İçeriğe atla
Noroxi

Yayın tarihine göre

Eylül 2026: sömürülen ve yeni ciddi CVE kayıtları

7.959 kayıt · 32 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 59 / 80

  • CVE-2026-61629
    30İzleyin

    nginx ignition has ParseAcceptLanguage `_` separator bypass that enables ~75x CPU amplification via Accept-Language header in i18nMiddleware

    YüksekCVSS 7,5İstismar yokEPSS %0

    lucasdillmann · nginx-ignition21 Eyl 2026

  • CVE-2026-68919
    28İzleyin

    GoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pages

    YüksekCVSS 7,0İstismar yokEPSS %0

    gocd · gocd21 Eyl 2026

  • CVE-2026-71543
    30İzleyin

    OpenBao's Templated Policies Allow Privilege Escalation via Wildcard Characters

    YüksekCVSS 7,5İstismar yokEPSS %0

    openbao · openbao21 Eyl 2026

  • CVE-2026-86473
    36İzleyin

    Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry

    KritikCVSS 9,1İstismar yokEPSS %0

    apache · airflow21 Eyl 2026

  • CVE-2026-94301
    39İzleyin

    Apache MINA: CVE-2026-47065 resolveProxyClass fix missing from 2.0.X and 2.1.X branches (2.0.30 / 2.1.14) ZDRES-232

    KritikCVSS 9,8İstismar yokEPSS %0

    apache software foundation · apache mina21 Eyl 2026

  • CVE-2026-36467
    28İzleyin

    Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access

    YüksekCVSS 7,2İstismar yokEPSS %0

    21 Eyl 2026

  • CVE-2026-36469
    36İzleyin

    CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery (SSRF) in core/modules/media.php -- upload_from_inet (Media Manager's "Upload

    KritikCVSS 9,1İstismar yokEPSS %0

    21 Eyl 2026

  • CVE-2026-53940
    35İzleyin

    Conda: Entry-point path traversal in noarch:python install (arbitrary file write) — canonical Python implementation

    YüksekCVSS 8,8İstismar yokEPSS %0

    conda · conda21 Eyl 2026

  • CVE-2026-55563
    35İzleyin

    Feast: `pull_request_target` integration tests run untrusted fork code with production cloud secrets; the `ok-to-test` label guard is bypassable via label persi

    YüksekCVSS 8,9İstismar yokEPSS %0

    feast-dev · feast21 Eyl 2026

  • CVE-2026-61687
    28İzleyin

    hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

    YüksekCVSS 7,1İstismar yokEPSS %0

    hatchet-dev · hatchet21 Eyl 2026

  • CVE-2026-82412
    35İzleyin

    ntopng: Remote Code Execution via OS Command Injection in Vulnerability-Scan REST API

    YüksekCVSS 8,8İstismar yokEPSS %0

    ntop · ntopng21 Eyl 2026

  • CVE-2026-85751
    39İzleyin

    Mailu: Authentication bypass in header-based proxy authentication via spoofable `X-Forwarded-By` trust

    KritikCVSS 9,8İstismar yokEPSS %0

    mailu · mailu21 Eyl 2026

  • CVE-2026-61674
    36İzleyin

    Fluent Bit: Remote stack buffer overflow in Fluent Bit `out_forward` Secure-Forward `PONG` handler

    KritikCVSS 9,2İstismar yokEPSS %0

    fluent · fluent-bit21 Eyl 2026

  • CVE-2026-62371
    35İzleyin

    KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API

    YüksekCVSS 8,8İstismar yokEPSS %0

    kubeedge · kubeedge21 Eyl 2026

  • CVE-2026-63116
    35İzleyin

    deepstream: PATCH_MULTI action bypasses Valve permission system allowing unauthorized record writes

    YüksekCVSS 8,8İstismar yokEPSS %0

    deepstreamio · deepstream.io21 Eyl 2026

  • CVE-2026-76898
    30İzleyin

    draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js

    YüksekCVSS 7,7İstismar yokEPSS %0

    jgraph · drawio21 Eyl 2026

  • CVE-2026-77560
    32İzleyin

    Tinyauth: forward-auth per-app ACL is matched case-sensitively against the (case-insensitive) hostname, letting an authenticated user reach apps they are not on

