Yayın tarihine göre

Eylül 2026: sömürülen ve yeni ciddi CVE kayıtları

7.959 kayıt · 32 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 60 / 80

CVE kayıtları
Aksiyon	CVE	Zafiyet	Ciddiyet	KEV	EPSS	Yayın
34İzleyin	CVE-2026-94627İstismar yok	vLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer ID Collisionvllm · vllm · CWE-401 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek8,7	—	%0,6	21 Eyl 2026
39İzleyin	CVE-2026-13355Kavram kanıtı	Meta Box AIO <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parametermeta box · meta box frontend submission · CWE-269 Kimlik doğrulamasız	Kritik9,8	—	%0,6	22 Eyl 2026
39İzleyin	CVE-2026-19658Kavram kanıtı	Give Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameterliquidweb · give tributes · CWE-502 Kimlik doğrulamasız Deserializasyon	Kritik9,8	—	%0,7	22 Eyl 2026
28İzleyin	CVE-2026-12470İstismar yok	CMP <= 4.1.17 - Authenticated (Editor+) Privilege Escalation via Arbitrary Option Update to cmp_ajax_import_settings AJAX Actionniteo · cmp – coming soon & maintenance plugin by niteothemes · CWE-269	Yüksek7,2	—	%0,5	22 Eyl 2026
28İzleyin	CVE-2026-89412İstismar yok	TranslatePress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panelcozmoslabs · translatepress – translate multilingual sites with ai translation · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,2	—	%0,5	22 Eyl 2026
30İzleyin	CVE-2026-91827İstismar yok	Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Exportunknown · ninja forms · CWE-502 Girişsiz RCE Deserializasyon	Yüksek7,5	—	%0,3	22 Eyl 2026
35İzleyin	CVE-2026-92438İstismar yok	Ninja Forms 3.15.3 - Unauthenticated Stored XSS via Paragraph Text Field in Submissions Adminunknown · ninja forms · CWE-79 Kimlik doğrulamasız XSS	Yüksek8,8	—	%0,3	22 Eyl 2026
28İzleyin	CVE-2026-94504İstismar yok	Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scriptingkstover · ninja forms – contact form builder with calculators, quizzes, signatures & ai form builder · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,2	—	%0,6	22 Eyl 2026
39İzleyin	CVE-2016-15059İstismar yok	Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycodeCWE-122 Kimlik doğrulamasız Bellek hatası	Kritik9,8	—	%0,4	22 Eyl 2026
28İzleyin	CVE-2026-6922İstismar yok	WP Table Builder <= 2.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'ids' Parameterwptb · wp table builder – drag & drop table builder · CWE-863 Erişim denetimi (IDOR)	Yüksek7,1	—	%0,5	22 Eyl 2026
33İzleyin	CVE-2026-74766İstismar yok	Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_pCWE-416 Bellek hatası	Yüksek8,4	—	%0,1	22 Eyl 2026
36İzleyin	CVE-2026-87078İstismar yok	Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycodeCWE-401 Kimlik doğrulamasız Hizmet dışı bırakma	Kritik9,1	—	%0,3	22 Eyl 2026
30İzleyin	CVE-2026-87079İstismar yok	Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycodeCWE-407 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek7,5	—	%0,3	22 Eyl 2026
36İzleyin	CVE-2026-87080İstismar yok	Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycodeCWE-1286 Kimlik doğrulamasız	Kritik9,1	—	%0,3	22 Eyl 2026
30İzleyin	CVE-2026-87081İstismar yok	Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_asciiCWE-407 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek7,5	—	%0,3	22 Eyl 2026
30İzleyin	CVE-2026-87082İstismar yok	Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode_punycodeCWE-835 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek7,5	—	%0,4	22 Eyl 2026
32İzleyin	CVE-2026-92235İstismar yok	WP Ultimate Review <= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameterroxnor · wp ultimate review · CWE-94 RCE	Yüksek8,1	—	%0,4	22 Eyl 2026
32İzleyin	CVE-2026-92969İstismar yok	HUSKY <= 1.4.4 - Unauthenticated Local File Inclusion via 'custom_tpl' Shortcode Attribute via 'woof_draw_products' AJAXrealmag777 · husky – products filter for woocommerce professional · CWE-98 Girişsiz RCE Kimlik doğrulama atlatma	Yüksek8,1	—	%0,8	22 Eyl 2026
28İzleyin	CVE-2026-93778İstismar yok	WP Yelp Review Slider <= 9.2 - Unauthenticated Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source)jgwhite33 · wp yelp review slider · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,2	—	%0,4	22 Eyl 2026
28İzleyin	CVE-2026-93836İstismar yok	WPC Product Bundles for WooCommerce <= 8.6.6 - Unauthenticated Stored Cross-Site Scripting via 'qty' Parameterwpclever · wpc product bundles for woocommerce · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,2	—	%0,3	22 Eyl 2026
68Bu hafta	CVE-2026-93952Silahlaştırılmış	Security Advisory 0183arista · velocloud orchestrator · CWE-20 Kimlik doğrulamasız	Kritik9,5	KEV	%1,3	22 Eyl 2026
32İzleyin	CVE-2026-65634İstismar yok	Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decodererlang · otp · CWE-407 Kimlik doğrulamasız	Yüksek8,2	—	%0,2	22 Eyl 2026
28İzleyin	CVE-2026-68956İstismar yok	SSH daemon allocates unbounded idle session channels, bypassing max_channelserlang · otp · CWE-770 Hizmet dışı bırakma	Yüksek7,1	—	%0,3	22 Eyl 2026
37İzleyin	CVE-2026-89422İstismar yok	TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extensionerlang · otp · CWE-322 Kimlik doğrulamasız	Kritik9,3	—	%0,4	22 Eyl 2026
