Yayın tarihine göre
Eylül 2026: sömürülen ve yeni ciddi CVE kayıtları
7.959 kayıt · 32 KEV. Yayın sırasıyla.
Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.
Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.
Sayfa 56 / 80
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
34İzleyin | CVE-2026-93657İstismar yok | hickory-resolver before 0.26.2 DNSSEC Validation Bypasshickory-dns · hickory-resolver · CWE-347 | Yüksek8,7 | — | %0,2 | 18 Eyl 2026 |
29İzleyin | CVE-2026-93658İstismar yok | uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuiduutils · coreutils · CWE-281 | Yüksek7,3 | — | %0,1 | 18 Eyl 2026 |
28İzleyin | CVE-2026-93660İstismar yok | SQLBot through 1.10.1 Improper Access Control via Dashboard Updatedataease · sqlbot · CWE-639 | Yüksek7,1 | — | %0,4 | 18 Eyl 2026 |
39İzleyin | CVE-2026-10027İstismar yok | IBM MQ queue manager is vulnerable to unauthenticated remote code executionibm · mq · CWE-787 | Kritik9,8 | — | %0,7 | 18 Eyl 2026 |
28İzleyin | CVE-2026-10030İstismar yok | IBM MQ Console is vulnerable to privilege escalationibm · mq · CWE-285 | Yüksek7,1 | — | %0,3 | 18 Eyl 2026 |
35İzleyin | CVE-2026-10575İstismar yok | IBM MQ queue manager is vulnerable to remote code executionibm · mq · CWE-122 | Yüksek8,8 | — | %0,4 | 18 Eyl 2026 |
30İzleyin | CVE-2026-10744İstismar yok | IBM MQ for HPE NonStop is vulnerable to a issue in MQINQ request validationibm · mq for hpe nonstop · CWE-122 | Yüksek7,5 | — | %0,3 | 18 Eyl 2026 |
40Planlayın | CVE-2026-10747İstismar yok | IBM MQ Appliance is affected by a heap buffer overflow vulnerability in protocol message processingibm · mq appliance · CWE-122 | Kritik10,0 | — | %0,9 | 18 Eyl 2026 |
30İzleyin | CVE-2026-10751İstismar yok | IBM MQ Java messaging is vulnerable to remote code executionibm · mq · CWE-502 | Yüksek7,5 | — | %0,5 | 18 Eyl 2026 |
35İzleyin | CVE-2026-10853İstismar yok | IBM MQ queue manager is vulnerable to remote code executionibm · mq · CWE-470 | Yüksek8,8 | — | %0,5 | 18 Eyl 2026 |
39İzleyin | CVE-2026-10858İstismar yok | IBM MQ for HPE NonStop is vulnerable to a denial of service attackibm · mq for hpe nonstop · CWE-122 | Kritik9,9 | — | %0,5 | 18 Eyl 2026 |
35İzleyin | CVE-2026-11375İstismar yok | IBM MQ queue manager is vulnerable to remote code executionibm · mq · CWE-122 | Yüksek8,8 | — | %0,6 | 18 Eyl 2026 |
35İzleyin | CVE-2026-11378İstismar yok | IBM MQ queue manager is vulnerable to remote code executionibm · mq · CWE-190 | Yüksek8,8 | — | %0,6 | 18 Eyl 2026 |
35İzleyin | CVE-2026-11381İstismar yok | IBM MQ for HPE NonStop is vulnerable to a denial of service issueibm · mq for hpe nonstop · CWE-122 | Yüksek8,8 | — | %0,5 | 18 Eyl 2026 |
32İzleyin | CVE-2026-54148İstismar yok | http4k: `DigestAuthProvider.verify` did not bind to request URIhttp4k · http4k · CWE-294 | Yüksek8,1 | — | %0,5 | 18 Eyl 2026 |
39İzleyin | CVE-2026-61682İstismar yok | kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters ikcp-dev · kcp · CWE-290 | Kritik9,9 | — | %0,3 | 18 Eyl 2026 |
39İzleyin | CVE-2026-75031İstismar yok | In the interchange/interchange project, a critical remote code execution (RCE) vulnerability was found in the “quick question” admin featurinterchange · interchange · CWE-94 | Kritik9,8 | — | %0,7 | 18 Eyl 2026 |
28İzleyin | CVE-2026-7006İstismar yok | Sublime Text 4192/3207 Local Privilege Escalation via Update Staging Mechanismsublime hq pty ltd · sublime text 4 · CWE-494 | Yüksek7,0 | — | %0,1 | 18 Eyl 2026 |
28İzleyin | CVE-2026-81305İstismar yok | CareCam CM2507 Inclusion of Functionality from Untrusted Control Spherecarecam · hmt.cm2507 firmware · CWE-829 | Yüksek7,0 | — | %0,2 | 18 Eyl 2026 |
35İzleyin | CVE-2026-81942İstismar yok | PLANET IGS-5225-8P2T4S V1/V2 OS Command Injection via Web Serverplanet technology corp. · planet igs-5225-8p2t4s v1 · CWE-78 | Yüksek8,7 | — | %1,8 | 18 Eyl 2026 |
33İzleyin | CVE-2026-81943İstismar yok | PLANET IGS-5225-8P2T4S V1/V2 Debug Mode RCEplanet technology corp. · planet igs-5225-8p2t4s v1 · CWE-489 | Yüksek8,4 | — | %0,1 | 18 Eyl 2026 |
30İzleyin | CVE-2026-81944İstismar yok | PLANET IGS-5225-8P2T4S V1/V2 Stack-Based Buffer Overflow via Web Serverplanet technology corp. · planet igs-5225-8p2t4s v1 · CWE-121 | Yüksek7,7 | — | %0,7 | 18 Eyl 2026 |