    YüksekCVSS 8,1İstismar yokEPSS %0

    tinyauthapp · tinyauth21 Eyl 2026

  • CVE-2026-79920
    39İzleyin

    Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task

    KritikCVSS 9,9İstismar yokEPSS %0

    ajenti · ajenti21 Eyl 2026

  • CVE-2026-83621
    32İzleyin

    ntopng: Missing Authorization Check in REST API Allows Non-Admin Users to Tamper Threat Intelligence Blacklist URLs

    YüksekCVSS 8,1İstismar yokEPSS %0

    ntop · ntopng21 Eyl 2026

  • CVE-2026-48826
    32İzleyin

    HomeBox: Cross-Group Inventory Wipe in Homebox via Global Owner Role and X-Tenant Header Switching

    YüksekCVSS 8,1İstismar yokEPSS %0

    sysadminsmedia · homebox21 Eyl 2026

  • CVE-2026-48975
    32İzleyin

    HomeBox: Cross-Tenant IDOR in MaintenanceEntry Update and Delete Allows Tampering and Destruction of Any User's Maintenance History in Homebox

    YüksekCVSS 8,1İstismar yokEPSS %0

    sysadminsmedia · homebox21 Eyl 2026

  • CVE-2026-48976
    32İzleyin

    HomeBox: Cross-Tenant IDOR in Notifier Update Leaks Shoutrrr Credentials and Allows Webhook Hijack

    YüksekCVSS 8,1İstismar yokEPSS %0

    sysadminsmedia · homebox21 Eyl 2026

  • CVE-2026-62182
    35İzleyin

    KubeEdge: ConfigUpdateJob updateFields enables remote shell injection and code execution on edge nodes

    YüksekCVSS 8,8İstismar yokEPSS %0

    kubeedge · kubeedge21 Eyl 2026

  • CVE-2026-62369
    32İzleyin

    KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join

    YüksekCVSS 8,1İstismar yokEPSS %0

    kubeedge · kubeedge21 Eyl 2026

  • CVE-2025-71421
    34İzleyin

    UVdesk core-framework before 1.1.7 Privilege Escalation via editAgent

    YüksekCVSS 8,6İstismar yokEPSS %0

    uvdesk · core-framework21 Eyl 2026

  • CVE-2026-93012
    39İzleyin

    Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envelope address reaches

    KritikCVSS 9,8İstismar yokEPSS %0

    21 Eyl 2026

  • CVE-2026-94488
    33İzleyin

    Telegram Desktop before 6.9.4 allows XSS in the HTML exporter.

    YüksekCVSS 8,3İstismar yokEPSS %0

    telegram · telegram desktop21 Eyl 2026

  • CVE-2026-17052
    31İzleyin

    Missing user-pointer validation in tgpio_pin_read_ts_ec syscall handler allows arbitrary supervisor-memory write from userspace

    YüksekCVSS 7,8İstismar yokEPSS %0

    zephyrproject · zephyr21 Eyl 2026

  • CVE-2026-49810
    31İzleyin

    Dell Command Powershell Provider (DCPP), versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log File vulnerability.