37İzleyin	CVE-2026-93556İstismar yok	Direct references to unsafe objects (IDOR) in Tankuam Places by Kompinikompini · tankuam places · CWE-639 Kimlik doğrulamasız Erişim denetimi (IDOR)	Kritik9,3	—	%0,4	22 Eyl 2026
29İzleyin	CVE-2026-93928İstismar yok	WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Authentication vulnerabilitymagepeople inc. · taxi booking manager for woocommerce · CWE-288 Kimlik doğrulamasız Kimlik doğrulama atlatma	Yüksek7,3	—	%0,4	22 Eyl 2026
29İzleyin	CVE-2026-95508İstismar yok	Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtured hat · red hat enterprise linux 10 · CWE-787 Girişsiz RCE Bellek hatası	Yüksek7,4	—	%0,5	22 Eyl 2026
30İzleyin	CVE-2026-9231İstismar yok	WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attributewptravelengine · wp travel engine – tour booking plugin – tour operator software · CWE-98 RCE	Yüksek7,5	—	%0,5	22 Eyl 2026
39İzleyin	CVE-2026-25254İstismar yok	Improper authorization in Qualcomm Software Centerqualcomm · software center · CWE-285 Girişsiz RCE Erişim denetimi (IDOR)	Kritik9,8	—	%0,4	22 Eyl 2026
35İzleyin	CVE-2026-25264İstismar yok	Uncontrolled Search Path Element in Qualcomm Software Centerqualcomm · software center · CWE-427 Yerel yetki yükseltme	Yüksek8,8	—	%0,1	22 Eyl 2026
35İzleyin	CVE-2026-25265İstismar yok	Creation of Temporary File with Insecure Permissions in Qualcomm Software Centerqualcomm · software center · CWE-378 Yerel yetki yükseltme	Yüksek8,8	—	%0,1	22 Eyl 2026
34İzleyin	CVE-2026-90882İstismar yok	Reflected arbitrary origins with credentials, allowing cross-origin reads of authenticated user dataeclipse foundation · open-vsx.org · CWE-942 Kimlik doğrulamasız CSRF	Yüksek8,7	—	%0,4	22 Eyl 2026
30İzleyin	CVE-2026-94117İstismar yok	WordPress HashBar – WordPress Notification Bar plugin <= 2.0.3 - SQL Injection vulnerabilitydevitems · hashbar – wordpress notification bar · CWE-89 SQL enjeksiyonu	Yüksek7,6	—	%0,3	22 Eyl 2026
35İzleyin	CVE-2025-1281İstismar yok	BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Deletionseatheme · bm content builder · CWE-22 RCE Yol geçişi	Yüksek8,8	—	%0,8	22 Eyl 2026
40Planlayın	CVE-2026-74849İstismar yok	Remote code execution vulnerabilityzohocorp · manageengine adselfservice plus · CWE-78 Girişsiz RCE Komut enjeksiyonu	Kritik9,8	—	%4,6	22 Eyl 2026
32İzleyin	CVE-2026-87119İstismar yok	mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayedzenhive · mpp · CWE-294 Kimlik doğrulamasız Kimlik doğrulama atlatma	Yüksek8,2	—	%0,5	22 Eyl 2026
28İzleyin	CVE-2026-89420İstismar yok	Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for freezenhive · mpp · CWE-1284	Yüksek7,1	—	%0,4	22 Eyl 2026
35İzleyin	CVE-2026-75791İstismar yok	Authentication bypass vulnerabilityzohocorp · manageengine adselfservice plus · CWE-306 Kimlik doğrulamasız Kimlik doğrulama atlatma	Yüksek8,6	—	%1,8	22 Eyl 2026
96Hemen	CVE-2026-93616Silahlaştırılmış	Directory Traversal and File upload allows execution of arbitrary script on the Management Servercheckpoint · multi-domain security management · CWE-22 Girişsiz RCE Yol geçişi	Kritik9,8	KEV	%91,6	22 Eyl 2026
31İzleyin	CVE-2026-25255İstismar yok	Exposed function in Qualcomm Package Manager and Qualcomm Software Center.qualcomm · package manager · CWE-749 Yerel yetki yükseltme	Yüksek7,8	—	%0,0	22 Eyl 2026
25İzleyin	CVE-2026-25262Kavram kanıtı	Write-what-where Condition in Primary Bootloaderqualcomm · mdm9207 firmware · CWE-123	Orta6,3	—	%0,1	22 Eyl 2026
39İzleyin	CVE-2026-12718İstismar yok	SQLi in Karel Electronics' KarelIPSkarel electronic industry and trade inc. · karelips · CWE-89 Kimlik doğrulamasız SQL enjeksiyonu	Kritik9,8	—	%0,4	22 Eyl 2026
28İzleyin	CVE-2026-93343İstismar yok	MarketKing < 2.1.72 Missing Authorization via marketking_admin_vendors_ajaxwebwizards · marketking · CWE-862 Erişim denetimi (IDOR)	Yüksek7,1	—	%0,4	22 Eyl 2026
38İzleyin	CVE-2026-95675Kavram kanıtı	D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management Interfaced-link · dap-1360 · CWE-78 Girişsiz RCE Komut enjeksiyonu	Kritik9,3	—	%2,0	22 Eyl 2026
31İzleyin	CVE-2026-24239İstismar yok	NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious data created by an attacker could cause remote code execution.nvidia · nemo speech · CWE-502 RCE Deserializasyon	Yüksek7,8	—	%0,6	22 Eyl 2026
31İzleyin	CVE-2026-24267İstismar yok	NVIDIA NeMo Speech for all platforms contains a vulnerability in the speech data explorer component, where malicious data created by an attanvidia · nemo speech · CWE-502 RCE Deserializasyon Yerel yetki yükseltme	Yüksek7,8	—	%0,6	22 Eyl 2026
31İzleyin	CVE-2026-65111İstismar yok	NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious input created by an attacker could cause a code injection.nvidia · nemo speech · CWE-77 RCE Komut enjeksiyonu	Yüksek7,8	—	%0,2	22 Eyl 2026
39İzleyin	CVE-2026-79313İstismar yok	webpy web.py 0.76 is vulnerable to Insufficient Session Expiration.CWE-613 Kimlik doğrulamasız	Kritik9,8	—	%0,3	22 Eyl 2026
35İzleyin	CVE-2026-79314İstismar yok	A horizontal privilege escalation vulnerability exists in x-ui 0.3.2.CWE-284 Erişim denetimi (IDOR)	Yüksek8,8	—	%0,3	22 Eyl 2026