30İzleyin | CVE-2026-81945İstismar yok | PLANET IGS-5225-8P2T4S V1/V2 Admin Stack-Based Buffer Overflow via Web Serverplanet technology corp. · planet igs-5225-8p2t4s v1 · CWE-121 | Yüksek7,5 | — | %0,5 | 18 Eyl 2026 |
39İzleyin | CVE-2026-84383Kavram kanıtı | libheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` itemsstrukturag · libheif · CWE-787 | Kritik9,8 | — | %0,7 | 18 Eyl 2026 |
30İzleyin | CVE-2026-84384İstismar yok | libheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoSstrukturag · libheif · CWE-409 | Yüksek7,5 | — | %0,5 | 18 Eyl 2026 |
34İzleyin | CVE-2026-84398İstismar yok | CareCam CM2507 Empty Password in Configuration Filecarecam · hmt.cm2507 firmware · CWE-258 | Yüksek8,7 | — | %0,4 | 18 Eyl 2026 |
29İzleyin | CVE-2026-84444İstismar yok | libheif uncompressed tiled image encoding allows out-of-bounds writestrukturag · libheif · CWE-787 | Yüksek7,4 | — | %0,4 | 18 Eyl 2026 |
30İzleyin | CVE-2026-84446İstismar yok | libheif: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory, bypassing max_sequence_framesstrukturag · libheif · CWE-835 | Yüksek7,5 | — | %0,4 | 18 Eyl 2026 |
30İzleyin | CVE-2026-84447İstismar yok | libheif: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle limits, causing CPU/memory amplification DoSstrukturag · libheif · CWE-770 | Yüksek7,5 | — | %0,5 | 18 Eyl 2026 |
34İzleyin | CVE-2026-86520İstismar yok | Use of Hard-coded Credentials in Bransys ELDbransys · eld · CWE-798 | Yüksek8,7 | — | %0,4 | 18 Eyl 2026 |
32İzleyin | CVE-2026-86689İstismar yok | Cleartext Transmission of Sensitive Information in Bransys ELDbransys · eld · CWE-319 | Yüksek8,2 | — | %0,2 | 18 Eyl 2026 |
34İzleyin | CVE-2026-88259İstismar yok | CareCam CM2507 Missing Authentication for Critical Functioncarecam · hmt.cm2507 firmware · CWE-306 | Yüksek8,7 | — | %0,5 | 18 Eyl 2026 |
34İzleyin | CVE-2026-93688İstismar yok | SGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_roomsgl-project · sglang · CWE-770 | Yüksek8,7 | — | %0,7 | 18 Eyl 2026 |
34İzleyin | CVE-2026-93690İstismar yok | uri-js through 4.4.1 Denial of Service via removeDotSegmentsgarycourt · uri-js · CWE-835 | Yüksek8,7 | — | %0,4 | 18 Eyl 2026 |
28İzleyin | CVE-2026-93737İstismar yok | Azkaban through 4.0.0 Authorization Bypass via ScheduleServletazkaban · azkaban · CWE-862 | Yüksek7,1 | — | %0,5 | 18 Eyl 2026 |
39İzleyin | CVE-2026-21806İstismar yok | HCL BigFix Service Management was affected with Admin Session Concurrency vulnerability (CVE-2026-21806)hcltech · bigfix service management · CWE-557 | Kritik9,8 | — | %0,1 | 18 Eyl 2026 |
30İzleyin | CVE-2026-93488İstismar yok | Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streamsred hat · red hat amq broker 7 · CWE-770 | Yüksek7,5 | — | %0,8 | 18 Eyl 2026 |
32İzleyin | CVE-2026-55556İstismar yok | Rsyslog: Heap buffer overflow in imhttp plugin Basic Authentication handlingrsyslog · rsyslog · CWE-122 | Yüksek8,2 | — | %0,8 | 18 Eyl 2026 |
35İzleyin | CVE-2026-58197İstismar yok | ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movementstacklok · toolhive · CWE-284 | Yüksek8,8 | — | %0,3 | 18 Eyl 2026 |
32İzleyin | CVE-2026-61548İstismar yok | Rsyslog: mmpstrucdata stack buffer overflow with oversized RFC5424 structured datarsyslog · rsyslog · CWE-121 | Yüksek8,1 | — | %0,9 | 18 Eyl 2026 |
28İzleyin | CVE-2026-61672İstismar yok | Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcementprojectcapsule · capsule · CWE-697 | Yüksek7,1 | — | %0,3 | 18 Eyl 2026 |
34İzleyin | CVE-2026-62943İstismar yok | btrbk: SSH Command Filter Bypass in ssh_filter_btrbk.shdigint · btrbk · CWE-78 | Yüksek8,7 | — | %0,4 | 18 Eyl 2026 |
28İzleyin | CVE-2026-63349İstismar yok | AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groupsagronholm · anyio · CWE-266 | Yüksek7,0 | — | %0,1 | 18 Eyl 2026 |
28İzleyin | CVE-2026-73863İstismar yok | NanoMQ: Heap-Buffer-Overflow in `nmq_subinfo_decode()` During MQTT v5 SUBSCRIBE Parsingnanomq · nanomq · CWE-125 | Yüksek7,0 | — | %0,3 | 18 Eyl 2026 |
32İzleyin | CVE-2026-77239İstismar yok | WACRM: Service-role routes missing a role checkarnasdon · wacrm · CWE-285 | Yüksek8,1 | — | %0,5 | 18 Eyl 2026 |
30İzleyin | CVE-2026-77301İstismar yok | adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)cthackers · adm-zip · CWE-789 | Yüksek7,5 | — | %0,6 | 18 Eyl 2026 |
37İzleyin | CVE-2026-81321İstismar yok | CareCam CM2507 Cleartext Storage of Sensitive Informationcarecam · hmt.cm2507 firmware · CWE-312 | Kritik9,3 | — | %0,3 | 18 Eyl 2026 |
