Yayın tarihine göre

Eylül 2026: sömürülen ve yeni ciddi CVE kayıtları

7.959 kayıt · 32 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 58 / 80

CVE kayıtları
Aksiyon	CVE	Zafiyet	Ciddiyet	KEV	EPSS	Yayın
35İzleyin	CVE-2026-92807İstismar yok	Save as PDF Plugin by PDFCrowd <= 4.6.1 - Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attripdfcrowd · save as pdf plugin by pdfcrowd · CWE-94 RCE	Yüksek8,8	—	%0,4	18 Eyl 2026
37İzleyin	CVE-2026-93741İstismar yok	Totolink A3002MU formWlWds buffer overflowtotolink · a3002mu · CWE-119 Kimlik doğrulamasız Bellek hatası	Kritik9,3	—	%0,6	19 Eyl 2026
28İzleyin	CVE-2026-76554İstismar yok	WP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User Importunknown · wp import export lite · CWE-269	Yüksek7,2	—	%0,4	19 Eyl 2026
28İzleyin	CVE-2026-76790İstismar yok	Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameterunknown · estatik real estate plugin · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,2	19 Eyl 2026
32İzleyin	CVE-2026-85574İstismar yok	Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unbounce_domainsunknown · unbounce landing pages · CWE-862 Erişim denetimi (IDOR)	Yüksek8,0	—	%0,3	19 Eyl 2026
35İzleyin	CVE-2026-85680İstismar yok	Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Titleunknown · ultimate member · CWE-79 Kimlik doğrulamasız XSS	Yüksek8,8	—	%0,5	19 Eyl 2026
39İzleyin	CVE-2026-86591İstismar yok	Botiga Pro < 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder REST Routeunknown · botiga pro · CWE-862 Kimlik doğrulamasız Erişim denetimi (IDOR)	Kritik9,8	—	%0,5	19 Eyl 2026
32İzleyin	CVE-2026-86814İstismar yok	UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider Emailunknown · userswp · CWE-269 Kimlik doğrulamasız	Yüksek8,1	—	%0,3	19 Eyl 2026
35İzleyin	CVE-2026-88824İstismar yok	Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label Settingsunknown · master blocks · CWE-79 Kimlik doğrulamasız XSS	Yüksek8,8	—	%0,5	19 Eyl 2026
34İzleyin	CVE-2026-88926İstismar yok	VikRentItems Flexible Rental Management System < 1.2.4 - Unauthenticated SQLiunknown · vikrentitems flexible rental management system · CWE-89 Kimlik doğrulamasız SQL enjeksiyonu	Yüksek8,6	—	%0,4	19 Eyl 2026
26İzleyin	CVE-2026-92099Kavram kanıtı	WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squattingunknown · wpgraphql smart cache · CWE-284 Kimlik doğrulamasız Erişim denetimi (IDOR)	Orta6,5	—	%0,3	19 Eyl 2026
30İzleyin	CVE-2026-92404İstismar yok	MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosureunknown · mgosync · CWE-200 Kimlik doğrulamasız Bilgi sızıntısı	Yüksek7,5	—	%0,4	19 Eyl 2026
28İzleyin	CVE-2026-15664İstismar yok	Quill Forms \| Conversational Multi Step Forms, Surveys & quizzes <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting via Multiple Choice 'Other' Valuemdmag · quill forms \| conversational multi step forms, surveys & quizzes · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,2	—	%0,5	19 Eyl 2026
35İzleyin	CVE-2026-4327İstismar yok	The Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' Parametersebwordpress · the welcomizer · CWE-94 RCE	Yüksek8,8	—	%0,6	19 Eyl 2026
32İzleyin	CVE-2026-85658İstismar yok	Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortcoproperfraction · paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress · CWE-94 RCE	Yüksek8,1	—	%0,6	19 Eyl 2026
30İzleyin	CVE-2026-1255İstismar yok	YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Unauthenticated Information Disclosure in 'ysleadgen_get_captured_data' AJAX Actionysinnovations · ys leadgen – popup builder, popup maker & form builder for wordpress \| lead generation, email marketing, sales, conversions, opt-ins & subscribers · CWE-200 Kimlik doğrulamasız Bilgi sızıntısı	Yüksek7,5	—	%0,5	19 Eyl 2026
35İzleyin	CVE-2026-93742İstismar yok	Totolink A3002MU formWsc command injectiontotolink · a3002mu · CWE-74 RCE Komut enjeksiyonu	Yüksek8,6	—	%2,2	19 Eyl 2026
39İzleyin	CVE-2026-78030İstismar yok	DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBMCWE-470 Kimlik doğrulamasız	Kritik9,8	—	%0,4	19 Eyl 2026
26İzleyin	CVE-2026-94000Kavram kanıtı	Keycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membershipred hat · red hat build of keycloak · CWE-862 Erişim denetimi (IDOR)	Orta6,6	—	%0,4	19 Eyl 2026
28İzleyin	RUSTSEC-2026-0328İstismar yok	`decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip) Yol geçişi	Yüksek7,1	—	—	19 Eyl 2026
30İzleyin	CVE-2026-82560İstismar yok	Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output widthCWE-835 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek7,5	—	%0,6	19 Eyl 2026
37İzleyin	CVE-2026-93985İstismar yok	OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCEopenpanel-dev · openpanel · CWE-94 RCE	Kritik9,4	—	%0,6	19 Eyl 2026
33İzleyin	CVE-2026-93991İstismar yok	Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selectorargoproj · argo-workflows · CWE-639 Erişim denetimi (IDOR)	Yüksek8,3	—	%0,4	19 Eyl 2026