38İzleyin	CVE-2026-84388Kavram kanıtı	A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM Chromefortinet · fortipam chrome extension · CWE-1021 Kimlik doğrulamasız	Kritik9,6	—	%0,3	22 Eyl 2026
30İzleyin	CVE-2026-89407İstismar yok	jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoSfasterxml · jackson-core · CWE-400 Kimlik doğrulamasız Deserializasyon Hizmet dışı bırakma	Yüksek7,5	—	%0,6	22 Eyl 2026
39İzleyin	CVE-2026-93088İstismar yok	SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution because the disaggregated-diffusion orchestsglang · sglang · CWE-502 Girişsiz RCE Deserializasyon	Kritik9,8	—	%0,7	22 Eyl 2026
28İzleyin	CVE-2026-93344İstismar yok	MarketKing < 2.1.72 Missing Authorization via marketking_get_page_content AJAXwebwizards · marketking · CWE-862 Erişim denetimi (IDOR)	Yüksek7,1	—	%0,4	22 Eyl 2026
74Bu hafta	CVE-2026-94127Silahlaştırılmış	BIG-IP APM OAuth vulnerabilityf5 · big-ip access policy manager · CWE-122 Girişsiz RCE Bellek hatası	Kritik9,3	KEV	%24,9	22 Eyl 2026
21İzleyin	CVE-2026-95698İstismar yok	MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Namemisp · misp · CWE-22 Yol geçişi	Orta5,3	—	%0,7	22 Eyl 2026
35İzleyin	CVE-2026-70410İstismar yok	Apache Calcite Avatica: Unrestricted class initialization when instantiating pluginsapache software foundation · apache calcite avatica · CWE-470	Yüksek8,8	—	%0,6	22 Eyl 2026
32İzleyin	CVE-2026-75607İstismar yok	Frigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only Operationsblakeblackshear · frigate · CWE-862 Erişim denetimi (IDOR)	Yüksek8,1	—	%0,6	22 Eyl 2026
34İzleyin	CVE-2026-77619İstismar yok	Vector: Unauthenticated denial of service in the `logstash` source via unbounded memory allocation.vectordotdev · vector · CWE-130 Kimlik doğrulamasız	Yüksek8,7	—	%0,5	22 Eyl 2026
34İzleyin	CVE-2026-77620İstismar yok	Vector: Unauthenticated denial of service in the `logstash` source via nested compressed frames (stack exhaustion and decompression amplification).vectordotdev · vector · CWE-409 Kimlik doğrulamasız	Yüksek8,7	—	%0,5	22 Eyl 2026
37İzleyin	CVE-2026-77621İstismar yok	Vector: Arbitrary file write in the file sink via templated path (path traversal).vectordotdev · vector · CWE-22 Kimlik doğrulamasız Yol geçişi	Kritik9,3	—	%1,1	22 Eyl 2026
28İzleyin	CVE-2026-77633İstismar yok	Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of servicecloudreve · cloudreve · CWE-362 Yarış durumu	Yüksek7,1	—	%0,3	22 Eyl 2026
38İzleyin	CVE-2026-80143İstismar yok	Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom readlantronix · slc8000 · CWE-78 RCE Komut enjeksiyonu	Kritik9,4	—	%1,6	22 Eyl 2026
38İzleyin	CVE-2026-80144İstismar yok	Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom writelantronix · slc8000 · CWE-78 RCE Komut enjeksiyonu	Kritik9,4	—	%1,6	22 Eyl 2026
38İzleyin	CVE-2026-80145İstismar yok	Lantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs passwordlantronix · slc8000 · CWE-78 RCE Komut enjeksiyonu	Kritik9,4	—	%1,8	22 Eyl 2026
37İzleyin	CVE-2026-80146İstismar yok	Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom readlantronix · slc8000 · CWE-121 RCE Bellek hatası	Kritik9,4	—	%0,8	22 Eyl 2026
37İzleyin	CVE-2026-80147İstismar yok	Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom writelantronix · slc8000 · CWE-121 RCE Bellek hatası	Kritik9,4	—	%0,4	22 Eyl 2026
30İzleyin	CVE-2026-80148İstismar yok	Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via Username Truncationlantronix · slc8000 · CWE-918 Kimlik doğrulamasız SSRF	Yüksek7,7	—	%0,5	22 Eyl 2026
30İzleyin	CVE-2026-80149İstismar yok	Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via rooturl Parameterlantronix · slc8000 · CWE-918 Kimlik doğrulamasız SSRF	Yüksek7,7	—	%0,5	22 Eyl 2026
30İzleyin	CVE-2026-80150İstismar yok	Lantronix Autonomous Out-of-Band Devices WebTelnet SSRF via rooturl Parameterlantronix · slc8000 · CWE-918 Kimlik doğrulamasız SSRF	Yüksek7,7	—	%0,5	22 Eyl 2026
37İzleyin	CVE-2026-80151İstismar yok	Lantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs downloadlantronix · slc8000 · CWE-78 RCE Komut enjeksiyonu	Kritik9,4	—	%1,6	22 Eyl 2026
37İzleyin	CVE-2026-80152İstismar yok	Lantronix Autonomous Out-of-Band Devices OS Command Injection via set script schedulelantronix · slc8000 · CWE-78 RCE Komut enjeksiyonu	Kritik9,4	—	%1,6	22 Eyl 2026
35İzleyin	CVE-2026-80154İstismar yok	Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypasslantronix · slc8000 · CWE-330 Kimlik doğrulamasız Kimlik doğrulama atlatma Zayıf kripto	Yüksek8,9	—	%0,6	22 Eyl 2026
40Planlayın	CVE-2026-80155İstismar yok	Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path Truncationlantronix · slc8000 · CWE-22 Girişsiz RCE Kimlik doğrulama atlatma Yol geçişi	Kritik10,0	—	%1,0	22 Eyl 2026
37İzleyin	CVE-2026-80156İstismar yok	Lantronix Autonomous Out-of-Band Devices Arbitrary File Write via Upload Filename Validation Bypasslantronix · slc8000 · CWE-22 RCE Yol geçişi	Kritik9,4	—	%0,6	22 Eyl 2026
28İzleyin	CVE-2026-85055İstismar yok	Twenty: Field-level read bypasstwentyhq · twenty · CWE-200 Bilgi sızıntısı	Yüksek7,1	—	%0,4	22 Eyl 2026
