İçeriğe atla
Noroxi

Yayın tarihine göre

Eylül 2026: sömürülen ve yeni ciddi CVE kayıtları

7.953 kayıt · 32 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 64 / 80

  • CVE-2026-84502
    39İzleyin

    Automation-controller: automation-controller-container: automation-controller: project scm_url argument injection into `git ls-remote --upload-pack` yields rce

    KritikCVSS 9,9İstismar yokEPSS %0

    red hat · red hat ansible automation platform 2.4 for rhel 823 Eyl 2026

  • CVE-2026-90899
    32İzleyin

    Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0

    YüksekCVSS 8,2İstismar yokEPSS %0

    joomshaper.com · easy store extension for joomla23 Eyl 2026

  • CVE-2026-90901
    34İzleyin

    Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0

    YüksekCVSS 8,6İstismar yokEPSS %0

    joomshaper.com · easy store extension for joomla23 Eyl 2026

  • CVE-2026-90902
    34İzleyin

    Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0

    YüksekCVSS 8,6İstismar yokEPSS %0

    joomshaper.com · easy store extension for joomla23 Eyl 2026

  • CVE-2026-90903
    28İzleyin

    Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.0.0

    YüksekCVSS 7,2İstismar yokEPSS %0

    joomshaper.com · easy store extension for joomla23 Eyl 2026

  • CVE-2026-90904
    34İzleyin

    Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0

    YüksekCVSS 8,6İstismar yokEPSS %0

    joomshaper.com · easy store extension for joomla23 Eyl 2026

  • CVE-2026-90905
    28İzleyin

    Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0

    YüksekCVSS 7,2İstismar yokEPSS %0

    joomshaper.com · easy store extension for joomla23 Eyl 2026

  • CVE-2026-92730
    29İzleyin

    LimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column name

    YüksekCVSS 7,4İstismar yokEPSS %0

    limesurvey · limesurvey23 Eyl 2026

  • CVE-2026-93526
    28İzleyin

    WordPress Event Tickets plugin <= 5.29.4 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    nexcess · event tickets23 Eyl 2026

  • CVE-2026-93527
    34İzleyin

    WordPress Live Copy Paste for Elementor plugin <= 1.5.10 - SQL Injection vulnerability

    YüksekCVSS 8,5İstismar yokEPSS %0

    bdthemes · live copy paste for elementor23 Eyl 2026

  • CVE-2026-93622
    28İzleyin

    WordPress WPS Limit Login plugin <= 1.5.9.3 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    nicolaskulka · wps limit login23 Eyl 2026

  • CVE-2026-93773
    34İzleyin

    WordPress Mollie Forms plugin <= 2.11.0 - SQL Injection vulnerability

    YüksekCVSS 8,5İstismar yokEPSS %0

    nick van wobbie · mollie forms23 Eyl 2026

  • CVE-2026-93774
    28İzleyin

    WordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    jacob n. breetvelt · wp photo album plus23 Eyl 2026

  • CVE-2026-94124
    34İzleyin

    WordPress WP EasyCart plugin <= 5.9.4 - SQL Injection vulnerability

    YüksekCVSS 8,5İstismar yokEPSS %0

    levelfourdevelopment · wp easycart23 Eyl 2026

  • CVE-2026-94174
    30İzleyin

    WordPress Email Log plugin <= 2.63 - SQL Injection vulnerability

    YüksekCVSS 7,6İstismar yokEPSS %0

    webfactory · email log23 Eyl 2026

  • CVE-2026-94176
    28İzleyin

    WordPress Mang Board WP plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    kitae park · mang board wp23 Eyl 2026

  • CVE-2026-94179
    28İzleyin

    WordPress Razorpay Payment Button plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    razorpay · razorpay payment button23 Eyl 2026

  • CVE-2026-94181
    29İzleyin

    Address Bar Spoof Risk; Missing Fullscreen Notification via Select Element

    YüksekCVSS 7,4İstismar yokEPSS %0

    the browser company of new york · arc23 Eyl 2026

  • CVE-2026-94487
    32İzleyin

    WordPress PublishPress Capabilities plugin <= 2.50.1 - Cross Site Request Forgery (CSRF) vulnerability