28İzleyin	CVE-2026-93992İstismar yok	Gopeed through 2.0.0-beta.3 Arbitrary File Write via Path Traversalgopeedlab · gopeed · CWE-22 Kimlik doğrulamasız Yol geçişi	Yüksek7,0	—	%0,9	19 Eyl 2026
34İzleyin	CVE-2026-93993İstismar yok	Mistral Vibe before 2.25.5 Remote Code Execution via git post-checkoutmistralai · mistral-vibe · CWE-829 Girişsiz RCE	Yüksek8,6	—	%0,7	19 Eyl 2026
30İzleyin	CVE-2026-94056İstismar yok	Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data fromexim · exim · CWE-908 Kimlik doğrulamasız Bellek hatası	Yüksek7,5	—	%0,2	19 Eyl 2026
35İzleyin	CVE-2026-93958Kavram kanıtı	D-Link R95 DHMAPI ssi system os command injectiond-link · r95 · CWE-77 RCE Komut enjeksiyonu	Yüksek8,5	—	%2,7	19 Eyl 2026
28İzleyin	CVE-2026-93988İstismar yok	QloApps through 1.7.0 Arbitrary File Read via getEmailHTMLwebkul · qloapps · CWE-22 Yol geçişi	Yüksek7,1	—	%0,5	19 Eyl 2026
34İzleyin	CVE-2026-93990İstismar yok	Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogatelibexpat · libexpat · CWE-176 Kimlik doğrulamasız	Yüksek8,7	—	%0,4	19 Eyl 2026
21İzleyin	CVE-2026-86552Kavram kanıtı	A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APPzte · smartlife · CWE-269	Orta5,4	—	%0,3	20 Eyl 2026
35İzleyin	CVE-2026-86553İstismar yok	A password reset vulnerability in ZTE SmartLife APPzte · smartlife · CWE-269	Yüksek8,8	—	%0,5	20 Eyl 2026
22İzleyin	CVE-2026-93964İstismar yok	NginxProxyManager nginx-proxy-manager Validate Route certificate.js internalCertificate.validate missing authenticationnginxproxymanager · nginx-proxy-manager · CWE-287 Kimlik doğrulamasız Kimlik doğrulama atlatma	Orta5,5	—	%0,4	20 Eyl 2026
37İzleyin	CVE-2026-94083İstismar yok	Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even thoisf · suricata · CWE-843 Kimlik doğrulamasız	Kritik9,4	—	%0,5	20 Eyl 2026
37İzleyin	CVE-2026-94084İstismar yok	Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with oisf · suricata · CWE-416 Kimlik doğrulamasız Bellek hatası	Kritik9,4	—	%0,5	20 Eyl 2026
28İzleyin	CVE-2026-81650İstismar yok	NextGEN Gallery < 4.5.0 - Authenticated Arbitrary File Upload via ZIP Importunknown · photo gallery, sliders, proofing and themes · CWE-434 RCE Dosya yükleme	Yüksek7,2	—	%0,4	20 Eyl 2026
32İzleyin	CVE-2026-82842İstismar yok	SAML Single Sign On < 6.0.0 - Unauthenticated Privilege Escalation via Account Matchingunknown · saml single sign on · CWE-269 Kimlik doğrulamasız	Yüksek8,1	—	%0,3	20 Eyl 2026
30İzleyin	CVE-2026-85017İstismar yok	Unlimited Elements For Elementor < 2.0.20 - Subscriber+ PHP Object Injectionunknown · unlimited elements for elementor · CWE-502 Deserializasyon	Yüksek7,5	—	%0,4	20 Eyl 2026
34İzleyin	CVE-2026-87067İstismar yok	Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injectionunknown · forminator forms · CWE-94 RCE	Yüksek8,5	—	%0,4	20 Eyl 2026
30İzleyin	CVE-2026-87839İstismar yok	Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletionunknown · tripzzy · CWE-284 Kimlik doğrulamasız Erişim denetimi (IDOR)	Yüksek7,5	—	%0,3	20 Eyl 2026
28İzleyin	CVE-2026-92540İstismar yok	Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_usersunknown · import and export users and customers · CWE-269	Yüksek7,2	—	%0,4	20 Eyl 2026
28İzleyin	CVE-2026-92541İstismar yok	Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importerunknown · import and export users and customers · CWE-269	Yüksek7,2	—	%0,4	20 Eyl 2026
37İzleyin	CVE-2026-94003İstismar yok	Comfast CF-N1-S Web Management mbox-config get_css_path_from_uri stack-based overflowcomfast · cf-n1-s · CWE-119 Kimlik doğrulamasız Bellek hatası	Kritik9,3	—	%0,6	20 Eyl 2026
34İzleyin	CVE-2026-94104İstismar yok	NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanagernivocart · nivocart · CWE-434 RCE Dosya yükleme	Yüksek8,7	—	%0,6	20 Eyl 2026
34İzleyin	CVE-2026-94106İstismar yok	getID3 before 1.9.26 OS Command Injection via Unescaped Filenamesjames-heinrich · getid3 · CWE-78 RCE Komut enjeksiyonu	Yüksek8,7	—	%1,6	20 Eyl 2026
36İzleyin	CVE-2026-94107İstismar yok	NivoCart through 2.4.0 Predictable Administrator Password Reset Tokennivocart · nivocart · CWE-338 Kimlik doğrulamasız Zayıf kripto	Kritik9,2	—	%0,5	20 Eyl 2026
33İzleyin	CVE-2026-94108İstismar yok	getID3 through 1.9.26 XML External Entity Injection via XML2arrayjames-heinrich · getid3 · CWE-611 Kimlik doğrulamasız SSRF XXE	Yüksek8,3	—	%0,5	20 Eyl 2026
27İzleyin	CVE-2026-94111İstismar yok	Tencent BrowserSkill through 0.3.0 Origin Validation Error in Local WebSocket Daemontencent · browserskill · CWE-346 Kimlik doğrulama atlatma	Orta6,9	—	%0,1	20 Eyl 2026
30İzleyin	CVE-2026-94112İstismar yok	mayswind ezBookkeeping before 2.0.0 TOTP Replay Attackmayswind · ezbookkeeping · CWE-294 Kimlik doğrulamasız Kimlik doğrulama atlatma	Yüksek7,6	—	%0,3	20 Eyl 2026
28İzleyin	CVE-2026-94113İstismar yok	Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpointsfrappe · erpnext · CWE-862 Erişim denetimi (IDOR)	Yüksek7,1	—	%0,4	20 Eyl 2026