34İzleyin	CVE-2026-95653İstismar yok	Concrete CMS Community Store before 2.7.8 Predictable Digital Download Tokenconcretecms-community-store · community_store · CWE-340 Kimlik doğrulamasız	Yüksek8,7	—	%0,5	22 Eyl 2026
36İzleyin	CVE-2026-95654İstismar yok	Databasement before 1.7.14 Authorization Bypass via Stale Invitation Tokendavid-crty · databasement · CWE-863 Kimlik doğrulamasız Erişim denetimi (IDOR)	Kritik9,1	—	%0,5	22 Eyl 2026
30İzleyin	CVE-2026-95806İstismar yok	MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem pathsmisp · misp · CWE-74 RCE Deserializasyon	Yüksek7,7	—	%0,3	22 Eyl 2026
30İzleyin	CVE-2026-95619İstismar yok	Gcc: libstdc++ integer overflow in `new` operatorred hat · red hat hardened images · CWE-190 Kimlik doğrulamasız Bellek hatası	Yüksek7,7	—	%0,4	22 Eyl 2026
31İzleyin	CVE-2026-83598İstismar yok	Netdata: Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI Repairnetdata · netdata · CWE-269 Yerel yetki yükseltme	Yüksek7,8	—	%0,1	22 Eyl 2026
30İzleyin	CVE-2026-83599İstismar yok	Netdata: WebSocket Decompression Bombnetdata · netdata · CWE-409 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek7,5	—	%0,7	22 Eyl 2026
33İzleyin	CVE-2026-83603Kavram kanıtı	Netdata: Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle RCEnetdata · netdata · CWE-73 RCE Yol geçişi Yerel yetki yükseltme	Yüksek8,4	—	%0,3	22 Eyl 2026
30İzleyin	CVE-2026-83803İstismar yok	Sentry: Unsafe pickle deserialization in Relocation Featuregetsentry · sentry · CWE-502 RCE Deserializasyon	Yüksek7,7	—	%0,6	22 Eyl 2026
36İzleyin	CVE-2026-85734İstismar yok	LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attackshkuds · lightrag · CWE-307 Kimlik doğrulamasız	Kritik9,1	—	%0,6	22 Eyl 2026
38İzleyin	CVE-2026-86059İstismar yok	Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.onedokploy · dokploy · CWE-200 Bilgi sızıntısı	Kritik9,6	—	%0,4	22 Eyl 2026
91Hemen	CVE-2026-87902Silahlaştırılmış	An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the wordpress · wordpress · CWE-98 Girişsiz RCE	Yüksek8,1	KEV	%95,7	22 Eyl 2026
28İzleyin	CVE-2026-94455İstismar yok	Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API keygitroomhq · postiz-app · CWE-306 Kimlik doğrulama atlatma	Yüksek7,1	—	%0,2	22 Eyl 2026
36İzleyin	CVE-2026-94456İstismar yok	Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keysgitroomhq · postiz-app · CWE-330 Kimlik doğrulamasız Zayıf kripto	Kritik9,1	—	%0,5	22 Eyl 2026
33İzleyin	CVE-2026-18457İstismar yok	Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers.rti · connext professional · CWE-122 Kimlik doğrulamasız Bellek hatası	Yüksek8,3	—	%0,4	22 Eyl 2026
34İzleyin	CVE-2026-18459İstismar yok	Incorrect Calculation vulnerability in RTI Connext Professional (Core Libraries) allows Abuse Existing Functionality.rti · connext professional · CWE-682 Kimlik doğrulamasız	Yüksek8,7	—	%0,4	22 Eyl 2026
36İzleyin	CVE-2026-18461İstismar yok	Use of Externally-Controlled Format String vulnerability in RTI Connext Professional (Core Libraries) allows Format String Injection.rti · connext professional · CWE-134 Kimlik doğrulamasız	Kritik9,2	—	%0,3	22 Eyl 2026
29İzleyin	CVE-2026-18462İstismar yok	Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional (Core Libraries) allows Shared Resource Manipulation.rti · connext professional · CWE-190 Bellek hatası	Yüksek7,3	—	%0,1	22 Eyl 2026
38İzleyin	CVE-2026-43641İstismar yok	Softaculous Virtualizor OS Command Injection via Billing Module Handlersoftaculous · virtualizor · CWE-78 Girişsiz RCE Kimlik doğrulama atlatma Deserializasyon Komut enjeksiyonu	Kritik9,3	—	%3,0	22 Eyl 2026
36İzleyin	CVE-2026-43642İstismar yok	Softaculous Virtualizor PHP Object Injection via Billing Module Handlersoftaculous · virtualizor · CWE-502 Girişsiz RCE Deserializasyon	Kritik9,2	—	%0,9	22 Eyl 2026
34İzleyin	CVE-2026-43643İstismar yok	Softaculous Virtualizor Authorization Bypass via Billing Module Handlersoftaculous · virtualizor · CWE-862 Kimlik doğrulamasız Erişim denetimi (IDOR)	Yüksek8,7	—	%0,6	22 Eyl 2026
40Planlayın	CVE-2026-73369İstismar yok	Adobe Campaign Classic (ACC) \| Improper Control of Generation of Code ('Code Injection') (CWE-94)adobe · campaign · CWE-94 Girişsiz RCE	Kritik10,0	—	%1,2	22 Eyl 2026
40Planlayın	CVE-2026-75699İstismar yok	Adobe Campaign Classic (ACC) \| Improper Control of Generation of Code ('Code Injection') (CWE-94)adobe · campaign · CWE-94 Girişsiz RCE	Kritik10,0	—	%1,2	22 Eyl 2026
40Planlayın	CVE-2026-75703İstismar yok	Adobe Campaign Classic (ACC) \| Improper Control of Generation of Code ('Code Injection') (CWE-94)adobe · campaign · CWE-94 Girişsiz RCE	Kritik10,0	—	%1,2	22 Eyl 2026
40Planlayın	CVE-2026-75721İstismar yok	Adobe Campaign Classic (ACC) \| Improper Control of Generation of Code ('Code Injection') (CWE-94)adobe · campaign · CWE-94 Girişsiz RCE	Kritik10,0	—	%1,2	22 Eyl 2026
40Planlayın	CVE-2026-75723İstismar yok	Adobe Campaign Classic (ACC) \| Incorrect Authorization (CWE-863)adobe · campaign · CWE-863 Girişsiz RCE Erişim denetimi (IDOR)	Kritik10,0	—	%1,1	22 Eyl 2026

CVE-2026-94627
34İzleyin
vLLM through 0.29.0 GPU KV Cache Leak via Mooncake Transfer ID Collision