28İzleyin | CVE-2026-81505İstismar yok | Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentialsfrain-dev · convoy · CWE-639 | Yüksek7,1 | — | %0,4 | 18 Eyl 2026 |
37İzleyin | CVE-2026-85497İstismar yok | CareCam CM2507 Use of Password Hash With Insufficient Computational Effortcarecam · hmt.cm2507 firmware · CWE-916 | Kritik9,3 | — | %0,3 | 18 Eyl 2026 |
34İzleyin | CVE-2026-93758İstismar yok | Cross-principal document update, theft, and deletion via unvalidated id in nested attributesmongodb · mongoid · CWE-639 | Yüksek8,6 | — | %0,3 | 18 Eyl 2026 |
33İzleyin | CVE-2026-93765İstismar yok | Document deletion and process crash via unvalidated method-name dispatch in atomic pop operationmongodb · mongoid · CWE-470 | Yüksek8,3 | — | %0,5 | 18 Eyl 2026 |
30İzleyin | CVE-2026-93491İstismar yok | Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queuered hat · red hat amq broker 7 · CWE-770 | Yüksek7,5 | — | %0,7 | 18 Eyl 2026 |
30İzleyin | CVE-2026-32641İstismar yok | Parseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middlewareparseablehq · parseable · CWE-248 | Yüksek7,5 | — | %0,9 | 18 Eyl 2026 |
35İzleyin | CVE-2026-33625İstismar yok | LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loadinginternlm · lmdeploy · CWE-400 | Yüksek8,8 | — | %0,4 | 18 Eyl 2026 |
36İzleyin | CVE-2026-59163İstismar yok | Mnemosyne has JWT signature verification bypass sync server that allows authentication bypassaxdsan · mnemosyne · CWE-347 | Kritik9,1 | — | %0,3 | 18 Eyl 2026 |
39İzleyin | CVE-2026-61550İstismar yok | Icinga 2: Improper access control for JSON-RPC update certificate messagesicinga · icinga2 · CWE-862 | Kritik9,8 | — | %0,6 | 18 Eyl 2026 |
34İzleyin | CVE-2026-61551İstismar yok | Icinga 2: Stack overflow via deeply nested JSON objectsicinga · icinga2 · CWE-674 | Yüksek8,6 | — | %0,9 | 18 Eyl 2026 |
28İzleyin | CVE-2026-61552İstismar yok | Icinga 2 DSL Injection via Unescaped Import Template Nameicinga · icinga2 · CWE-94 | Yüksek7,2 | — | %0,9 | 18 Eyl 2026 |
32İzleyin | CVE-2026-62278İstismar yok | LubeLogger: Path Traversal in HandleTranslationFileUpload Allows Authenticated Users to Write Files Outside Data Directoryhargata · lubelog · CWE-22 | Yüksek8,1 | — | %0,5 | 18 Eyl 2026 |
28İzleyin | CVE-2026-63445İstismar yok | Perses: Unvalidated project parameter enables filesystem path traversalperses · perses · CWE-22 | Yüksek7,1 | — | %0,5 | 18 Eyl 2026 |
28İzleyin | CVE-2026-63458İstismar yok | Perses project query parameter authorization bypass exposes cross-project resourcesperses · perses · CWE-639 | Yüksek7,1 | — | %0,4 | 18 Eyl 2026 |
30İzleyin | CVE-2026-69184İstismar yok | c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chainsc-ares · c-ares · CWE-407 | Yüksek7,5 | — | %0,4 | 18 Eyl 2026 |
32İzleyin | CVE-2026-81179İstismar yok | SysReptor: Host header injection might allow account takeoversyslifters · sysreptor · CWE-807 | Yüksek8,1 | — | %0,4 | 18 Eyl 2026 |
35İzleyin | CVE-2026-81180İstismar yok | SysReptor: Authenticated RCE by insecure image processingsyslifters · sysreptor · CWE-20 | Yüksek8,8 | — | %0,6 | 18 Eyl 2026 |
30İzleyin | CVE-2026-85058İstismar yok | Moquette: Missing Authorization in io.moquette:moquette-brokermoquette-io · moquette · CWE-862 | Yüksek7,5 | — | %0,4 | 18 Eyl 2026 |
32İzleyin | CVE-2026-91127İstismar yok | File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC rendererflyfish-dev · file-viewer · CWE-79 | Yüksek8,2 | — | %0,3 | 18 Eyl 2026 |
34İzleyin | CVE-2026-93749İstismar yok | source-map-js through 1.2.1 Event Loop Denial of Service7rulnik · source-map-js · CWE-1284 | Yüksek8,7 | — | %0,4 | 18 Eyl 2026 |
32İzleyin | CVE-2026-93750İstismar yok | http-cache-semantics through 4.2.0 Cross-Client Cache Disclosure via Vary Wildcardkornelski · http-cache-semantics · CWE-436 | Yüksek8,2 | — | %0,4 | 18 Eyl 2026 |
34İzleyin | CVE-2026-93752İstismar yok | CSSOM through 0.5.0 Denial of Service via length Propertynv · cssom · CWE-915 | Yüksek8,7 | — | %0,6 | 18 Eyl 2026 |
34İzleyin | CVE-2026-93753İstismar yok | deepmerge through 4.3.1 Prototype Poisoning via mergeObjecttehshrike · deepmerge · CWE-1321 | Yüksek8,7 | — | %0,5 | 18 Eyl 2026 |
35İzleyin | CVE-2026-93759İstismar yok | Server-side JavaScript injection via string query criteria bypassing the strict operator allowlistmongodb · mongoid · CWE-94 | Yüksek8,8 | — | %0,4 | 18 Eyl 2026 |