40Planlayın	CVE-2026-90817Kavram kanıtı	An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in whicvanderbilt university · redcap · CWE-73 Girişsiz RCE Yol geçişi	Kritik9,8	—	%3,7	20 Eyl 2026
29İzleyin	CVE-2026-94036Kavram kanıtı	D-Link DIR-X1860/DIR-X1860Z routerd ubus access controld-link · dir-x1860 · CWE-266 Kimlik doğrulamasız	Yüksek7,4	—	%0,5	20 Eyl 2026
34İzleyin	CVE-2026-94109İstismar yok	openEQUELLA < 2026.1.0 Authenticated Stored SSTI via FreemarkerPortletRendereropenequella · openequella · CWE-1336 RCE SSTI	Yüksek8,6	—	%0,7	20 Eyl 2026
37İzleyin	CVE-2026-88854Kavram kanıtı	Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7ordasoft.com · ordasoft joomla gallery free extension for joomla · CWE-89 Kimlik doğrulamasız SQL enjeksiyonu	Kritik9,3	—	%0,3	20 Eyl 2026
34İzleyin	CVE-2026-88855İstismar yok	Joomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7ordasoft.com · ordasoft joomla gallery free extension for joomla · CWE-89 SQL enjeksiyonu	Yüksek8,6	—	%0,3	20 Eyl 2026
37İzleyin	CVE-2026-88856İstismar yok	Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7ordasoft.com · ordasoft joomla gallery free extension for joomla · CWE-94 RCE	Kritik9,4	—	%0,6	20 Eyl 2026
37İzleyin	CVE-2026-88857İstismar yok	Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7ordasoft.com · ordasoft joomla gallery free extension for joomla · CWE-434 RCE Dosya yükleme	Kritik9,4	—	%0,6	20 Eyl 2026
37İzleyin	CVE-2026-94089İstismar yok	D-Link DIR-868L Authentication webfa_authentication.cgi strcpy stack-based overflowd-link · dir-868l · CWE-119 Kimlik doğrulamasız Bellek hatası	Kritik9,3	—	%0,9	20 Eyl 2026
35İzleyin	CVE-2026-94095Kavram kanıtı	Netcore NBR200V2 Traceroute Diagnostic Feature network_tools command injectionnetcore · nbr200v2 · CWE-74 RCE Komut enjeksiyonu	Yüksek8,6	—	%2,3	20 Eyl 2026
35İzleyin	CVE-2026-94096İstismar yok	Netcore NBR200V2 LAN IP Configuration network_tools command injectionnetcore · nbr200v2 · CWE-74 RCE Komut enjeksiyonu	Yüksek8,6	—	%1,9	20 Eyl 2026
38İzleyin	CVE-2026-94097İstismar yok	Netcore NBR200V2 CGI Diagnostic Endpoint network_tools command injectionnetcore · nbr200v2 · CWE-74 Girişsiz RCE Komut enjeksiyonu	Kritik9,3	—	%2,9	20 Eyl 2026
35İzleyin	CVE-2026-94098İstismar yok	Netcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injectionnetcore · nbr200v2 · CWE-74 RCE Komut enjeksiyonu	Yüksek8,5	—	%2,3	20 Eyl 2026
35İzleyin	CVE-2026-94099İstismar yok	Netcore NBR200V2 Backup Restore restore.cgi command injectionnetcore · nbr200v2 · CWE-74 RCE Komut enjeksiyonu	Yüksek8,6	—	%1,6	20 Eyl 2026
34İzleyin	CVE-2026-94100İstismar yok	Netcore NBR200V2 WAN VLAN Reconfiguration routerd wan_config_set_vlan buffer overflownetcore · nbr200v2 · CWE-119 Bellek hatası	Yüksek8,6	—	%0,8	20 Eyl 2026
34İzleyin	CVE-2026-94101İstismar yok	Netcore NBR200V2 routerd vlan_load_form_uci buffer overflownetcore · nbr200v2 · CWE-119 Bellek hatası	Yüksek8,6	—	%0,4	20 Eyl 2026
34İzleyin	CVE-2026-94128Kavram kanıtı	BioStar VIVID LED DJ IOCTL BS_LED64.sys sub_1105C write-what-wherebiostar · vivid led dj · CWE-119 Bellek hatası	Yüksek8,5	—	%0,1	20 Eyl 2026
34İzleyin	CVE-2026-94129Kavram kanıtı	BioStar VALKYRIE AURORA IOCTL BS_RVSIO64.sys sub_1105C write-what-wherebiostar · valkyrie aurora · CWE-119 Bellek hatası	Yüksek8,5	—	%0,1	20 Eyl 2026
34İzleyin	CVE-2026-94142İstismar yok	BioStar Temperature Monitor Utility IOCTL BS_HWMIO64_W10.sys sub_1105C write-what-wherebiostar · temperature monitor utility · CWE-119 Bellek hatası	Yüksek8,5	—	%0,1	21 Eyl 2026
39İzleyin	CVE-2026-82187İstismar yok	WooCommerce Online Product Designer 1.7.0 - < 2.15.0 - Unauthenticated Arbitrary File Uploadunknown · web to print online designer · CWE-434 Kimlik doğrulamasız Dosya yükleme	Kritik9,8	—	%0,5	21 Eyl 2026
28İzleyin	CVE-2026-90860İstismar yok	The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebViecanva · canva · CWE-212 Kimlik doğrulamasız	Yüksek7,1	—	%0,3	21 Eyl 2026
34İzleyin	CVE-2026-94146İstismar yok	BioStar BIOS Update Utility IOCTL BSMEM64_W10.sys sub_110BC write-what-wherebiostar · bios update utility · CWE-119 Bellek hatası	Yüksek8,5	—	%0,1	21 Eyl 2026
30İzleyin	CVE-2026-47321İstismar yok	Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflateapache software foundation · apache mina · CWE-409 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek7,5	—	%0,4	21 Eyl 2026
32İzleyin	CVE-2026-15801İstismar yok	Cri-o: cri-o: insufficient validation during container checkpoint restorered hat · red hat openshift container platform 4 · CWE-22 Yol geçişi	Yüksek8,0	—	%0,4	21 Eyl 2026
34İzleyin	CVE-2026-16651İstismar yok	temporalio/sqlparser malformed MySQL version comments can cause a panictemporal technologies, inc. · temporalio/sqlparser · CWE-129 Kimlik doğrulamasız	Yüksek8,7	—	%0,5	21 Eyl 2026
28İzleyin	CVE-2026-16652İstismar yok	Temporal Server Schedule exclusion search can cause excessive CPU consumptiontemporal technologies, inc. · temporal server · CWE-606	Yüksek7,1	—	%0,4	21 Eyl 2026