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
vllm · vllm21 Eyl 2026
CVE-2026-13355
39İzleyin
Meta Box AIO <= 3.11.0 And Standalone Plugin Extensions - Unauthenticated Privilege Escalation to Administrator to 'rwmb_frontend_field_object_id' Parameter
KritikCVSS 9,8Kavram kanıtıEPSS %0
- Kimlik doğrulamasız
meta box · meta box frontend submission22 Eyl 2026
CVE-2026-19658
39İzleyin
Give Tributes <= 2.3.1 - Unauthenticated PHP Object Injection via 'give_tributes_ecard_notify[recipient][personalized][]' Parameter
KritikCVSS 9,8Kavram kanıtıEPSS %0
- Kimlik doğrulamasız
- Deserializasyon
liquidweb · give tributes22 Eyl 2026
CVE-2026-12470
28İzleyin
CMP <= 4.1.17 - Authenticated (Editor+) Privilege Escalation via Arbitrary Option Update to cmp_ajax_import_settings AJAX Action
YüksekCVSS 7,2İstismar yokEPSS %0
niteo · cmp – coming soon & maintenance plugin by niteothemes22 Eyl 2026
CVE-2026-89412
28İzleyin
TranslatePress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel
YüksekCVSS 7,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
cozmoslabs · translatepress – translate multilingual sites with ai translation22 Eyl 2026
CVE-2026-91827
30İzleyin
Ninja Forms 3.15.3 - Unauthenticated PHP Object Injection via CSV Export
YüksekCVSS 7,5İstismar yokEPSS %0
- Girişsiz RCE
- Deserializasyon
unknown · ninja forms22 Eyl 2026
CVE-2026-92438
35İzleyin
Ninja Forms 3.15.3 - Unauthenticated Stored XSS via Paragraph Text Field in Submissions Admin
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
unknown · ninja forms22 Eyl 2026
CVE-2026-94504
28İzleyin
Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting
YüksekCVSS 7,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
kstover · ninja forms – contact form builder with calculators, quizzes, signatures & ai form builder22 Eyl 2026
CVE-2016-15059
39İzleyin
Net::IDN::Punycode versions before 2.301 for Perl allow a heap buffer overflow via unchecked writes past the output buffer in encode_punycode
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
22 Eyl 2026
CVE-2026-6922
28İzleyin
WP Table Builder <= 2.2.1 - Incorrect Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'ids' Parameter
YüksekCVSS 7,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
wptb · wp table builder – drag & drop table builder22 Eyl 2026
CVE-2026-74766
33İzleyin
Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_p
YüksekCVSS 8,4İstismar yokEPSS %0
- Bellek hatası
22 Eyl 2026
CVE-2026-87078
36İzleyin
Net::IDN::Punycode versions from 2.302 before 2.590 for Perl leak the output buffer on every rejected label in decode_punycode
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
22 Eyl 2026
CVE-2026-87079
30İzleyin
Net::IDN::Punycode versions before 2.590 for Perl allow CPU exhaustion via quadratic insertion cost when decoding a long label in decode_punycode
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
22 Eyl 2026
CVE-2026-87080
36İzleyin
Net::IDN::Punycode::PP versions before 2.590 for Perl decode a truncated label to a name containing a character it never encoded in decode_punycode
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
22 Eyl 2026
CVE-2026-87081
30İzleyin
Net::IDN::UTS46 versions before 2.590 for Perl allow CPU exhaustion via quadratic punycode encoding of an overlong label before the length check in to_ascii
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
22 Eyl 2026
CVE-2026-87082
30İzleyin
Net::IDN::Punycode versions before 2.590 for Perl hang, crash or return a wrong label via unvalidated malformed UTF-8 in encode_punycode
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
22 Eyl 2026
CVE-2026-92235
32İzleyin
WP Ultimate Review <= 2.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'xs_submit_review_data[xs_reviw_summery]' Parameter
YüksekCVSS 8,1İstismar yokEPSS %0
- RCE
roxnor · wp ultimate review22 Eyl 2026
CVE-2026-92969
32İzleyin
HUSKY <= 1.4.4 - Unauthenticated Local File Inclusion via 'custom_tpl' Shortcode Attribute via 'woof_draw_products' AJAX
YüksekCVSS 8,1İstismar yokEPSS %0
- Girişsiz RCE
- Kimlik doğrulama atlatma
realmag777 · husky – products filter for woocommerce professional22 Eyl 2026
CVE-2026-93778
28İzleyin
WP Yelp Review Slider <= 9.2 - Unauthenticated Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source)
YüksekCVSS 7,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
jgwhite33 · wp yelp review slider22 Eyl 2026
CVE-2026-93836
28İzleyin
WPC Product Bundles for WooCommerce <= 8.6.6 - Unauthenticated Stored Cross-Site Scripting via 'qty' Parameter
YüksekCVSS 7,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
wpclever · wpc product bundles for woocommerce22 Eyl 2026
CVE-2026-93952
68Bu hafta
Security Advisory 0183
KritikCVSS 9,5KEVSilahlaştırılmışEPSS %1
- Kimlik doğrulamasız
arista · velocloud orchestrator22 Eyl 2026
CVE-2026-65634
32İzleyin
Superlinear CPU denial of service in Erlang/OTP ASN.1 OBJECT IDENTIFIER decoder
YüksekCVSS 8,2İstismar yokEPSS %0
- Kimlik doğrulamasız
erlang · otp22 Eyl 2026
CVE-2026-68956
28İzleyin
SSH daemon allocates unbounded idle session channels, bypassing max_channels