    YüksekCVSS 8,1İstismar yokEPSS %0

    publishpress · publishpress capabilities23 Eyl 2026

  • CVE-2026-95513
    30İzleyin

    WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.6.0 - Broken Access Control vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %0

    vcita · online booking & scheduling calendar for wordpress by vcita23 Eyl 2026

  • CVE-2026-95515
    28İzleyin

    WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    kevin stover · ninja forms23 Eyl 2026

  • CVE-2026-95522
    30İzleyin

    WordPress Easy Digital Downloads plugin <= 3.7.0 - SQL Injection vulnerability

    YüksekCVSS 7,6İstismar yokEPSS %0

    syed balkhi · easy digital downloads23 Eyl 2026

  • CVE-2026-95528
    28İzleyin

    WordPress Core Web Vitals & PageSpeed Booster plugin <= 1.0.31 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    mohammed kaludi · core web vitals & pagespeed booster23 Eyl 2026

  • CVE-2026-95529
    28İzleyin

    WordPress Calculated Fields Form plugin <= 5.5.1.1 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    codepeople · calculated fields form23 Eyl 2026

  • CVE-2026-95590
    28İzleyin

    WordPress Tainacan plugin <= 1.2.0 - SQL Injection vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    tainacan · tainacan23 Eyl 2026

  • CVE-2026-95593
    30İzleyin

    WordPress Ultimeter plugin <= 3.0.8 - SQL Injection vulnerability

    YüksekCVSS 7,6İstismar yokEPSS %0

    ben roberts · ultimeter23 Eyl 2026

  • CVE-2026-95601
    37İzleyin

    WordPress Product Filter by WBW plugin <= 3.1.7 - SQL Injection vulnerability

    KritikCVSS 9,3İstismar yokEPSS %0

    wbw plugins · product filter by wbw23 Eyl 2026

  • CVE-2026-95603
    28İzleyin

    WordPress Reycob Product Import Export plugin <= 2.3.0 - PHP Object Injection vulnerability

    YüksekCVSS 7,2İstismar yokEPSS %0

    victor rodriguez · reycob product import export23 Eyl 2026

  • CVE-2026-95604
    30İzleyin

    WordPress Loops & Logic plugin <= 4.2.4 - Broken Access Control vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %0

    tangible · loops & logic23 Eyl 2026

  • CVE-2026-96770
    37İzleyin

    s2s-proxy accepts untrusted client certificates

    KritikCVSS 9,3İstismar yokEPSS %0

    temporal technologies, inc. · s2s-proxy23 Eyl 2026

  • CVE-2026-96872
    11İzleyin

    WikiLambda public function execution bypasses the unsaved-code permission through nested Z825 compositions

    DüşükCVSS 2,9Kavram kanıtıEPSS %0

    the wikimedia foundation · mediawiki - wikilambda extension23 Eyl 2026

  • CVE-2026-18181
    32İzleyin

    IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

    YüksekCVSS 8,1İstismar yokEPSS %0

    ibm · financial transaction manager23 Eyl 2026

  • CVE-2026-18184
    29İzleyin

    IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

    YüksekCVSS 7,4İstismar yokEPSS %0

    ibm · financial transaction manager23 Eyl 2026

  • CVE-2026-18185
    29İzleyin

    IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

    YüksekCVSS 7,3İstismar yokEPSS %0

    ibm · financial transaction manager23 Eyl 2026

  • CVE-2026-18490
    35İzleyin

    IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

    YüksekCVSS 8,8İstismar yokEPSS %0

    ibm · financial transaction manager23 Eyl 2026

  • CVE-2026-18872
    37İzleyin

    IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

    KritikCVSS 9,3İstismar yokEPSS %0

    ibm · financial transaction manager23 Eyl 2026

  • CVE-2026-18875
    29İzleyin

    IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

    YüksekCVSS 7,3İstismar yokEPSS %0

    ibm · financial transaction manager23 Eyl 2026

  • CVE-2026-19179
    32İzleyin

    IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

    YüksekCVSS 8,2İstismar yokEPSS %0

    ibm · financial transaction manager23 Eyl 2026

  • CVE-2026-67238
    28İzleyin

    RabbitMQ: Atom-table exhaustion via reply-to queue name decoding

    YüksekCVSS 7,1İstismar yokEPSS %0

    rabbitmq · rabbitmq-server23 Eyl 2026

  • CVE-2026-68490
    32İzleyin

    Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.