34İzleyin	CVE-2026-65651İstismar yok	temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversaltemporal technologies, inc. · temporalio/sqlparser · CWE-674 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek8,7	—	%0,6	21 Eyl 2026
34İzleyin	CVE-2026-65652İstismar yok	temporalio/tchannel-go malformed checksum type causes process terminationtemporal technologies, inc. · temporalio/tchannel-go · CWE-129 Kimlik doğrulamasız	Yüksek8,7	—	%0,7	21 Eyl 2026
34İzleyin	CVE-2026-65653İstismar yok	temporalio/tchannel-go zero-chunk call fragment causes process terminationtemporal technologies, inc. · temporalio/tchannel-go · CWE-129 Kimlik doğrulamasız	Yüksek8,7	—	%0,7	21 Eyl 2026
34İzleyin	CVE-2026-65654İstismar yok	temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossiptemporal technologies, inc. · temporalio/ringpop-go · CWE-770 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek8,7	—	%0,5	21 Eyl 2026
28İzleyin	CVE-2026-87858İstismar yok	Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorizationtemporal technologies, inc. · temporal server · CWE-807	Yüksek7,2	—	%0,7	21 Eyl 2026
34İzleyin	CVE-2026-89139İstismar yok	Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service hosttemporal technologies, inc. · temporal server · CWE-78 RCE Komut enjeksiyonu	Yüksek8,7	—	%0,5	21 Eyl 2026
30İzleyin	CVE-2026-91863İstismar yok	Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of serviceapache · neethi · CWE-674 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek7,5	—	%0,7	21 Eyl 2026
30İzleyin	CVE-2026-91864İstismar yok	Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustionapache · neethi · CWE-770 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek7,5	—	%0,7	21 Eyl 2026
30İzleyin	CVE-2026-91865İstismar yok	Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of serviceapache · neethi · CWE-770 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek7,5	—	%0,7	21 Eyl 2026
30İzleyin	CVE-2026-91866İstismar yok	Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of serviceapache · neethi · CWE-770 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek7,5	—	%0,7	21 Eyl 2026
28İzleyin	CVE-2026-94368İstismar yok	Noobaa-core: noobaa-core: presigned put url escalation to copyobject via unsigned x-amz-copy-source headerred hat · red hat openshift data foundation 4 · CWE-347 Zayıf kripto	Yüksek7,1	—	%0,2	21 Eyl 2026
36İzleyin	CVE-2025-12999İstismar yok	UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forwardeclipse foundation · eclipse open vsx · CWE-345 Kimlik doğrulamasız	Kritik9,1	—	%0,3	21 Eyl 2026
36İzleyin	CVE-2026-84285İstismar yok	OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5dassault systèmes · tuleap enterprise edition · CWE-78 RCE Komut enjeksiyonu	Yüksek8,8	—	%1,8	21 Eyl 2026
33İzleyin	CVE-2026-94374İstismar yok	MISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events' Reportsmisp · misp · CWE-472 Erişim denetimi (IDOR)	Yüksek8,3	—	%0,3	21 Eyl 2026
34İzleyin	CVE-2026-94381İstismar yok	MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTimemisp · misp · CWE-269	Yüksek8,7	—	%0,3	21 Eyl 2026
34İzleyin	CVE-2026-94383İstismar yok	MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extensionmisp · misp · CWE-20 RCE	Yüksek8,6	—	%0,5	21 Eyl 2026
35İzleyin	CVE-2026-92574İstismar yok	Cri-o: cri-o checkpoint restore bypasses destination security contextred hat · confidential compute attestation · CWE-250	Yüksek8,8	—	%0,6	21 Eyl 2026
30İzleyin	CVE-2026-88806İstismar yok	libX11 XkbGetMap Reply Heap-based Buffer Overflowx.org · libx11 · CWE-122 Kimlik doğrulamasız Bellek hatası	Yüksek7,5	—	%0,2	21 Eyl 2026
35İzleyin	CVE-2026-88807İstismar yok	libXrender RenderQueryPictFormats Reply Heap-based Buffer Overflowx.org · libxrender · CWE-122 Kimlik doğrulamasız Bellek hatası	Yüksek8,9	—	%0,2	21 Eyl 2026
33İzleyin	CVE-2026-94401İstismar yok	MISP Arbitrary Local File Read and SSRF via MISP Export Uploadmisp · misp · CWE-73 SSRF Yol geçişi	Yüksek8,3	—	%0,3	21 Eyl 2026
28İzleyin	CVE-2026-94404İstismar yok	MISP CSRF vulnerability allows unauthorized attribute modificationmisp · misp · CWE-352 Kimlik doğrulamasız CSRF	Yüksek7,1	—	%0,2	21 Eyl 2026
30İzleyin	CVE-2026-52741İstismar yok	GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pagesgocd · gocd · CWE-80 XSS	Yüksek7,5	—	%0,5	21 Eyl 2026
33İzleyin	CVE-2026-55071İstismar yok	MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`sepinetam · mcp-for-stata · CWE-94 RCE Komut enjeksiyonu	Yüksek8,4	—	%0,2	21 Eyl 2026
32İzleyin	CVE-2026-55074İstismar yok	Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)chofstede · ansible_jailexec · CWE-59 Kimlik doğrulamasız	Yüksek8,2	—	%0,4	21 Eyl 2026
31İzleyin	CVE-2026-55567İstismar yok	BleachBit: Exploit File Delete to Escalate Privilegebleachbit · bleachbit · CWE-367 Yerel yetki yükseltme Yarış durumu	Yüksek7,8	—	%0,1	21 Eyl 2026