YüksekCVSS 7,1İstismar yokEPSS %0
- Hizmet dışı bırakma
erlang · otp22 Eyl 2026
CVE-2026-89422
37İzleyin
TLS 1.3 client skips server authentication when ServerHello carries an unsolicited pre_shared_key extension
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
erlang · otp22 Eyl 2026
CVE-2026-93556
37İzleyin
Direct references to unsafe objects (IDOR) in Tankuam Places by Kompini
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
kompini · tankuam places22 Eyl 2026
CVE-2026-93928
29İzleyin
WordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Authentication vulnerability
YüksekCVSS 7,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
magepeople inc. · taxi booking manager for woocommerce22 Eyl 2026
CVE-2026-95508
29İzleyin
Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtu
YüksekCVSS 7,4İstismar yokEPSS %0
- Girişsiz RCE
- Bellek hatası
red hat · red hat enterprise linux 1022 Eyl 2026
CVE-2026-9231
30İzleyin
WP Travel Engine <= 6.8.0 - Authenticated (Contributor+) Local File Inclusion via 'template' Shortcode Attribute
YüksekCVSS 7,5İstismar yokEPSS %0
- RCE
wptravelengine · wp travel engine – tour booking plugin – tour operator software22 Eyl 2026
CVE-2026-25254
39İzleyin
Improper authorization in Qualcomm Software Center
KritikCVSS 9,8İstismar yokEPSS %0
- Girişsiz RCE
- Erişim denetimi (IDOR)
qualcomm · software center22 Eyl 2026
CVE-2026-25264
35İzleyin
Uncontrolled Search Path Element in Qualcomm Software Center
YüksekCVSS 8,8İstismar yokEPSS %0
- Yerel yetki yükseltme
qualcomm · software center22 Eyl 2026
CVE-2026-25265
35İzleyin
Creation of Temporary File with Insecure Permissions in Qualcomm Software Center
YüksekCVSS 8,8İstismar yokEPSS %0
- Yerel yetki yükseltme
qualcomm · software center22 Eyl 2026
CVE-2026-90882
34İzleyin
Reflected arbitrary origins with credentials, allowing cross-origin reads of authenticated user data
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- CSRF
eclipse foundation · open-vsx.org22 Eyl 2026
CVE-2026-94117
30İzleyin
WordPress HashBar – WordPress Notification Bar plugin <= 2.0.3 - SQL Injection vulnerability
YüksekCVSS 7,6İstismar yokEPSS %0
- SQL enjeksiyonu
devitems · hashbar – wordpress notification bar22 Eyl 2026
CVE-2025-1281
35İzleyin
BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Deletion
YüksekCVSS 8,8İstismar yokEPSS %0
- RCE
- Yol geçişi
seatheme · bm content builder22 Eyl 2026
CVE-2026-74849
40Planlayın
Remote code execution vulnerability
KritikCVSS 9,8İstismar yokEPSS %4
- Girişsiz RCE
- Komut enjeksiyonu
zohocorp · manageengine adselfservice plus22 Eyl 2026
CVE-2026-87119
32İzleyin
mpp Tempo subscription key authorization is not bound to the issuing challenge, allowing a captured activation credential to be replayed
YüksekCVSS 8,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
zenhive · mpp22 Eyl 2026
CVE-2026-89420
28İzleyin
Session voucher adding no new funds is accepted without a charge in mpp, serving paid resources for free
YüksekCVSS 7,1İstismar yokEPSS %0
zenhive · mpp22 Eyl 2026
CVE-2026-75791
35İzleyin
Authentication bypass vulnerability
YüksekCVSS 8,6İstismar yokEPSS %1
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
zohocorp · manageengine adselfservice plus22 Eyl 2026
CVE-2026-93616
96Hemen
Directory Traversal and File upload allows execution of arbitrary script on the Management Server
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %91
- Girişsiz RCE
- Yol geçişi
checkpoint · multi-domain security management22 Eyl 2026
CVE-2026-25255
31İzleyin
Exposed function in Qualcomm Package Manager and Qualcomm Software Center.
YüksekCVSS 7,8İstismar yokEPSS %0
- Yerel yetki yükseltme
qualcomm · package manager22 Eyl 2026
CVE-2026-25262
25İzleyin
Write-what-where Condition in Primary Bootloader
OrtaCVSS 6,3Kavram kanıtıEPSS %0
qualcomm · mdm9207 firmware22 Eyl 2026
CVE-2026-12718
39İzleyin
SQLi in Karel Electronics' KarelIPS
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- SQL enjeksiyonu
karel electronic industry and trade inc. · karelips22 Eyl 2026
CVE-2026-93343
28İzleyin
MarketKing < 2.1.72 Missing Authorization via marketking_admin_vendors_ajax
YüksekCVSS 7,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
webwizards · marketking22 Eyl 2026
CVE-2026-95675
38İzleyin
D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management Interface
KritikCVSS 9,3Kavram kanıtıEPSS %2
- Girişsiz RCE
- Komut enjeksiyonu
d-link · dap-136022 Eyl 2026
CVE-2026-24239
31İzleyin
NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious data created by an attacker could cause remote code execution.
YüksekCVSS 7,8İstismar yokEPSS %0
- RCE
- Deserializasyon
nvidia · nemo speech22 Eyl 2026
CVE-2026-24267
31İzleyin
NVIDIA NeMo Speech for all platforms contains a vulnerability in the speech data explorer component, where malicious data created by an atta
YüksekCVSS 7,8İstismar yokEPSS %0
- RCE
- Deserializasyon
- Yerel yetki yükseltme
nvidia · nemo speech22 Eyl 2026
CVE-2026-65111
31İzleyin
NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious input created by an attacker could cause a code injection.
