TOCTOU race in AshAuthentication
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- Yarış durumu
team-alembic · ash_authentication17 Eyl 2026
CVE-2026-85500
36İzleyin
`require_confirmed_with` is not enforced on the action and fails open on an unreadable attribute in AshAuthentication
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
team-alembic · ash_authentication17 Eyl 2026
CVE-2026-86533
36İzleyin
Revoked session accepted because the session jti is never checked in AshAuthentication and AshAuthentication Phoenix
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
team-alembic · ash_authentication17 Eyl 2026
CVE-2026-89418
34İzleyin
Uncontrolled Recursion leading to Denial of Service in protobuf-javascript (google-protobuf)
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Deserializasyon
- Hizmet dışı bırakma
google · protobuf-javascript (aka google-protobuf npm package)17 Eyl 2026
CVE-2026-90887
28İzleyin
WordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
wp inventory · wp inventory manager17 Eyl 2026
CVE-2026-90986
28İzleyin
WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.21 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
codepress it solutions llc · visitor traffic real time statistics pro17 Eyl 2026
CVE-2026-92934
38İzleyin
vm2 before 3.11.8 Sandbox Escape RCE via AggregateError
KritikCVSS 9,5İstismar yokEPSS %0
- Girişsiz RCE
patriksimek · vm217 Eyl 2026
CVE-2026-92935
38İzleyin
vm2 NodeVM Remote Code Execution via Array-Shaped Require
KritikCVSS 9,5Kavram kanıtıEPSS %0
- Girişsiz RCE
patriksimek · vm217 Eyl 2026
CVE-2026-92937
40Planlayın
vm2 3.11.6 Remote Code Execution via Promise call/apply
KritikCVSS 10,0İstismar yokEPSS %1
- Girişsiz RCE
patriksimek · vm217 Eyl 2026
CVE-2026-92938
37İzleyin
vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite
KritikCVSS 9,4İstismar yokEPSS %0
- RCE
patriksimek · vm217 Eyl 2026
CVE-2026-92939
37İzleyin
vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine
KritikCVSS 9,4İstismar yokEPSS %0
patriksimek · vm217 Eyl 2026
CVE-2026-92940
40Planlayın
vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent
KritikCVSS 10,0İstismar yokEPSS %0
- Kimlik doğrulamasız
patriksimek · vm217 Eyl 2026
CVE-2026-92941
40Planlayın
vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation
KritikCVSS 10,0İstismar yokEPSS %0
- Kimlik doğrulamasız
patriksimek · vm217 Eyl 2026
CVE-2026-92942
34İzleyin
vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
patriksimek · vm217 Eyl 2026
CVE-2026-92944
37İzleyin
vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector
KritikCVSS 9,3İstismar yokEPSS %0
- Girişsiz RCE
patriksimek · vm217 Eyl 2026
CVE-2026-92946
40Planlayın
vm2 before 3.11.7 Remote Code Execution via require.external
KritikCVSS 10,0İstismar yokEPSS %0
- Girişsiz RCE
patriksimek · vm217 Eyl 2026
CVE-2026-92947
40Planlayın
vm2 before 3.11.7 Memory Disclosure via Buffer Pool
KritikCVSS 10,0İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bilgi sızıntısı
patriksimek · vm217 Eyl 2026
CVE-2026-92948
37İzleyin
vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test
KritikCVSS 9,4İstismar yokEPSS %0
patriksimek · vm217 Eyl 2026
CVE-2026-92950
37İzleyin
vm2 before 3.11.7 Sandbox Escape via CLI require
KritikCVSS 9,3İstismar yokEPSS %0
- RCE
patriksimek · vm217 Eyl 2026
CVE-2026-92951
37İzleyin
vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver
KritikCVSS 9,4İstismar yokEPSS %0
patriksimek · vm217 Eyl 2026
CVE-2026-92952
35İzleyin
vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass
YüksekCVSS 8,9İstismar yokEPSS %0
- Kimlik doğrulamasız
patriksimek · vm217 Eyl 2026
CVE-2026-92953
37İzleyin
vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Prototype pollution
patriksimek · vm217 Eyl 2026
CVE-2026-92954
36İzleyin
vm2 3.10.0 through 3.11.7 Denial of Service via Host Promise
KritikCVSS 9,2İstismar yokEPSS %0
- Kimlik doğrulamasız
patriksimek · vm217 Eyl 2026
CVE-2026-92955
40Planlayın
vm2 before 3.11.8 Sandbox Escape via NodeVM
KritikCVSS 10,0İstismar yokEPSS %0
- Kimlik doğrulamasız
patriksimek · vm217 Eyl 2026
CVE-2026-92956
40Planlayın
vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming
KritikCVSS 10,0Kavram kanıtıEPSS %0
- Kimlik doğrulamasız
patriksimek · vm217 Eyl 2026
CVE-2026-92957
37İzleyin
vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix
KritikCVSS 9,4İstismar yokEPSS %0
patriksimek · vm217 Eyl 2026
CVE-2026-92958
33İzleyin
vm2 before 3.11.7 Denylist Bypass via fs/promises
YüksekCVSS 8,4İstismar yokEPSS %0
patriksimek · vm217 Eyl 2026
CVE-2026-92959
28İzleyin
vm2 before 3.11.8 allowAsync Bypass via Promise Thenable
YüksekCVSS 7,1İstismar yokEPSS %0
patriksimek · vm217 Eyl 2026
CVE-2026-92960
40Planlayın
vm2 before 3.11.6 Process-wide State Exposure via os and dns
KritikCVSS 10,0İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bilgi sızıntısı
patriksimek · vm217 Eyl 2026
CVE-2026-92961
34İzleyin
vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
patriksimek · vm217 Eyl 2026
CVE-2026-92970
34İzleyin
HUBzero CMS through 2.2.32 Path Traversal via File Upload
YüksekCVSS 8,7İstismar yokEPSS %0
- Yol geçişi
hubzero · hubzero-cms17 Eyl 2026
CVE-2026-92971
34İzleyin
InternLM LMDeploy through 0.17.0 Assertion Denial of Service
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
internlm · lmdeploy17 Eyl 2026
CVE-2026-92972
35İzleyin
SGLang through 0.5.19 Unauthenticated Route Poisoning via PUT endpoint
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
sgl-project · sglang17 Eyl 2026
CVE-2026-63459
34İzleyin
Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions
YüksekCVSS 8,7İstismar yokEPSS %0
- XSS
vendurehq · vendure17 Eyl 2026
CVE-2026-63460
30İzleyin
Vendure: Unauthenticated ReDoS via `regex` filter on SQLite backends
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
vendurehq · vendure17 Eyl 2026
CVE-2026-63472
36İzleyin
Vendure: External-authentication account takeover: external login linked to a pre-existing account by email without verification
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
vendurehq · vendure17 Eyl 2026
CVE-2026-85077
32İzleyin
Sanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responses
YüksekCVSS 8,2İstismar yokEPSS %0
- Kimlik doğrulamasız
sanic-org · sanic17 Eyl 2026
CVE-2026-88952
36İzleyin
OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
team-alembic · ash_authentication17 Eyl 2026
CVE-2026-92983
34İzleyin
InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID Mismatch
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
internlm · lmdeploy17 Eyl 2026
CVE-2026-92984
34İzleyin
HUBzero CMS through 2.2.32 Session Fixation via Query-String Session Identifier
YüksekCVSS 8,5İstismar yokEPSS %0
- Kimlik doğrulamasız
hubzero · hubzero-cms17 Eyl 2026