33İzleyin | CVE-2026-93760İstismar yok | NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guardmongodb · mongoid · CWE-943 | Yüksek8,3 | — | %0,5 | 18 Eyl 2026 |
34İzleyin | CVE-2026-93761İstismar yok | Denial of service via unbounded regex matching in Mongoid's in-memory query matchermongodb · mongoid · CWE-1333 | Yüksek8,7 | — | %0,4 | 18 Eyl 2026 |
36İzleyin | CVE-2026-93762İstismar yok | Data deletion and attribute disclosure via field-name method injection in in-memory queriesmongodb · mongoid · CWE-470 | Kritik9,2 | — | %0,5 | 18 Eyl 2026 |
28İzleyin | CVE-2026-93763İstismar yok | Silent plaintext persistence via unresolved callable database name in encryption schema mapmongodb · mongoid · CWE-312 | Yüksek7,1 | — | %0,1 | 18 Eyl 2026 |
28İzleyin | CVE-2026-93764İstismar yok | Plaintext storage of encrypted fields via skipped embedded models in encryption schema generationmongodb · mongoid · CWE-312 | Yüksek7,1 | — | %0,1 | 18 Eyl 2026 |
34İzleyin | CVE-2026-93592İstismar yok | vLLM before 0.28.0 Denial of Service via negative token IDvllm · vllm · CWE-129 | Yüksek8,7 | — | %0,5 | 18 Eyl 2026 |
34İzleyin | CVE-2019-25776İstismar yok | Weaver E-cology SQL Injection via SyncUserInfo.jspweaver network co., ltd. · e-cology · CWE-89 | Yüksek8,7 | — | %0,5 | 18 Eyl 2026 |
34İzleyin | CVE-2021-48008İstismar yok | Chanjet CRM SQL Injection via get_usedspace.phpchanjet information technology co., ltd. · crm · CWE-89 | Yüksek8,7 | — | %0,5 | 18 Eyl 2026 |
37İzleyin | CVE-2023-54399İstismar yok | Hongjing e-HR < 8.2 SQL Injection via /servlet/codesettreehongjing · e-hr · CWE-89 | Kritik9,3 | — | %0,7 | 18 Eyl 2026 |
30İzleyin | CVE-2026-75893İstismar yok | Heap based buffer overflow at ipaccess_proxy_read_msg()osmocom · osmo-bsc · CWE-122 | Yüksek7,5 | — | %0,4 | 18 Eyl 2026 |
30İzleyin | CVE-2026-75894İstismar yok | Reachable assertion at ranap_handle_co_dt()osmocom · osmo-iuh · CWE-617 | Yüksek7,5 | — | %0,3 | 18 Eyl 2026 |
30İzleyin | CVE-2026-93558İstismar yok | Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of servicered hat · red hat amq broker 7 · CWE-1035 | Yüksek7,5 | — | %1,0 | 18 Eyl 2026 |
30İzleyin | CVE-2026-93564İstismar yok | Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881)red hat · red hat amq broker 7 · CWE-1035 | Yüksek7,5 | — | %0,9 | 18 Eyl 2026 |
30İzleyin | CVE-2026-93565İstismar yok | Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control bytered hat · red hat amq broker 7 · CWE-1035 | Yüksek7,5 | — | %0,7 | 18 Eyl 2026 |
31İzleyin | CVE-2026-93567İstismar yok | Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authorityred hat · red hat amq broker 7 · CWE-20 | Yüksek7,5 | — | %2,5 | 18 Eyl 2026 |
30İzleyin | CVE-2026-93568İstismar yok | Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requestsred hat · red hat amq broker 7 · CWE-20 | Yüksek7,5 | — | %0,9 | 18 Eyl 2026 |
33İzleyin | CVE-2026-93569İstismar yok | Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authorityred hat · red hat amq broker 7 · CWE-444 | Yüksek8,2 | — | %2,1 | 18 Eyl 2026 |
34İzleyin | CVE-2026-93659Kavram kanıtı | Concrete CMS Community Store before 2.7.8 Stored XSSconcretecms-community-store · community_store · CWE-79 | Yüksek8,6 | — | %0,3 | 18 Eyl 2026 |
28İzleyin | CVE-2026-93852İstismar yok | In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases for every project without enforcing projecopenstack · blazar · CWE-862 | Yüksek7,1 | — | %0,3 | 18 Eyl 2026 |
28İzleyin | CVE-2026-93854İstismar yok | In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2openstack · blazar · CWE-1025 | Yüksek7,2 | — | %0,4 | 18 Eyl 2026 |
34İzleyin | CVE-2017-20284İstismar yok | Caucho Resin resin-doc Unauthenticated Path Traversal via jndi-appconfig Servletcaucho technology, inc. · resin · CWE-22 | Yüksek8,7 | — | %1,1 | 18 Eyl 2026 |
30İzleyin | CVE-2025-14753İstismar yok | IBM Cloud Pak for Data is vulnerable to path traversalibm · cloud pak for data · CWE-22 | Yüksek7,5 | — | %0,6 | 18 Eyl 2026 |
35İzleyin | CVE-2025-14754İstismar yok | IBM Cloud Pak for Data is vulnerable to OS command injectionibm · cloud pak for data · CWE-78 | Yüksek8,8 | — | %0,6 | 18 Eyl 2026 |
40Planlayın | CVE-2025-15399İstismar yok | Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agentibm · common licensing · CWE-352 | Kritik10,0 | — | %0,2 | 18 Eyl 2026 |