    YüksekCVSS 7,8İstismar yokEPSS %0

    dell · command powershell provider (dcpp)21 Eyl 2026

  • CVE-2026-58491
    37İzleyin

    Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter

    KritikCVSS 9,3İstismar yokEPSS %0

    warp-tech · warpgate21 Eyl 2026

  • CVE-2026-94403
    34İzleyin

    ColorFul iGameCenter IOCTL ene.sys sub_140001AF0 untrusted pointer dereference

    YüksekCVSS 8,5İstismar yokEPSS %0

    colorful · igamecenter21 Eyl 2026

  • CVE-2026-94411
    34İzleyin

    jshERP 3.6 Privilege Escalation via updateOneValueByKeyIdAndType

    YüksekCVSS 8,7İstismar yokEPSS %0

    jishenghua · jsherp21 Eyl 2026

  • CVE-2026-94412
    34İzleyin

    jshERP through 3.6 Authorization Bypass via resetPwd

    YüksekCVSS 8,7İstismar yokEPSS %0

    jishenghua · jsherp21 Eyl 2026

  • CVE-2026-94413
    28İzleyin

    jshERP through 3.6 Password Hash Disclosure via /user/info

    YüksekCVSS 7,1İstismar yokEPSS %0

    jishenghua · jsherp21 Eyl 2026

  • CVE-2026-94495
    28İzleyin

    jshERP through 3.6 Missing Authorization via systemConfig

    YüksekCVSS 7,1İstismar yokEPSS %0

    jishenghua · jsherp21 Eyl 2026

  • CVE-2026-94496
    34İzleyin

    jshERP through 3.6 Privilege Escalation via Role Management

    YüksekCVSS 8,7İstismar yokEPSS %0

    jishenghua · jsherp21 Eyl 2026

  • CVE-2026-94497
    34İzleyin

    jshERP through 3.6 Unauthorized Access via by-id Endpoints

    YüksekCVSS 8,7İstismar yokEPSS %0

    jishenghua · jsherp21 Eyl 2026

  • CVE-2026-94501
    34İzleyin

    jshERP through 3.6 Privilege Escalation via userBusiness CRUD

    YüksekCVSS 8,7İstismar yokEPSS %0

    jishenghua · jsherp21 Eyl 2026

  • CVE-2026-75939
    29İzleyin

    Openshift/oc-mirror: release signature verification: openpgp signatureerror checked before signed body is consumed

    YüksekCVSS 7,4İstismar yokEPSS %0

    red hat · red hat openshift container platform 421 Eyl 2026

  • CVE-2026-80110
    32İzleyin

    Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpoint

    YüksekCVSS 8,1İstismar yokEPSS %0

    red hat · red hat certificate system 921 Eyl 2026

  • CVE-2026-49811
    33İzleyin

    Dell Command | Monitor (DCM), versions prior to 10.13.2, contain an Incorrect Permission Assignment for Critical Resource vulnerability.

    YüksekCVSS 8,4İstismar yokEPSS %0

    dell · command | monitor (dcm)21 Eyl 2026

  • CVE-2026-52835
    28İzleyin

    Tautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_database

    YüksekCVSS 7,0İstismar yokEPSS %0

    tautulli · tautulli21 Eyl 2026

  • CVE-2026-55897
    35İzleyin

    luci-app-advanced-reboot read ACL exposes /bin/sh through file.exec, allowing delegated users to run commands as root

    YüksekCVSS 8,8İstismar yokEPSS %0

    openwrt · luci21 Eyl 2026

  • CVE-2026-58269
    32İzleyin

    Sync-in Server has a complete 2FA Bypass via `POST /api/auth/token`

    YüksekCVSS 8,1İstismar yokEPSS %0

    sync-in · server21 Eyl 2026

  • CVE-2026-81469
    31İzleyin

    Dell Inventory Collector Client, versions prior to 15.0.0, contain an Unquoted Search Path or Element vulnerability.

    YüksekCVSS 7,8İstismar yokEPSS %0

    dell · inventory collector client21 Eyl 2026

  • CVE-2026-49450
    28İzleyin

    Joplin desktop Windows auto-updater accepts signed installer from any publisher because app-update.yml has no publisherName

    YüksekCVSS 7,1İstismar yokEPSS %0

    laurent22 · joplin21 Eyl 2026

  • CVE-2026-49453
    28İzleyin

    Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory

    YüksekCVSS 7,0İstismar yokEPSS %0

    laurent22 · joplin21 Eyl 2026

  • CVE-2026-55105
    30İzleyin

    Joplin: Fountain embeds allow arbitrary script execution in published notes and the note viewer

    YüksekCVSS 7,7İstismar yokEPSS %0

    laurent22 · joplin21 Eyl 2026

  • CVE-2026-61647
    28İzleyin

    @roomi-fields/notebooklm-mcp has path traversal in vault.batch tool that allows arbitrary file write outside intended vault directory