YüksekCVSS 7,8İstismar yokEPSS %0
- RCE
- Komut enjeksiyonu
nvidia · nemo speech22 Eyl 2026
CVE-2026-79313
39İzleyin
webpy web.py 0.76 is vulnerable to Insufficient Session Expiration.
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
22 Eyl 2026
CVE-2026-79314
35İzleyin
A horizontal privilege escalation vulnerability exists in x-ui 0.3.2.
YüksekCVSS 8,8İstismar yokEPSS %0
- Erişim denetimi (IDOR)
22 Eyl 2026
CVE-2026-84388
38İzleyin
A improper restriction of rendered ui layers or frames vulnerability in Fortinet FortiPAM Chrome Extension 8.0 all versions, FortiPAM Chrome
KritikCVSS 9,6Kavram kanıtıEPSS %0
- Kimlik doğrulamasız
fortinet · fortipam chrome extension22 Eyl 2026
CVE-2026-89407
30İzleyin
jackson-core: quadratic backtracking in NumberInput.PATTERN_FLOAT via looksLikeValidNumber() enables ReDoS
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Deserializasyon
- Hizmet dışı bırakma
fasterxml · jackson-core22 Eyl 2026
CVE-2026-93088
39İzleyin
SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution because the disaggregated-diffusion orchest
KritikCVSS 9,8İstismar yokEPSS %0
- Girişsiz RCE
- Deserializasyon
sglang · sglang22 Eyl 2026
CVE-2026-93344
28İzleyin
MarketKing < 2.1.72 Missing Authorization via marketking_get_page_content AJAX
YüksekCVSS 7,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
webwizards · marketking22 Eyl 2026
CVE-2026-94127
74Bu hafta
BIG-IP APM OAuth vulnerability
KritikCVSS 9,3KEVSilahlaştırılmışEPSS %24
- Girişsiz RCE
- Bellek hatası
f5 · big-ip access policy manager22 Eyl 2026
CVE-2026-95698
21İzleyin
MISP Path Traversal in OrgImgHelper findOrgImage via Crafted Organization Name
OrtaCVSS 5,3İstismar yokEPSS %0
- Yol geçişi
misp · misp22 Eyl 2026
CVE-2026-70410
35İzleyin
Apache Calcite Avatica: Unrestricted class initialization when instantiating plugins
YüksekCVSS 8,8İstismar yokEPSS %0
apache software foundation · apache calcite avatica22 Eyl 2026
CVE-2026-75607
32İzleyin
Frigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only Operations
YüksekCVSS 8,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
blakeblackshear · frigate22 Eyl 2026
CVE-2026-77619
34İzleyin
Vector: Unauthenticated denial of service in the `logstash` source via unbounded memory allocation.
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
vectordotdev · vector22 Eyl 2026
CVE-2026-77620
34İzleyin
Vector: Unauthenticated denial of service in the `logstash` source via nested compressed frames (stack exhaustion and decompression amplification).
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
vectordotdev · vector22 Eyl 2026
CVE-2026-77621
37İzleyin
Vector: Arbitrary file write in the file sink via templated path (path traversal).
KritikCVSS 9,3İstismar yokEPSS %1
- Kimlik doğrulamasız
- Yol geçişi
vectordotdev · vector22 Eyl 2026
CVE-2026-77633
28İzleyin
Cloudreve: Storage-quota TOCTOU race allows quota bypass and storage-based denial of service
YüksekCVSS 7,1İstismar yokEPSS %0
- Yarış durumu
cloudreve · cloudreve22 Eyl 2026
CVE-2026-80143
38İzleyin
Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom read
KritikCVSS 9,4İstismar yokEPSS %1
- RCE
- Komut enjeksiyonu
lantronix · slc800022 Eyl 2026
CVE-2026-80144
38İzleyin
Lantronix Autonomous Out-of-Band Devices CLI Command Injection via mfc eeprom write
KritikCVSS 9,4İstismar yokEPSS %1
- RCE
- Komut enjeksiyonu
lantronix · slc800022 Eyl 2026
CVE-2026-80145
38İzleyin
Lantronix Autonomous Out-of-Band Devices CLI Command Injection via set cifs password
KritikCVSS 9,4İstismar yokEPSS %1
- RCE
- Komut enjeksiyonu
lantronix · slc800022 Eyl 2026
CVE-2026-80146
37İzleyin
Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom read
KritikCVSS 9,4İstismar yokEPSS %0
- RCE
- Bellek hatası
lantronix · slc800022 Eyl 2026
CVE-2026-80147
37İzleyin
Lantronix Autonomous Out-of-Band Devices Stack-Based Buffer Overflow via mfc eeprom write
KritikCVSS 9,4İstismar yokEPSS %0
- RCE
- Bellek hatası
lantronix · slc800022 Eyl 2026
CVE-2026-80148
30İzleyin
Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via Username Truncation
YüksekCVSS 7,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- SSRF
lantronix · slc800022 Eyl 2026
CVE-2026-80149
30İzleyin
Lantronix Autonomous Out-of-Band Devices WebSSH SSRF via rooturl Parameter
YüksekCVSS 7,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- SSRF
lantronix · slc800022 Eyl 2026
CVE-2026-80150
30İzleyin
Lantronix Autonomous Out-of-Band Devices WebTelnet SSRF via rooturl Parameter
YüksekCVSS 7,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- SSRF
lantronix · slc800022 Eyl 2026
CVE-2026-80151
37İzleyin
Lantronix Autonomous Out-of-Band Devices OS Command Injection via set nfs download
KritikCVSS 9,4İstismar yokEPSS %1
- RCE
- Komut enjeksiyonu
lantronix · slc800022 Eyl 2026
CVE-2026-80152
37İzleyin
Lantronix Autonomous Out-of-Band Devices OS Command Injection via set script schedule
KritikCVSS 9,4İstismar yokEPSS %1
- RCE
- Komut enjeksiyonu
lantronix · slc800022 Eyl 2026
CVE-2026-80154
35İzleyin
Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypass
YüksekCVSS 8,9İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
- Zayıf kripto
lantronix · slc800022 Eyl 2026
CVE-2026-80155
40Planlayın
Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path Truncation
KritikCVSS 10,0İstismar yokEPSS %1
- Girişsiz RCE