30İzleyin | CVE-2026-11716İstismar yok | IBM MQ for HPE NonStop is vulnerable to a denial of service attackibm · mq for hpe nonstop · CWE-122 | Yüksek7,5 | — | %0,4 | 18 Eyl 2026 |
35İzleyin | CVE-2026-11725İstismar yok | IBM MQ queue manager is vulnerable to privilege escalationibm · mq · CWE-190 | Yüksek8,8 | — | %0,5 | 18 Eyl 2026 |
39İzleyin | CVE-2025-53837İstismar yok | org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issuexwiki · xwiki-rendering · CWE-95 | Kritik9,9 | — | %1,5 | 18 Eyl 2026 |
34İzleyin | CVE-2025-61682İstismar yok | Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributessemanticmediawiki · semanticmediawiki · CWE-79 | Yüksek8,6 | — | %0,4 | 18 Eyl 2026 |
32İzleyin | CVE-2026-11726İstismar yok | IBM MQ for HPE NonStop is vulnerable to a denial of service issueibm · mq for hpe nonstop · CWE-125 | Yüksek8,1 | — | %0,4 | 18 Eyl 2026 |
- CVE-2026-9365734İzleyin
hickory-resolver before 0.26.2 DNSSEC Validation Bypass
YüksekCVSS 8,7İstismar yokEPSS %0hickory-dns · hickory-resolver18 Eyl 2026
- CVE-2026-9365829İzleyin
uutils coreutils 0.0.18 before 0.10.0 Privilege Escalation via setuid
YüksekCVSS 7,3İstismar yokEPSS %0uutils · coreutils18 Eyl 2026
- CVE-2026-9366028İzleyin
SQLBot through 1.10.1 Improper Access Control via Dashboard Update
YüksekCVSS 7,1İstismar yokEPSS %0dataease · sqlbot18 Eyl 2026
- CVE-2026-1002739İzleyin
IBM MQ queue manager is vulnerable to unauthenticated remote code execution
KritikCVSS 9,8İstismar yokEPSS %0ibm · mq18 Eyl 2026
- CVE-2026-1003028İzleyin
IBM MQ Console is vulnerable to privilege escalation
YüksekCVSS 7,1İstismar yokEPSS %0ibm · mq18 Eyl 2026
- CVE-2026-1057535İzleyin
IBM MQ queue manager is vulnerable to remote code execution
YüksekCVSS 8,8İstismar yokEPSS %0ibm · mq18 Eyl 2026
- CVE-2026-1074430İzleyin
IBM MQ for HPE NonStop is vulnerable to a issue in MQINQ request validation
YüksekCVSS 7,5İstismar yokEPSS %0ibm · mq for hpe nonstop18 Eyl 2026
- CVE-2026-1074740Planlayın
IBM MQ Appliance is affected by a heap buffer overflow vulnerability in protocol message processing
KritikCVSS 10,0İstismar yokEPSS %0ibm · mq appliance18 Eyl 2026
- CVE-2026-1075130İzleyin
IBM MQ Java messaging is vulnerable to remote code execution
YüksekCVSS 7,5İstismar yokEPSS %0ibm · mq18 Eyl 2026
- CVE-2026-1085335İzleyin
IBM MQ queue manager is vulnerable to remote code execution
YüksekCVSS 8,8İstismar yokEPSS %0ibm · mq18 Eyl 2026
- CVE-2026-1085839İzleyin
IBM MQ for HPE NonStop is vulnerable to a denial of service attack
KritikCVSS 9,9İstismar yokEPSS %0ibm · mq for hpe nonstop18 Eyl 2026
- CVE-2026-1137535İzleyin
IBM MQ queue manager is vulnerable to remote code execution
YüksekCVSS 8,8İstismar yokEPSS %0ibm · mq18 Eyl 2026
- CVE-2026-1137835İzleyin
IBM MQ queue manager is vulnerable to remote code execution
YüksekCVSS 8,8İstismar yokEPSS %0ibm · mq18 Eyl 2026
- CVE-2026-1138135İzleyin
IBM MQ for HPE NonStop is vulnerable to a denial of service issue
YüksekCVSS 8,8İstismar yokEPSS %0ibm · mq for hpe nonstop18 Eyl 2026
- CVE-2026-5414832İzleyin
http4k: `DigestAuthProvider.verify` did not bind to request URI
YüksekCVSS 8,1İstismar yokEPSS %0http4k · http4k18 Eyl 2026
- CVE-2026-6168239İzleyin
kcp front-proxy does not strip inbound X-Remote-* identity headers, allowing any authenticated client to inject groups/warrants and impersonate system:masters i
KritikCVSS 9,9İstismar yokEPSS %0kcp-dev · kcp18 Eyl 2026
- CVE-2026-7503139İzleyin
In the interchange/interchange project, a critical remote code execution (RCE) vulnerability was found in the “quick question” admin featur
KritikCVSS 9,8İstismar yokEPSS %0interchange · interchange18 Eyl 2026
- CVE-2026-700628İzleyin
Sublime Text 4192/3207 Local Privilege Escalation via Update Staging Mechanism
YüksekCVSS 7,0İstismar yokEPSS %0sublime hq pty ltd · sublime text 418 Eyl 2026
- CVE-2026-8130528İzleyin
CareCam CM2507 Inclusion of Functionality from Untrusted Control Sphere
YüksekCVSS 7,0İstismar yokEPSS %0carecam · hmt.cm2507 firmware18 Eyl 2026
- CVE-2026-8194235İzleyin
PLANET IGS-5225-8P2T4S V1/V2 OS Command Injection via Web Server
YüksekCVSS 8,7İstismar yokEPSS %1planet technology corp. · planet igs-5225-8p2t4s v118 Eyl 2026
- CVE-2026-8194333İzleyin
PLANET IGS-5225-8P2T4S V1/V2 Debug Mode RCE
YüksekCVSS 8,4İstismar yokEPSS %0planet technology corp. · planet igs-5225-8p2t4s v118 Eyl 2026