32İzleyin	CVE-2026-61628Kavram kanıtı	nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Conditionlucasdillmann · nginx-ignition · CWE-362 Kimlik doğrulamasız Yarış durumu	Yüksek8,1	—	%0,4	21 Eyl 2026

CVE-2026-92807
35İzleyin
Save as PDF Plugin by PDFCrowd <= 4.6.1 - Authenticated (Contributor+) Arbitrary Function Invocation / Code Injection via 'pdf_created_callback' Shortcode Attri
YüksekCVSS 8,8İstismar yokEPSS %0
- RCE
pdfcrowd · save as pdf plugin by pdfcrowd18 Eyl 2026
CVE-2026-93741
37İzleyin
Totolink A3002MU formWlWds buffer overflow
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
totolink · a3002mu19 Eyl 2026
CVE-2026-76554
28İzleyin
WP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User Import
YüksekCVSS 7,2İstismar yokEPSS %0
unknown · wp import export lite19 Eyl 2026
CVE-2026-76790
28İzleyin
Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameter
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
unknown · estatik real estate plugin19 Eyl 2026
CVE-2026-85574
32İzleyin
Unbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unbounce_domains
YüksekCVSS 8,0İstismar yokEPSS %0
- Erişim denetimi (IDOR)
unknown · unbounce landing pages19 Eyl 2026
CVE-2026-85680
35İzleyin
Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
unknown · ultimate member19 Eyl 2026
CVE-2026-86591
39İzleyin
Botiga Pro < 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder REST Route
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
unknown · botiga pro19 Eyl 2026
CVE-2026-86814
32İzleyin
UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider Email
YüksekCVSS 8,1İstismar yokEPSS %0
- Kimlik doğrulamasız
unknown · userswp19 Eyl 2026
CVE-2026-88824
35İzleyin
Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label Settings
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
unknown · master blocks19 Eyl 2026
CVE-2026-88926
34İzleyin
VikRentItems Flexible Rental Management System < 1.2.4 - Unauthenticated SQLi
YüksekCVSS 8,6İstismar yokEPSS %0
- Kimlik doğrulamasız
- SQL enjeksiyonu
unknown · vikrentitems flexible rental management system19 Eyl 2026
CVE-2026-92099
26İzleyin
WPGraphQL Smart Cache < 2.3.2 - Unauthenticated Persisted Query Registration and Alias Squatting
OrtaCVSS 6,5Kavram kanıtıEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
unknown · wpgraphql smart cache19 Eyl 2026
CVE-2026-92404
30İzleyin
MgoSync 2.1.5 - 2.1.6 - Unauthenticated WooCommerce API Credential Disclosure
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bilgi sızıntısı
unknown · mgosync19 Eyl 2026
CVE-2026-15664
28İzleyin
Quill Forms | Conversational Multi Step Forms, Surveys & quizzes <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting via Multiple Choice 'Other' Value
YüksekCVSS 7,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
mdmag · quill forms | conversational multi step forms, surveys & quizzes19 Eyl 2026
CVE-2026-4327
35İzleyin
The Welcomizer <= 2.8.1 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via 'twiz_custom_logic' Parameter
YüksekCVSS 8,8İstismar yokEPSS %0
- RCE
sebwordpress · the welcomizer19 Eyl 2026
CVE-2026-85658
32İzleyin
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.2 - Authenticated (Subscriber+) Arbitrary Shortco
YüksekCVSS 8,1İstismar yokEPSS %0
- RCE
properfraction · paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress19 Eyl 2026
CVE-2026-1255
30İzleyin
YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Unauthenticated Information Disclosure in 'ysleadgen_get_captured_data' AJAX Action
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bilgi sızıntısı
ysinnovations · ys leadgen – popup builder, popup maker & form builder for wordpress | lead generation, email marketing, sales, conversions, opt-ins & subscribers19 Eyl 2026
CVE-2026-93742
35İzleyin
Totolink A3002MU formWsc command injection
YüksekCVSS 8,6İstismar yokEPSS %2
- RCE
- Komut enjeksiyonu
totolink · a3002mu19 Eyl 2026
CVE-2026-78030
39İzleyin
DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
19 Eyl 2026
CVE-2026-94000
26İzleyin
Keycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membership
OrtaCVSS 6,6Kavram kanıtıEPSS %0
- Erişim denetimi (IDOR)
red hat · red hat build of keycloak19 Eyl 2026
RUSTSEC-2026-0328
28İzleyin
`decompress`: tar-family extractors write archive entries without a path-traversal check (tar-slip)
YüksekCVSS 7,1İstismar yok
- Yol geçişi
19 Eyl 2026
CVE-2026-82560
30İzleyin
Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
19 Eyl 2026
CVE-2026-93985
37İzleyin
OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE
KritikCVSS 9,4İstismar yokEPSS %0
- RCE
openpanel-dev · openpanel19 Eyl 2026
CVE-2026-93991
33İzleyin
Argo Workflows 4.1.0 through 4.1.3 Cross-Namespace Disclosure via Negated Selector
YüksekCVSS 8,3İstismar yokEPSS %0
- Erişim denetimi (IDOR)
argoproj · argo-workflows19 Eyl 2026
CVE-2026-93992
28İzleyin
Gopeed through 2.0.0-beta.3 Arbitrary File Write via Path Traversal
YüksekCVSS 7,0İstismar yokEPSS %0
- Kimlik doğrulamasız
- Yol geçişi
gopeedlab · gopeed19 Eyl 2026