- Kimlik doğrulama atlatma
- Yol geçişi
lantronix · slc800022 Eyl 2026
CVE-2026-80156
37İzleyin
Lantronix Autonomous Out-of-Band Devices Arbitrary File Write via Upload Filename Validation Bypass
KritikCVSS 9,4İstismar yokEPSS %0
- RCE
- Yol geçişi
lantronix · slc800022 Eyl 2026
CVE-2026-85055
28İzleyin
Twenty: Field-level read bypass
YüksekCVSS 7,1İstismar yokEPSS %0
- Bilgi sızıntısı
twentyhq · twenty22 Eyl 2026
CVE-2026-95653
34İzleyin
Concrete CMS Community Store before 2.7.8 Predictable Digital Download Token
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
concretecms-community-store · community_store22 Eyl 2026
CVE-2026-95654
36İzleyin
Databasement before 1.7.14 Authorization Bypass via Stale Invitation Token
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
david-crty · databasement22 Eyl 2026
CVE-2026-95806
30İzleyin
MISP: PHP phar stream wrapper enables deserialization and code execution via caller-influenced filesystem paths
YüksekCVSS 7,7İstismar yokEPSS %0
- RCE
- Deserializasyon
misp · misp22 Eyl 2026
CVE-2026-95619
30İzleyin
Gcc: libstdc++ integer overflow in `new` operator
YüksekCVSS 7,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
red hat · red hat hardened images22 Eyl 2026
CVE-2026-83598
31İzleyin
Netdata: Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI Repair
YüksekCVSS 7,8İstismar yokEPSS %0
- Yerel yetki yükseltme
netdata · netdata22 Eyl 2026
CVE-2026-83599
30İzleyin
Netdata: WebSocket Decompression Bomb
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
netdata · netdata22 Eyl 2026
CVE-2026-83603
33İzleyin
Netdata: Local Root via ndsudo Arbitrary socket_path → fail2ban-client Pickle RCE
YüksekCVSS 8,4Kavram kanıtıEPSS %0
- RCE
- Yol geçişi
- Yerel yetki yükseltme
netdata · netdata22 Eyl 2026
CVE-2026-83803
30İzleyin
Sentry: Unsafe pickle deserialization in Relocation Feature
YüksekCVSS 7,7İstismar yokEPSS %0
- RCE
- Deserializasyon
getsentry · sentry22 Eyl 2026
CVE-2026-85734
36İzleyin
LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
hkuds · lightrag22 Eyl 2026
CVE-2026-86059
38İzleyin
Dokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.one
KritikCVSS 9,6İstismar yokEPSS %0
- Bilgi sızıntısı
dokploy · dokploy22 Eyl 2026
CVE-2026-87902
91Hemen
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the
YüksekCVSS 8,1KEVSilahlaştırılmışEPSS %95
- Girişsiz RCE
wordpress · wordpress22 Eyl 2026
CVE-2026-94455
28İzleyin
Unauthenticated /enterprise/create-user mints lifetime top-tier organizations and discloses their API key
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulama atlatma
gitroomhq · postiz-app22 Eyl 2026
CVE-2026-94456
36İzleyin
Unauthenticated recovery of the Math.random() state behind OAuth tokens, authorization codes, client secrets and organization API keys
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- Zayıf kripto
gitroomhq · postiz-app22 Eyl 2026
CVE-2026-18457
33İzleyin
Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers.
YüksekCVSS 8,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
rti · connext professional22 Eyl 2026
CVE-2026-18459
34İzleyin
Incorrect Calculation vulnerability in RTI Connext Professional (Core Libraries) allows Abuse Existing Functionality.
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
rti · connext professional22 Eyl 2026
CVE-2026-18461
36İzleyin
Use of Externally-Controlled Format String vulnerability in RTI Connext Professional (Core Libraries) allows Format String Injection.
KritikCVSS 9,2İstismar yokEPSS %0
- Kimlik doğrulamasız
rti · connext professional22 Eyl 2026
CVE-2026-18462
29İzleyin
Integer Overflow or Wraparound, Improper Access Control vulnerability in RTI Connext Professional (Core Libraries) allows Shared Resource Manipulation.
YüksekCVSS 7,3İstismar yokEPSS %0
- Bellek hatası
rti · connext professional22 Eyl 2026
CVE-2026-43641
38İzleyin
Softaculous Virtualizor OS Command Injection via Billing Module Handler
KritikCVSS 9,3İstismar yokEPSS %3
- Girişsiz RCE
- Kimlik doğrulama atlatma
- Deserializasyon
- Komut enjeksiyonu
softaculous · virtualizor22 Eyl 2026
CVE-2026-43642
36İzleyin
Softaculous Virtualizor PHP Object Injection via Billing Module Handler
KritikCVSS 9,2İstismar yokEPSS %0
- Girişsiz RCE
- Deserializasyon
softaculous · virtualizor22 Eyl 2026
CVE-2026-43643
34İzleyin
Softaculous Virtualizor Authorization Bypass via Billing Module Handler
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
softaculous · virtualizor22 Eyl 2026
CVE-2026-73369
40Planlayın
Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
KritikCVSS 10,0İstismar yokEPSS %1
- Girişsiz RCE
adobe · campaign22 Eyl 2026
CVE-2026-75699
40Planlayın
Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
KritikCVSS 10,0İstismar yokEPSS %1
- Girişsiz RCE
adobe · campaign22 Eyl 2026
CVE-2026-75703
40Planlayın
Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
KritikCVSS 10,0İstismar yokEPSS %1
- Girişsiz RCE
adobe · campaign22 Eyl 2026
CVE-2026-75721
40Planlayın
Adobe Campaign Classic (ACC) | Improper Control of Generation of Code ('Code Injection') (CWE-94)
KritikCVSS 10,0İstismar yokEPSS %1
- Girişsiz RCE
adobe · campaign22 Eyl 2026
CVE-2026-75723
40Planlayın
Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)
KritikCVSS 10,0İstismar yokEPSS %1
- Girişsiz RCE
- Erişim denetimi (IDOR)
adobe · campaign22 Eyl 2026