- CVE-2026-8194430İzleyin
PLANET IGS-5225-8P2T4S V1/V2 Stack-Based Buffer Overflow via Web Server
YüksekCVSS 7,7İstismar yokEPSS %0planet technology corp. · planet igs-5225-8p2t4s v118 Eyl 2026
- CVE-2026-8194530İzleyin
PLANET IGS-5225-8P2T4S V1/V2 Admin Stack-Based Buffer Overflow via Web Server
YüksekCVSS 7,5İstismar yokEPSS %0planet technology corp. · planet igs-5225-8p2t4s v118 Eyl 2026
- CVE-2026-8438339İzleyin
libheif: Heap buffer overflow in `scale_nearest_neighbor()` via duplicate Alpha planes from nested `iden`/`auxl` items
KritikCVSS 9,8Kavram kanıtıEPSS %0strukturag · libheif18 Eyl 2026
- CVE-2026-8438430İzleyin
libheif: brotli/zlib decompression paths lack output-size limits, allowing decompression-bomb OOM/DoS
YüksekCVSS 7,5İstismar yokEPSS %0strukturag · libheif18 Eyl 2026
- CVE-2026-8439834İzleyin
CareCam CM2507 Empty Password in Configuration File
YüksekCVSS 8,7İstismar yokEPSS %0carecam · hmt.cm2507 firmware18 Eyl 2026
- CVE-2026-8444429İzleyin
libheif uncompressed tiled image encoding allows out-of-bounds write
YüksekCVSS 7,4İstismar yokEPSS %0strukturag · libheif18 Eyl 2026
- CVE-2026-8444630İzleyin
libheif: Sequence decode timing-table initialization allows non-terminating loops and unbounded memory, bypassing max_sequence_frames
YüksekCVSS 7,5İstismar yokEPSS %0strukturag · libheif18 Eyl 2026
- CVE-2026-8444730İzleyin
libheif: Derived-image indirect reference chains and tiled offsets bypass decode caching and MemoryHandle limits, causing CPU/memory amplification DoS
YüksekCVSS 7,5İstismar yokEPSS %0strukturag · libheif18 Eyl 2026
- CVE-2026-8652034İzleyin
Use of Hard-coded Credentials in Bransys ELD
YüksekCVSS 8,7İstismar yokEPSS %0bransys · eld18 Eyl 2026
- CVE-2026-8668932İzleyin
Cleartext Transmission of Sensitive Information in Bransys ELD
YüksekCVSS 8,2İstismar yokEPSS %0bransys · eld18 Eyl 2026
- CVE-2026-8825934İzleyin
CareCam CM2507 Missing Authentication for Critical Function
YüksekCVSS 8,7İstismar yokEPSS %0carecam · hmt.cm2507 firmware18 Eyl 2026
- CVE-2026-9368834İzleyin
SGLang through 0.5.19 Unbounded Memory Allocation via bootstrap_room
YüksekCVSS 8,7İstismar yokEPSS %0sgl-project · sglang18 Eyl 2026
- CVE-2026-9369034İzleyin
uri-js through 4.4.1 Denial of Service via removeDotSegments
YüksekCVSS 8,7İstismar yokEPSS %0garycourt · uri-js18 Eyl 2026
- CVE-2026-9373728İzleyin
Azkaban through 4.0.0 Authorization Bypass via ScheduleServlet
YüksekCVSS 7,1İstismar yokEPSS %0azkaban · azkaban18 Eyl 2026
- CVE-2026-2180639İzleyin
HCL BigFix Service Management was affected with Admin Session Concurrency vulnerability (CVE-2026-21806)
KritikCVSS 9,8İstismar yokEPSS %0hcltech · bigfix service management18 Eyl 2026
- CVE-2026-9348830İzleyin
Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams
YüksekCVSS 7,5İstismar yokEPSS %0red hat · red hat amq broker 718 Eyl 2026
- CVE-2026-5555632İzleyin
Rsyslog: Heap buffer overflow in imhttp plugin Basic Authentication handling
YüksekCVSS 8,2İstismar yokEPSS %0rsyslog · rsyslog18 Eyl 2026
- CVE-2026-5819735İzleyin
ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement
YüksekCVSS 8,8İstismar yokEPSS %0stacklok · toolhive18 Eyl 2026
- CVE-2026-6154832İzleyin
Rsyslog: mmpstrucdata stack buffer overflow with oversized RFC5424 structured data
YüksekCVSS 8,1İstismar yokEPSS %0rsyslog · rsyslog18 Eyl 2026
- CVE-2026-6167228İzleyin
Capsule: Tenant owner bypasses Capsule's forbidden namespace/service/node label and annotation enforcement
YüksekCVSS 7,1İstismar yokEPSS %0projectcapsule · capsule18 Eyl 2026
- CVE-2026-6294334İzleyin
btrbk: SSH Command Filter Bypass in ssh_filter_btrbk.sh
YüksekCVSS 8,7İstismar yokEPSS %0digint · btrbk18 Eyl 2026
- CVE-2026-6334928İzleyin
AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups
YüksekCVSS 7,0İstismar yokEPSS %0agronholm · anyio18 Eyl 2026
- CVE-2026-7386328İzleyin
NanoMQ: Heap-Buffer-Overflow in `nmq_subinfo_decode()` During MQTT v5 SUBSCRIBE Parsing
YüksekCVSS 7,0İstismar yokEPSS %0nanomq · nanomq18 Eyl 2026
- CVE-2026-7723932İzleyin
WACRM: Service-role routes missing a role check
YüksekCVSS 8,1İstismar yokEPSS %0arnasdon · wacrm18 Eyl 2026
- CVE-2026-7730130İzleyin
adm-zip: Uncontrolled memory allocation via the declared uncompressed size (DoS)
YüksekCVSS 7,5İstismar yokEPSS %0cthackers · adm-zip18 Eyl 2026
- CVE-2026-8132137İzleyin