CVE-2026-93993
34İzleyin
Mistral Vibe before 2.25.5 Remote Code Execution via git post-checkout
YüksekCVSS 8,6İstismar yokEPSS %0
- Girişsiz RCE
mistralai · mistral-vibe19 Eyl 2026
CVE-2026-94056
30İzleyin
Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
exim · exim19 Eyl 2026
CVE-2026-93958
35İzleyin
D-Link R95 DHMAPI ssi system os command injection
YüksekCVSS 8,5Kavram kanıtıEPSS %2
- RCE
- Komut enjeksiyonu
d-link · r9519 Eyl 2026
CVE-2026-93988
28İzleyin
QloApps through 1.7.0 Arbitrary File Read via getEmailHTML
YüksekCVSS 7,1İstismar yokEPSS %0
- Yol geçişi
webkul · qloapps19 Eyl 2026
CVE-2026-93990
34İzleyin
Expat before 2.8.5 Malformed UTF-16 Acceptance via Unchecked Surrogate
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
libexpat · libexpat19 Eyl 2026
CVE-2026-86552
21İzleyin
A vulnerability that skips email ownership verification for account registration in ZTE SmartLife APP
OrtaCVSS 5,4Kavram kanıtıEPSS %0
zte · smartlife20 Eyl 2026
CVE-2026-86553
35İzleyin
A password reset vulnerability in ZTE SmartLife APP
YüksekCVSS 8,8İstismar yokEPSS %0
zte · smartlife20 Eyl 2026
CVE-2026-93964
22İzleyin
NginxProxyManager nginx-proxy-manager Validate Route certificate.js internalCertificate.validate missing authentication
OrtaCVSS 5,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
nginxproxymanager · nginx-proxy-manager20 Eyl 2026
CVE-2026-94083
37İzleyin
Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even th
KritikCVSS 9,4İstismar yokEPSS %0
- Kimlik doğrulamasız
oisf · suricata20 Eyl 2026
CVE-2026-94084
37İzleyin
Suricata before 8.0.7 has an Http2ThreadMultiBuf use-after-free when a transaction is inspected by rules that use http.response_header with
KritikCVSS 9,4İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
oisf · suricata20 Eyl 2026
CVE-2026-81650
28İzleyin
NextGEN Gallery < 4.5.0 - Authenticated Arbitrary File Upload via ZIP Import
YüksekCVSS 7,2İstismar yokEPSS %0
- RCE
- Dosya yükleme
unknown · photo gallery, sliders, proofing and themes20 Eyl 2026
CVE-2026-82842
32İzleyin
SAML Single Sign On < 6.0.0 - Unauthenticated Privilege Escalation via Account Matching
YüksekCVSS 8,1İstismar yokEPSS %0
- Kimlik doğrulamasız
unknown · saml single sign on20 Eyl 2026
CVE-2026-85017
30İzleyin
Unlimited Elements For Elementor < 2.0.20 - Subscriber+ PHP Object Injection
YüksekCVSS 7,5İstismar yokEPSS %0
- Deserializasyon
unknown · unlimited elements for elementor20 Eyl 2026
CVE-2026-87067
34İzleyin
Forminator Forms < 1.57.2.1 - Authenticated RCE via XML-RPC PHP Object Injection
YüksekCVSS 8,5İstismar yokEPSS %0
- RCE
unknown · forminator forms20 Eyl 2026
CVE-2026-87839
30İzleyin
Tripzzy < 1.5.1 - Unauthenticated Arbitrary Comment Deletion
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
unknown · tripzzy20 Eyl 2026
CVE-2026-92540
28İzleyin
Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via caller_can_promote_users
YüksekCVSS 7,2İstismar yokEPSS %0
unknown · import and export users and customers20 Eyl 2026
CVE-2026-92541
28İzleyin
Import and export users and customers < 2.5.2 - Custom Role Privilege Escalation to Administrator via Frontend Importer
YüksekCVSS 7,2İstismar yokEPSS %0
unknown · import and export users and customers20 Eyl 2026
CVE-2026-94003
37İzleyin
Comfast CF-N1-S Web Management mbox-config get_css_path_from_uri stack-based overflow
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
comfast · cf-n1-s20 Eyl 2026
CVE-2026-94104
34İzleyin
NivoCart through 2.4.0 Arbitrary File Upload RCE via filemanager
YüksekCVSS 8,7İstismar yokEPSS %0
- RCE
- Dosya yükleme
nivocart · nivocart20 Eyl 2026
CVE-2026-94106
34İzleyin
getID3 before 1.9.26 OS Command Injection via Unescaped Filenames
YüksekCVSS 8,7İstismar yokEPSS %1
- RCE
- Komut enjeksiyonu
james-heinrich · getid320 Eyl 2026
CVE-2026-94107
36İzleyin
NivoCart through 2.4.0 Predictable Administrator Password Reset Token
KritikCVSS 9,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- Zayıf kripto
nivocart · nivocart20 Eyl 2026
CVE-2026-94108
33İzleyin
getID3 through 1.9.26 XML External Entity Injection via XML2array
YüksekCVSS 8,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- SSRF
- XXE
james-heinrich · getid320 Eyl 2026
CVE-2026-94111
27İzleyin
Tencent BrowserSkill through 0.3.0 Origin Validation Error in Local WebSocket Daemon
OrtaCVSS 6,9İstismar yokEPSS %0
- Kimlik doğrulama atlatma
tencent · browserskill20 Eyl 2026
CVE-2026-94112
30İzleyin
mayswind ezBookkeeping before 2.0.0 TOTP Replay Attack
YüksekCVSS 7,6İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
mayswind · ezbookkeeping20 Eyl 2026
CVE-2026-94113
28İzleyin
Frappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints
YüksekCVSS 7,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
frappe · erpnext20 Eyl 2026
CVE-2026-90817
40Planlayın
An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in whic
KritikCVSS 9,8Kavram kanıtıEPSS %3
- Girişsiz RCE
- Yol geçişi