    YüksekCVSS 8,2İstismar yokEPSS %0

    webpros · cpanel23 Eyl 2026

  • CVE-2026-68492
    34İzleyin

    An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users

    YüksekCVSS 8,7İstismar yokEPSS %0

    webpros · plesk23 Eyl 2026

  • CVE-2026-75884
    36İzleyin

    Awx: awx: privilege escalation to openshift namespace via pod_spec_override injection in container groups

    KritikCVSS 9,1İstismar yokEPSS %0

    red hat · red hat ansible automation platform 2.4 for rhel 823 Eyl 2026

  • CVE-2026-82405
    34İzleyin

    Klever-Go Account takeover: `kleverUpdateAccountPermission` authorizes on attacker-controlled `RecipientAddr` instead of the authenticated caller

    YüksekCVSS 8,7İstismar yokEPSS %0

    klever-io · klever-go23 Eyl 2026

  • CVE-2026-82406
    28İzleyin

    Klever-Go: Zombie-order theft: `Buy` missing `IsClaimed` guard in native marketplace

    YüksekCVSS 7,1İstismar yokEPSS %0

    klever-io · klever-go23 Eyl 2026

  • CVE-2026-82407
    28İzleyin

    Klever-Go: Validator registration accepts an unvalidated BLS public key → consensus liveness DoS

    YüksekCVSS 7,0İstismar yokEPSS %0

    klever-io · klever-go23 Eyl 2026

  • CVE-2026-82409
    33İzleyin

    Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery

    YüksekCVSS 8,4İstismar yokEPSS %0

    klever-io · klever-go23 Eyl 2026

  • CVE-2026-84683
    34İzleyin

    Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view via ansi osc 8 hyperlink

    YüksekCVSS 8,7İstismar yokEPSS %0

    red hat · red hat ansible automation platform 2.5 for rhel 823 Eyl 2026

  • CVE-2026-84691
    34İzleyin

    Automation-controller: automation-controller-container: automation-controller: format string injection in the api 4xx error log setting discloses django secret_

    YüksekCVSS 8,7İstismar yokEPSS %0

    red hat · red hat ansible automation platform 2.5 for rhel 823 Eyl 2026

  • CVE-2026-84706
    30İzleyin

    Automation-controller: automation-controller-container: automation-controller: credential type env-injector deny-list omits process-hijacking variables (bash_en

    YüksekCVSS 7,6İstismar yokEPSS %0

    red hat · red hat ansible automation platform 2.5 for rhel 823 Eyl 2026

  • CVE-2026-84714
    28İzleyin

    Automation-controller: automation-controller: incomplete sanitize_jinja() regex allows jinja template injection into ad-hoc module_args, machine-credential fiel

    YüksekCVSS 7,1İstismar yokEPSS %0

    red hat · red hat ansible automation platform 2.5 for rhel 823 Eyl 2026

  • CVE-2026-84719
    39İzleyin

    Automation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass

    KritikCVSS 9,9İstismar yokEPSS %0

    red hat · red hat ansible automation platform 2.4 for rhel 823 Eyl 2026

  • CVE-2026-86064
    34İzleyin

    Klever-Go: /log controls global node logging

    YüksekCVSS 8,6İstismar yokEPSS %0

    klever-io · klever-go23 Eyl 2026

  • CVE-2026-87898
    37İzleyin

    OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.

    KritikCVSS 9,4İstismar yokEPSS %1

    webpros · plesk extension "site import"23 Eyl 2026

  • CVE-2026-87899
    37İzleyin

    Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.