CareCam CM2507 Cleartext Storage of Sensitive Information
KritikCVSS 9,3İstismar yokEPSS %0carecam · hmt.cm2507 firmware18 Eyl 2026
- CVE-2026-8150528İzleyin
Convoy: Cross-Tenant Source IDOR Leaks Plaintext Message Broker Credentials
YüksekCVSS 7,1İstismar yokEPSS %0frain-dev · convoy18 Eyl 2026
- CVE-2026-8549737İzleyin
CareCam CM2507 Use of Password Hash With Insufficient Computational Effort
KritikCVSS 9,3İstismar yokEPSS %0carecam · hmt.cm2507 firmware18 Eyl 2026
- CVE-2026-9375834İzleyin
Cross-principal document update, theft, and deletion via unvalidated id in nested attributes
YüksekCVSS 8,6İstismar yokEPSS %0mongodb · mongoid18 Eyl 2026
- CVE-2026-9376533İzleyin
Document deletion and process crash via unvalidated method-name dispatch in atomic pop operation
YüksekCVSS 8,3İstismar yokEPSS %0mongodb · mongoid18 Eyl 2026
- CVE-2026-9349130İzleyin
Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue
YüksekCVSS 7,5İstismar yokEPSS %0red hat · red hat amq broker 718 Eyl 2026
- CVE-2026-3264130İzleyin
Parseable: Unauthenticated Denial of Service via panic in Kinesis header parsing middleware
YüksekCVSS 7,5İstismar yokEPSS %0parseablehq · parseable18 Eyl 2026
- CVE-2026-3362535İzleyin
LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading
YüksekCVSS 8,8İstismar yokEPSS %0internlm · lmdeploy18 Eyl 2026
- CVE-2026-5916336İzleyin
Mnemosyne has JWT signature verification bypass sync server that allows authentication bypass
KritikCVSS 9,1İstismar yokEPSS %0axdsan · mnemosyne18 Eyl 2026
- CVE-2026-6155039İzleyin
Icinga 2: Improper access control for JSON-RPC update certificate messages
KritikCVSS 9,8İstismar yokEPSS %0icinga · icinga218 Eyl 2026
- CVE-2026-6155134İzleyin
Icinga 2: Stack overflow via deeply nested JSON objects
YüksekCVSS 8,6İstismar yokEPSS %0icinga · icinga218 Eyl 2026
- CVE-2026-6155228İzleyin
Icinga 2 DSL Injection via Unescaped Import Template Name
YüksekCVSS 7,2İstismar yokEPSS %0icinga · icinga218 Eyl 2026
- CVE-2026-6227832İzleyin
LubeLogger: Path Traversal in HandleTranslationFileUpload Allows Authenticated Users to Write Files Outside Data Directory
YüksekCVSS 8,1İstismar yokEPSS %0hargata · lubelog18 Eyl 2026
- CVE-2026-6344528İzleyin
Perses: Unvalidated project parameter enables filesystem path traversal
YüksekCVSS 7,1İstismar yokEPSS %0perses · perses18 Eyl 2026
- CVE-2026-6345828İzleyin
Perses project query parameter authorization bypass exposes cross-project resources
YüksekCVSS 7,1İstismar yokEPSS %0perses · perses18 Eyl 2026
- CVE-2026-6918430İzleyin
c-ares: CPU-exhaustion denial of service via unbounded DNS name compression pointer chains
YüksekCVSS 7,5İstismar yokEPSS %0c-ares · c-ares18 Eyl 2026
- CVE-2026-8117932İzleyin
SysReptor: Host header injection might allow account takeover
YüksekCVSS 8,1İstismar yokEPSS %0syslifters · sysreptor18 Eyl 2026
- CVE-2026-8118035İzleyin
SysReptor: Authenticated RCE by insecure image processing
YüksekCVSS 8,8İstismar yokEPSS %0syslifters · sysreptor18 Eyl 2026
- CVE-2026-8505830İzleyin
Moquette: Missing Authorization in io.moquette:moquette-broker
YüksekCVSS 7,5İstismar yokEPSS %0moquette-io · moquette18 Eyl 2026
- CVE-2026-9112732İzleyin
File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
YüksekCVSS 8,2İstismar yokEPSS %0flyfish-dev · file-viewer18 Eyl 2026
- CVE-2026-9374934İzleyin
source-map-js through 1.2.1 Event Loop Denial of Service
YüksekCVSS 8,7İstismar yokEPSS %07rulnik · source-map-js18 Eyl 2026
- CVE-2026-9375032İzleyin
http-cache-semantics through 4.2.0 Cross-Client Cache Disclosure via Vary Wildcard
YüksekCVSS 8,2İstismar yokEPSS %0kornelski · http-cache-semantics18 Eyl 2026
- CVE-2026-9375234İzleyin
CSSOM through 0.5.0 Denial of Service via length Property
YüksekCVSS 8,7İstismar yokEPSS %0nv · cssom18 Eyl 2026
- CVE-2026-9375334İzleyin
deepmerge through 4.3.1 Prototype Poisoning via mergeObject
YüksekCVSS 8,7İstismar yokEPSS %0tehshrike · deepmerge18 Eyl 2026
- CVE-2026-9375935İzleyin
Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist
YüksekCVSS 8,8İstismar yokEPSS %0mongodb · mongoid18 Eyl 2026
- CVE-2026-9376033İzleyin
NoSQL injection of JavaScript-executing query operators via unsafe-by-default operator guard
YüksekCVSS 8,3İstismar yokEPSS %0mongodb · mongoid18 Eyl 2026
- CVE-2026-9376134İzleyin
Denial of service via unbounded regex matching in Mongoid's in-memory query matcher