vanderbilt university · redcap20 Eyl 2026
CVE-2026-94036
29İzleyin
D-Link DIR-X1860/DIR-X1860Z routerd ubus access control
YüksekCVSS 7,4Kavram kanıtıEPSS %0
- Kimlik doğrulamasız
d-link · dir-x186020 Eyl 2026
CVE-2026-94109
34İzleyin
openEQUELLA < 2026.1.0 Authenticated Stored SSTI via FreemarkerPortletRenderer
YüksekCVSS 8,6İstismar yokEPSS %0
- RCE
- SSTI
openequella · openequella20 Eyl 2026
CVE-2026-88854
37İzleyin
Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
KritikCVSS 9,3Kavram kanıtıEPSS %0
- Kimlik doğrulamasız
- SQL enjeksiyonu
ordasoft.com · ordasoft joomla gallery free extension for joomla20 Eyl 2026
CVE-2026-88855
34İzleyin
Joomla Extension - OrdaSoft.com - Authenticated, Privileged SQL Injection in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
YüksekCVSS 8,6İstismar yokEPSS %0
- SQL enjeksiyonu
ordasoft.com · ordasoft joomla gallery free extension for joomla20 Eyl 2026
CVE-2026-88856
37İzleyin
Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
KritikCVSS 9,4İstismar yokEPSS %0
- RCE
ordasoft.com · ordasoft joomla gallery free extension for joomla20 Eyl 2026
CVE-2026-88857
37İzleyin
Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
KritikCVSS 9,4İstismar yokEPSS %0
- RCE
- Dosya yükleme
ordasoft.com · ordasoft joomla gallery free extension for joomla20 Eyl 2026
CVE-2026-94089
37İzleyin
D-Link DIR-868L Authentication webfa_authentication.cgi strcpy stack-based overflow
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
d-link · dir-868l20 Eyl 2026
CVE-2026-94095
35İzleyin
Netcore NBR200V2 Traceroute Diagnostic Feature network_tools command injection
YüksekCVSS 8,6Kavram kanıtıEPSS %2
- RCE
- Komut enjeksiyonu
netcore · nbr200v220 Eyl 2026
CVE-2026-94096
35İzleyin
Netcore NBR200V2 LAN IP Configuration network_tools command injection
YüksekCVSS 8,6İstismar yokEPSS %1
- RCE
- Komut enjeksiyonu
netcore · nbr200v220 Eyl 2026
CVE-2026-94097
38İzleyin
Netcore NBR200V2 CGI Diagnostic Endpoint network_tools command injection
KritikCVSS 9,3İstismar yokEPSS %2
- Girişsiz RCE
- Komut enjeksiyonu
netcore · nbr200v220 Eyl 2026
CVE-2026-94098
35İzleyin
Netcore NBR200V2 Firmware Upgrade CGI Endpoint upgrade command injection
YüksekCVSS 8,5İstismar yokEPSS %2
- RCE
- Komut enjeksiyonu
netcore · nbr200v220 Eyl 2026
CVE-2026-94099
35İzleyin
Netcore NBR200V2 Backup Restore restore.cgi command injection
YüksekCVSS 8,6İstismar yokEPSS %1
- RCE
- Komut enjeksiyonu
netcore · nbr200v220 Eyl 2026
CVE-2026-94100
34İzleyin
Netcore NBR200V2 WAN VLAN Reconfiguration routerd wan_config_set_vlan buffer overflow
YüksekCVSS 8,6İstismar yokEPSS %0
- Bellek hatası
netcore · nbr200v220 Eyl 2026
CVE-2026-94101
34İzleyin
Netcore NBR200V2 routerd vlan_load_form_uci buffer overflow
YüksekCVSS 8,6İstismar yokEPSS %0
- Bellek hatası
netcore · nbr200v220 Eyl 2026
CVE-2026-94128
34İzleyin
BioStar VIVID LED DJ IOCTL BS_LED64.sys sub_1105C write-what-where
YüksekCVSS 8,5Kavram kanıtıEPSS %0
- Bellek hatası
biostar · vivid led dj20 Eyl 2026
CVE-2026-94129
34İzleyin
BioStar VALKYRIE AURORA IOCTL BS_RVSIO64.sys sub_1105C write-what-where
YüksekCVSS 8,5Kavram kanıtıEPSS %0
- Bellek hatası
biostar · valkyrie aurora20 Eyl 2026
CVE-2026-94142
34İzleyin
BioStar Temperature Monitor Utility IOCTL BS_HWMIO64_W10.sys sub_1105C write-what-where
YüksekCVSS 8,5İstismar yokEPSS %0
- Bellek hatası
biostar · temperature monitor utility21 Eyl 2026
CVE-2026-82187
39İzleyin
WooCommerce Online Product Designer 1.7.0 - < 2.15.0 - Unauthenticated Arbitrary File Upload
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Dosya yükleme
unknown · web to print online designer21 Eyl 2026
CVE-2026-90860
28İzleyin
The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebVie
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
canva · canva21 Eyl 2026
CVE-2026-94146
34İzleyin
BioStar BIOS Update Utility IOCTL BSMEM64_W10.sys sub_110BC write-what-where
YüksekCVSS 8,5İstismar yokEPSS %0
- Bellek hatası
biostar · bios update utility21 Eyl 2026
CVE-2026-47321
30İzleyin
Apache MINA: Unbounded Decompression Amplification DoS in Zlib.inflate
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
apache software foundation · apache mina21 Eyl 2026
CVE-2026-15801
32İzleyin
Cri-o: cri-o: insufficient validation during container checkpoint restore
YüksekCVSS 8,0İstismar yokEPSS %0
- Yol geçişi
red hat · red hat openshift container platform 421 Eyl 2026
CVE-2026-16651
34İzleyin
temporalio/sqlparser malformed MySQL version comments can cause a panic
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
temporal technologies, inc. · temporalio/sqlparser21 Eyl 2026
CVE-2026-16652
28İzleyin
Temporal Server Schedule exclusion search can cause excessive CPU consumption
YüksekCVSS 7,1İstismar yokEPSS %0
temporal technologies, inc. · temporal server21 Eyl 2026
CVE-2026-65651
34İzleyin
temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
temporal technologies, inc. · temporalio/sqlparser21 Eyl 2026