    YüksekCVSS 7,1İstismar yokEPSS %0

    roomi-fields · notebooklm-mcp21 Eyl 2026

  • CVE-2026-67827
    39İzleyin

    Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 allows remote attackers to achieve Remote Code Execution (RCE)

    KritikCVSS 9,8İstismar yokEPSS %0

    21 Eyl 2026

  • CVE-2026-77521
    40Planlayın

    MaxKB: Prompt-injectable agent can lead to command execution

    KritikCVSS 10,0Kavram kanıtıEPSS %1

    1panel-dev · maxkb21 Eyl 2026

  • CVE-2026-77523
    29İzleyin

    MaxKB: Cross-workspace model parameter form write

    YüksekCVSS 7,4İstismar yokEPSS %0

    1panel-dev · maxkb21 Eyl 2026

  • CVE-2026-79316
    30İzleyin

    An improper access control vulnerability exists in x-ui 0.3.2.

    YüksekCVSS 7,6İstismar yokEPSS %0

    21 Eyl 2026

  • CVE-2026-79916
    36İzleyin

    MaxKB AWS Bedrock model credential injection leads to remote code execution

    KritikCVSS 9,1İstismar yokEPSS %0

    1panel-dev · maxkb21 Eyl 2026

  • CVE-2026-88402
    39İzleyin

    A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via inje

    KritikCVSS 9,8İstismar yokEPSS %0

    21 Eyl 2026

  • CVE-2026-88404
    39İzleyin

    A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/services/script-execution.service.ts) of U

    KritikCVSS 9,8İstismar yokEPSS %0

    21 Eyl 2026

  • CVE-2026-88405
    39İzleyin

    A remote code execution (RCE) vulnerability in the RemoteRegisterFunctionService function (/remote/remote-register-function.service.ts) of U

    KritikCVSS 9,8İstismar yokEPSS %0

    21 Eyl 2026

  • CVE-2026-88406
    30İzleyin

    FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _ValidateUnion_Clauses function (/ast/ast_valid

    YüksekCVSS 7,5İstismar yokEPSS %0

    21 Eyl 2026

  • CVE-2026-88407
    30İzleyin

    An out-of-bounds read in the node_token_count/relation_token_count component of FalkorDB (Redis module) v4.20.1 to v4.20.4 allows attackers

    YüksekCVSS 7,5İstismar yokEPSS %0

    21 Eyl 2026

  • CVE-2026-88409
    35İzleyin

    FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the _Decode_GrB_Matrix function (/v19/decode_matri

    YüksekCVSS 8,8İstismar yokEPSS %0

    21 Eyl 2026

  • CVE-2026-88410
    28İzleyin

    The graph.UDF in FalkorDB (Redis module) v4.20.1 to v4.20.4 is not registered as a write command, leading to unexpected behavior within the

    YüksekCVSS 7,1İstismar yokEPSS %0

    21 Eyl 2026

  • CVE-2026-88411
    30İzleyin

    Improper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c) of FalkorDB (Redis module) v4.20.1 leads to a Denial of Ser

    YüksekCVSS 7,5İstismar yokEPSS %0

    21 Eyl 2026

  • CVE-2026-88746
    28İzleyin

    idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php.

    YüksekCVSS 7,1İstismar yokEPSS %0

    21 Eyl 2026

  • CVE-2026-94424
    37İzleyin

    Moore Threads MTT S80 Driver Package IOCTL mtdispkm64.sys sub_140001000 heap-based overflow

    KritikCVSS 9,3İstismar yokEPSS %0

    moore threads · mtt s80 driver package21 Eyl 2026

  • CVE-2026-94571
    37İzleyin

    In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect

    KritikCVSS 9,4İstismar yokEPSS %0

    openstack · octavia21 Eyl 2026

  • CVE-2026-94572
    37İzleyin

    In OpenStack Octavia before 18.0.1, the Amphora provider driver did not validate the listener and pool tls_ciphers field for control charact

    KritikCVSS 9,4İstismar yokEPSS %0

    openstack · octavia21 Eyl 2026

  • CVE-2026-84990
    35İzleyin

    ntopng: Missing Authorization on System Configuration Backup Download and Listing