YüksekCVSS 8,7İstismar yokEPSS %0mongodb · mongoid18 Eyl 2026
- CVE-2026-9376236İzleyin
Data deletion and attribute disclosure via field-name method injection in in-memory queries
KritikCVSS 9,2İstismar yokEPSS %0mongodb · mongoid18 Eyl 2026
- CVE-2026-9376328İzleyin
Silent plaintext persistence via unresolved callable database name in encryption schema map
YüksekCVSS 7,1İstismar yokEPSS %0mongodb · mongoid18 Eyl 2026
- CVE-2026-9376428İzleyin
Plaintext storage of encrypted fields via skipped embedded models in encryption schema generation
YüksekCVSS 7,1İstismar yokEPSS %0mongodb · mongoid18 Eyl 2026
- CVE-2026-9359234İzleyin
vLLM before 0.28.0 Denial of Service via negative token ID
YüksekCVSS 8,7İstismar yokEPSS %0vllm · vllm18 Eyl 2026
- CVE-2019-2577634İzleyin
Weaver E-cology SQL Injection via SyncUserInfo.jsp
YüksekCVSS 8,7İstismar yokEPSS %0weaver network co., ltd. · e-cology18 Eyl 2026
- CVE-2021-4800834İzleyin
Chanjet CRM SQL Injection via get_usedspace.php
YüksekCVSS 8,7İstismar yokEPSS %0chanjet information technology co., ltd. · crm18 Eyl 2026
- CVE-2023-5439937İzleyin
Hongjing e-HR < 8.2 SQL Injection via /servlet/codesettree
KritikCVSS 9,3İstismar yokEPSS %0hongjing · e-hr18 Eyl 2026
- CVE-2026-7589330İzleyin
Heap based buffer overflow at ipaccess_proxy_read_msg()
YüksekCVSS 7,5İstismar yokEPSS %0osmocom · osmo-bsc18 Eyl 2026
- CVE-2026-7589430İzleyin
Reachable assertion at ranap_handle_co_dt()
YüksekCVSS 7,5İstismar yokEPSS %0osmocom · osmo-iuh18 Eyl 2026
- CVE-2026-9355830İzleyin
Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service
YüksekCVSS 7,5İstismar yokEPSS %1red hat · red hat amq broker 718 Eyl 2026
- CVE-2026-9356430İzleyin
Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881)
YüksekCVSS 7,5İstismar yokEPSS %0red hat · red hat amq broker 718 Eyl 2026
- CVE-2026-9356530İzleyin
Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte
YüksekCVSS 7,5İstismar yokEPSS %0red hat · red hat amq broker 718 Eyl 2026
- CVE-2026-9356731İzleyin
Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority
YüksekCVSS 7,5İstismar yokEPSS %2red hat · red hat amq broker 718 Eyl 2026
- CVE-2026-9356830İzleyin
Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests
YüksekCVSS 7,5İstismar yokEPSS %0red hat · red hat amq broker 718 Eyl 2026
- CVE-2026-9356933İzleyin
Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority
YüksekCVSS 8,2İstismar yokEPSS %2red hat · red hat amq broker 718 Eyl 2026
- CVE-2026-9365934İzleyin
Concrete CMS Community Store before 2.7.8 Stored XSS
YüksekCVSS 8,6Kavram kanıtıEPSS %0concretecms-community-store · community_store18 Eyl 2026
- CVE-2026-9385228İzleyin
In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases for every project without enforcing projec
YüksekCVSS 7,1İstismar yokEPSS %0openstack · blazar18 Eyl 2026
- CVE-2026-9385428İzleyin
In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2
YüksekCVSS 7,2İstismar yokEPSS %0openstack · blazar18 Eyl 2026
- CVE-2017-2028434İzleyin
Caucho Resin resin-doc Unauthenticated Path Traversal via jndi-appconfig Servlet
YüksekCVSS 8,7İstismar yokEPSS %1caucho technology, inc. · resin18 Eyl 2026
- CVE-2025-1475330İzleyin
IBM Cloud Pak for Data is vulnerable to path traversal
YüksekCVSS 7,5İstismar yokEPSS %0ibm · cloud pak for data18 Eyl 2026
- CVE-2025-1475435İzleyin
IBM Cloud Pak for Data is vulnerable to OS command injection
YüksekCVSS 8,8İstismar yokEPSS %0ibm · cloud pak for data18 Eyl 2026
- CVE-2025-1539940Planlayın
Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent
KritikCVSS 10,0İstismar yokEPSS %0ibm · common licensing18 Eyl 2026
- CVE-2026-1171630İzleyin
IBM MQ for HPE NonStop is vulnerable to a denial of service attack
YüksekCVSS 7,5İstismar yokEPSS %0ibm · mq for hpe nonstop18 Eyl 2026
- CVE-2026-1172535İzleyin
IBM MQ queue manager is vulnerable to privilege escalation
YüksekCVSS 8,8İstismar yokEPSS %0ibm · mq18 Eyl 2026
- CVE-2025-5383739İzleyin
org.xwiki.rendering:xwiki-rendering-xml has an Eval Injection issue
KritikCVSS 9,9İstismar yokEPSS %1xwiki · xwiki-rendering18 Eyl 2026
- CVE-2025-6168234İzleyin
Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes
YüksekCVSS 8,6İstismar yokEPSS %0semanticmediawiki · semanticmediawiki18 Eyl 2026
- CVE-2026-1172632İzleyin
IBM MQ for HPE NonStop is vulnerable to a denial of service issue
YüksekCVSS 8,1İstismar yokEPSS %0ibm · mq for hpe nonstop18 Eyl 2026