    KritikCVSS 9,4İstismar yokEPSS %0

    webpros · cpanel23 Eyl 2026

  • CVE-2026-87900
    37İzleyin

    Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute a

    KritikCVSS 9,4İstismar yokEPSS %0

    webpros · wp toolkit for cpanel23 Eyl 2026

  • CVE-2026-94183
    29İzleyin

    Address bar spoofing risk in affected Android versions of Arc Search

    YüksekCVSS 7,4İstismar yokEPSS %0

    the browser company of new york · arc search23 Eyl 2026

  • CVE-2026-96826
    30İzleyin

    WordPress W4 Post List plugin <= 3.0.6 - SQL Injection vulnerability

    YüksekCVSS 7,6İstismar yokEPSS %0

    shazzad hossain khan · w4 post list23 Eyl 2026

  • CVE-2025-63564
    39İzleyin

    SQL injection vulnerability in Moodle Socialwall plugin v.3.0 through v.3.3 allows an attacker to execute arbitrary code via crafted HTTP re

    KritikCVSS 9,8İstismar yokEPSS %0

    23 Eyl 2026

  • CVE-2026-95844
    34İzleyin

    Moquette deeply nested MQTT topics can cause stack exhaustion

    YüksekCVSS 8,7İstismar yokEPSS %0

    moquette · moquette23 Eyl 2026

  • CVE-2026-96651
    28İzleyin

    Plex Media Server path traversal

    YüksekCVSS 7,1İstismar yokEPSS %0

    plex · media server23 Eyl 2026

  • CVE-2026-96652
    51Planlayın

    Plex Media Server SSRF

    OrtaCVSS 5,3KEVSilahlaştırılmışEPSS %0

    plex · media server23 Eyl 2026

  • CVE-2026-96654
    60Bu hafta

    Plex Media Server URL injection

    OrtaCVSS 6,9KEVSilahlaştırılmışEPSS %0

    plex · media server23 Eyl 2026

  • CVE-2026-96655
    51Planlayın

    Plex Media Server arbitrary-host SSRF

    OrtaCVSS 5,3KEVSilahlaştırılmışEPSS %0

    plex · media server23 Eyl 2026

  • CVE-2026-96656
    64Bu hafta

    Plex Media Server arbitrary file write

    YüksekCVSS 8,6KEVSilahlaştırılmışEPSS %0

    plex · media server23 Eyl 2026

  • CVE-2026-96754
    37İzleyin

    orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path

    KritikCVSS 9,3İstismar yokEPSS %0

    orval-labs · orval23 Eyl 2026

  • CVE-2026-96759
    37İzleyin

    orval before 8.29.0 Code Injection via operationId

    KritikCVSS 9,3İstismar yokEPSS %0

    orval-labs · orval23 Eyl 2026

  • CVE-2026-19125
    32İzleyin

    EthPress <= 2.3.5 - Unauthenticated Authentication Bypass

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    lynn999 · ethpress – web3 login23 Eyl 2026

  • CVE-2026-86583
    35İzleyin

    Import and export users and customers <= 2.4.17 - Authenticated (Subscriber+) Privilege Escalation via CSV Escape-Character Mismatch in Export/Import Round Trip

    YüksekCVSS 8,8İstismar yokEPSS %0

    carazo · import and export users and customers23 Eyl 2026

  • CVE-2026-93352
    37İzleyin

    Laravel-Mediable 7.0.0 < 7.0.2 RCE via .pht File Upload

    KritikCVSS 9,3İstismar yokEPSS %0

    plank · laravel-mediable23 Eyl 2026

  • CVE-2026-86926
    31İzleyin

    A heap buffer overflow vulnerability in the FileMaker Server database engine block parsing routine allowed a maliciously crafted .fmp12 data

    YüksekCVSS 7,8İstismar yokEPSS %0

    claris · filemaker server23 Eyl 2026

  • CVE-2026-86930
    36İzleyin

    An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially crafted image file to a containe

    KritikCVSS 9,1İstismar yokEPSS %0

    claris · filemaker server23 Eyl 2026

  • CVE-2026-86934
    36İzleyin

    An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header

    KritikCVSS 9,1İstismar yokEPSS %0

    claris · filemaker server23 Eyl 2026

  • CVE-2026-86938
    29İzleyin

    A DLL hijacking vulnerability in the FileMaker Pro installer for Windows allowed a local user to execute arbitrary code with elevated admini