    YüksekCVSS 8,8İstismar yokEPSS %0

    ntop · ntopng21 Eyl 2026

  • CVE-2026-94449
    30İzleyin

    Quarkus-smallrye-fault-tolerance: quarkus-smallrye-fault-tolerance: memory leak in @applyguard leads to denial of service

    YüksekCVSS 7,5İstismar yokEPSS %0

    red hat · exploit intelligence21 Eyl 2026

  • CVE-2026-55210
    29İzleyin

    Joplin: SAML SSO account takeover via email-based account linking (missing is_external check in ssoLogin)

    YüksekCVSS 7,4İstismar yokEPSS %0

    laurent22 · joplin21 Eyl 2026

  • CVE-2026-59814
    30İzleyin

    Joplin: Stored XSS via inline-served note attachment on published shares

    YüksekCVSS 7,6İstismar yokEPSS %0

    laurent22 · joplin21 Eyl 2026

  • CVE-2026-61652
    34İzleyin

    Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory (decompression bomb)

    YüksekCVSS 8,7İstismar yokEPSS %0

    kap-sh · zapros21 Eyl 2026

  • CVE-2026-78847
    39İzleyin

    An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter w

    KritikCVSS 9,8İstismar yokEPSS %0

    21 Eyl 2026

  • CVE-2026-79079
    31İzleyin

    An issue in CrossWire Xiphos <= 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menu_popup.c com

    YüksekCVSS 7,8İstismar yokEPSS %0

    21 Eyl 2026

  • CVE-2026-88738
    35İzleyin

    Jazzware RT1000 Edge webUI v.

    YüksekCVSS 8,8İstismar yokEPSS %0

    21 Eyl 2026

  • CVE-2026-93340
    29İzleyin

    Gladys Assistant < 5.1.0 Password Reset Link Poisoning via forgot_password Endpoint

    YüksekCVSS 7,4İstismar yokEPSS %0

    gladys assistant · gladys assistant21 Eyl 2026

  • CVE-2026-94532
    28İzleyin

    lamp-cloud through 5.10.0 Unauthorized User Profile Access via getUserInfoById

    YüksekCVSS 7,1İstismar yokEPSS %0

    dromara · lamp-cloud21 Eyl 2026

  • CVE-2026-94533
    28İzleyin

    lamp-cloud through 5.10.0 Unauthorized File Download via /anyone/file

    YüksekCVSS 7,1İstismar yokEPSS %0

    dromara · lamp-cloud21 Eyl 2026

  • CVE-2026-94534
    28İzleyin

    lamp-cloud through 5.10.0 Unauthorized Profile Modification via PUT endpoints

    YüksekCVSS 7,1İstismar yokEPSS %0

    dromara · lamp-cloud21 Eyl 2026

  • CVE-2026-94535
    28İzleyin

    lamp-cloud through 5.10.0 Unauthorized Notification Deletion

    YüksekCVSS 7,1İstismar yokEPSS %0

    dromara · lamp-cloud21 Eyl 2026

  • CVE-2026-94540
    29İzleyin

    DesktopSMS 1.11.0 Unauthorized Access via Local Service

    YüksekCVSS 7,4İstismar yokEPSS %0

    mrpear · desktopsms21 Eyl 2026

  • CVE-2026-94425
    37İzleyin

    Moore Threads MTT S80 Driver Package IOCTL mtdispkm64.sys sub_140006F0C privileges management

    KritikCVSS 9,3İstismar yokEPSS %0

    moore threads · mtt s80 driver package21 Eyl 2026

  • CVE-2026-63330
    30İzleyin

    Warpgate: Missing Admin Authorization on Live Recording Stream WebSocket Allows Any Authenticated User to Eavesdrop on Terminal Sessions

    YüksekCVSS 7,7İstismar yokEPSS %0

    warp-tech · warpgate21 Eyl 2026

  • CVE-2026-55159
    35İzleyin

    luci-app-adblock-fast: Delegated `luci-app-adblock-fast` users can reach root command execution by injecting newline-separated cron entries