CVE-2026-65652
34İzleyin
temporalio/tchannel-go malformed checksum type causes process termination
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
temporal technologies, inc. · temporalio/tchannel-go21 Eyl 2026
CVE-2026-65653
34İzleyin
temporalio/tchannel-go zero-chunk call fragment causes process termination
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
temporal technologies, inc. · temporalio/tchannel-go21 Eyl 2026
CVE-2026-65654
34İzleyin
temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossip
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
temporal technologies, inc. · temporalio/ringpop-go21 Eyl 2026
CVE-2026-87858
28İzleyin
Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization
YüksekCVSS 7,2İstismar yokEPSS %0
temporal technologies, inc. · temporal server21 Eyl 2026
CVE-2026-89139
34İzleyin
Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host
YüksekCVSS 8,7İstismar yokEPSS %0
- RCE
- Komut enjeksiyonu
temporal technologies, inc. · temporal server21 Eyl 2026
CVE-2026-91863
30İzleyin
Apache Neethi: Uncontrolled recursion while parsing crafted WS-Policy documents allows denial of service
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
apache · neethi21 Eyl 2026
CVE-2026-91864
30İzleyin
Apache Neethi: Crafted WS-Policy documents bypass element/attribute limits causing memory exhaustion
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
apache · neethi21 Eyl 2026
CVE-2026-91865
30İzleyin
Apache Neethi: Crafted policy references cause exponential expansion during normalization leading to denial of service
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
apache · neethi21 Eyl 2026
CVE-2026-91866
30İzleyin
Apache Neethi: Crafted policies cause unbounded work during intersection leading to denial of service
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
apache · neethi21 Eyl 2026
CVE-2026-94368
28İzleyin
Noobaa-core: noobaa-core: presigned put url escalation to copyobject via unsigned x-amz-copy-source header
YüksekCVSS 7,1İstismar yokEPSS %0
- Zayıf kripto
red hat · red hat openshift data foundation 421 Eyl 2026
CVE-2025-12999
36İzleyin
UrlUtil.getBaseUrl builds the absolute URLs in a response — download links, icons, asset and API URLs — from the X-Forwarded-Host, X-Forward
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
eclipse foundation · eclipse open vsx21 Eyl 2026
CVE-2026-84285
36İzleyin
OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.3 through 17.5
YüksekCVSS 8,8İstismar yokEPSS %1
- RCE
- Komut enjeksiyonu
dassault systèmes · tuleap enterprise edition21 Eyl 2026
CVE-2026-94374
33İzleyin
MISP: IDOR via Client-Supplied Report ID in Module Results Processing Allows Reparenting and Overwriting of Other Events' Reports
YüksekCVSS 8,3İstismar yokEPSS %0
- Erişim denetimi (IDOR)
misp · misp21 Eyl 2026
CVE-2026-94381
34İzleyin
MISP Privilege Escalation: Read-Only API Key User Can Regain Full Role via updateLoginTime
YüksekCVSS 8,7İstismar yokEPSS %0
misp · misp21 Eyl 2026
CVE-2026-94383
34İzleyin
MISP Blocklist Workflow Module: Arbitrary Script Execution via Unrestricted File Extension
YüksekCVSS 8,6İstismar yokEPSS %0
- RCE
misp · misp21 Eyl 2026
CVE-2026-92574
35İzleyin
Cri-o: cri-o checkpoint restore bypasses destination security context
YüksekCVSS 8,8İstismar yokEPSS %0
red hat · confidential compute attestation21 Eyl 2026
CVE-2026-88806
30İzleyin
libX11 XkbGetMap Reply Heap-based Buffer Overflow
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
x.org · libx1121 Eyl 2026
CVE-2026-88807
35İzleyin
libXrender RenderQueryPictFormats Reply Heap-based Buffer Overflow
YüksekCVSS 8,9İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
x.org · libxrender21 Eyl 2026
CVE-2026-94401
33İzleyin
MISP Arbitrary Local File Read and SSRF via MISP Export Upload
YüksekCVSS 8,3İstismar yokEPSS %0
- SSRF
- Yol geçişi
misp · misp21 Eyl 2026
CVE-2026-94404
28İzleyin
MISP CSRF vulnerability allows unauthorized attribute modification
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- CSRF
misp · misp21 Eyl 2026
CVE-2026-52741
30İzleyin
GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages
YüksekCVSS 7,5İstismar yokEPSS %0
- XSS
gocd · gocd21 Eyl 2026
CVE-2026-55071
33İzleyin
MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`
YüksekCVSS 8,4İstismar yokEPSS %0
- RCE
- Komut enjeksiyonu
sepinetam · mcp-for-stata21 Eyl 2026
CVE-2026-55074
32İzleyin
Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)
YüksekCVSS 8,2İstismar yokEPSS %0
- Kimlik doğrulamasız
chofstede · ansible_jailexec21 Eyl 2026
CVE-2026-55567
31İzleyin
BleachBit: Exploit File Delete to Escalate Privilege
YüksekCVSS 7,8İstismar yokEPSS %0
- Yerel yetki yükseltme
- Yarış durumu
bleachbit · bleachbit21 Eyl 2026
CVE-2026-61628
32İzleyin
nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition
YüksekCVSS 8,1Kavram kanıtıEPSS %0
- Kimlik doğrulamasız
- Yarış durumu
lucasdillmann · nginx-ignition21 Eyl 2026