    YüksekCVSS 8,8İstismar yokEPSS %0

    openwrt · luci-app-adblock-fast21 Eyl 2026

  • CVE-2026-73512
    30İzleyin

    Envoy: use-after-free in QUIC on internal redirects

    YüksekCVSS 7,5İstismar yokEPSS %0

    envoyproxy · envoy21 Eyl 2026

  • CVE-2026-73513
    30İzleyin

    Envoy: oghttp2 upstream trailers incorrect handling

    YüksekCVSS 7,5İstismar yokEPSS %0

    envoyproxy · envoy21 Eyl 2026

  • CVE-2026-73546
    29İzleyin

    Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)

    YüksekCVSS 7,4İstismar yokEPSS %0

    envoyproxy · envoy21 Eyl 2026

  • CVE-2026-73547
    30İzleyin

    Envoy ext_authz: request `:path` pseudoheader dereferenced w/o null check

    YüksekCVSS 7,5İstismar yokEPSS %0

    envoyproxy · envoy21 Eyl 2026

  • CVE-2026-73548
    30İzleyin

    Envoy: Cross-user response poisoning via a generic (non-WebSocket) HTTP upgrade on Envoy's shared backend pool

    YüksekCVSS 7,5İstismar yokEPSS %0

    envoyproxy · envoy21 Eyl 2026

  • CVE-2026-73550
    30İzleyin

    Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy

    YüksekCVSS 7,5İstismar yokEPSS %0

    envoyproxy · envoy21 Eyl 2026

  • CVE-2026-73552
    30İzleyin

    Envoy: HTTP RBAC safe_regex can fail open on RFC-valid obs-text header values

    YüksekCVSS 7,5İstismar yokEPSS %0

    envoyproxy · envoy21 Eyl 2026

  • CVE-2026-93710
    30İzleyin

    Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks

    YüksekCVSS 7,5İstismar yokEPSS %0

    21 Eyl 2026

  • CVE-2026-93712
    30İzleyin

    Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside public_dir via relative path segments in the File route handler

    YüksekCVSS 7,5İstismar yokEPSS %0

    21 Eyl 2026

  • CVE-2026-94493
    37İzleyin

    Gigatech PDV5701 WebSocket Service index.html missing authentication

    KritikCVSS 9,3İstismar yokEPSS %0

    gigatech · pdv570121 Eyl 2026

  • CVE-2026-46649
    36İzleyin

    Joplin: SSO Auth Code Login Missing Rate Limiting — 9-Digit Numeric Code Brute-Forceable via Unprotected Endpoint

    KritikCVSS 9,1İstismar yokEPSS %0

    laurent22 · joplin21 Eyl 2026

  • CVE-2026-73553
    30İzleyin

    Envoy: RBAC Authorization Bypass via Path Parameters

    YüksekCVSS 7,5İstismar yokEPSS %0

    envoyproxy · envoy21 Eyl 2026

  • CVE-2026-65980
    31İzleyin

    Chartbrew: SQL Injection via Missing Backslash Escaping in ClickHouse Variable Substitution

    YüksekCVSS 7,9İstismar yokEPSS %0

    chartbrew · chartbrew21 Eyl 2026

  • CVE-2026-94622
    34İzleyin

    vLLM through 0.29.0 Denial of Service via Incomplete NIXL KV Transfer Metadata

    YüksekCVSS 8,7İstismar yokEPSS %0

    vllm · vllm21 Eyl 2026

  • CVE-2026-94623
    34İzleyin

    vLLM through 0.29.0 Denial of Service via NIXL Multi-Prompt Assertion Failure

    YüksekCVSS 8,7İstismar yokEPSS %0

    vllm · vllm21 Eyl 2026

  • CVE-2026-94624
    34İzleyin

    vLLM through 0.29.0 Denial of Service via Unbounded P2P KV Offloading Sessions

    YüksekCVSS 8,7İstismar yokEPSS %0

    vllm · vllm21 Eyl 2026

  • CVE-2026-94626
    34İzleyin

    vLLM through 0.29.0 Memory Exhaustion via Unvalidated NIXL tp_size

    YüksekCVSS 8,7İstismar yokEPSS %0

    vllm · vllm21 Eyl 2026