    YüksekCVSS 7,3İstismar yokEPSS %0

    claris · filemaker pro23 Eyl 2026

  • CVE-2026-91775
    29İzleyin

    LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings

    YüksekCVSS 7,4İstismar yokEPSS %0

    limesurvey · limesurvey23 Eyl 2026

  • CVE-2026-59990
    30İzleyin

    Jawn: Uncontrolled nesting depth in JSON parser

    YüksekCVSS 7,5İstismar yokEPSS %0

    typelevel · jawn23 Eyl 2026

  • CVE-2026-61695
    30İzleyin

    Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service

    YüksekCVSS 7,5İstismar yokEPSS %0

    square · wire23 Eyl 2026

  • CVE-2026-61814
    30İzleyin

    Jawn: Quadratic parsing effort in AsyncParser

    YüksekCVSS 7,5İstismar yokEPSS %0

    typelevel · jawn23 Eyl 2026

  • CVE-2026-63132
    36İzleyin

    OpenBao's Recovery Mode Vulnerable To Token Leakage via Timing Attack

    KritikCVSS 9,2İstismar yokEPSS %0

    openbao · openbao23 Eyl 2026

  • CVE-2026-76086
    34İzleyin

    Formie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials

    YüksekCVSS 8,5İstismar yokEPSS %0

    verbb · formie23 Eyl 2026

  • CVE-2026-76087
    32İzleyin

    Formie: Unauthenticated users can overwrite incomplete submissions via submit action

    YüksekCVSS 8,2İstismar yokEPSS %0

    verbb · formie23 Eyl 2026

  • CVE-2026-76089
    30İzleyin

    Formie: Missing authorization on sent notification resend modal exposes submission PII

    YüksekCVSS 7,7İstismar yokEPSS %0

    verbb · formie23 Eyl 2026

  • CVE-2026-76648
    34İzleyin

    Automation-controller: automation-controller-container: aap controller: copyapiview.post() missing read authorization check enables job template

    YüksekCVSS 8,5İstismar yokEPSS %0

    red hat · red hat ansible automation platform 2.723 Eyl 2026

  • CVE-2026-77422
    30İzleyin

    JLine: ReDoS in Built-in grep Command Amplified by Automatic `.*` Wrapping

    YüksekCVSS 7,5İstismar yokEPSS %0

    jline · jline323 Eyl 2026

  • CVE-2026-77423
    30İzleyin

    JLine: ReDoS in Built-in Less Viewer Search

    YüksekCVSS 7,5İstismar yokEPSS %0

    jline · jline323 Eyl 2026

  • CVE-2026-77602
    39İzleyin

    OpenC3 COSMOS: Authenticated remote code execution via the user-writable config overlay (table definitions, cmd/tlm definitions, and script suites)

    KritikCVSS 9,9İstismar yokEPSS %0

    openc3 · cosmos23 Eyl 2026

  • CVE-2026-82368
    34İzleyin

    Insecure access controls on internal service ports in Brocade SANnav versions before 3.0.1a allow local, non-administrative host users to co

    YüksekCVSS 8,7İstismar yokEPSS %0

    brocade · sannav23 Eyl 2026

  • CVE-2026-96541
    30İzleyin

    Gnome-remote-desktop: gnome-remote-desktop: unauthenticated rdp sockets lack a handshake deadline

    YüksekCVSS 7,5İstismar yokEPSS %0

    red hat · red hat enterprise linux 1023 Eyl 2026

  • CVE-2026-66070
    30İzleyin

    RabbitMQ: CORS * reflects Origin with Allow-Credentials

    YüksekCVSS 7,6İstismar yokEPSS %0

    broadcom · rabbitmq server23 Eyl 2026

  • CVE-2026-66079
    32İzleyin

    RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS

    YüksekCVSS 8,2İstismar yokEPSS %0

    broadcom · rabbitmq server23 Eyl 2026

  • CVE-2026-85475
    28İzleyin

    Automation-controller: automation-controller-container: automation-controller: rsyslog configuration injection via log_aggregator_* settings leads to remote cod

    YüksekCVSS 7,2İstismar yokEPSS %0

    red hat · red hat ansible automation platform 2.723 Eyl 2026

  • CVE-2026-86065
    30İzleyin

    Klever-Go: Unauthenticated WebSocket /subscribe: no read-size limit, no connection cap, permissive origin -> remote node memory/goroutine exhaustion (DoS)

    YüksekCVSS 7,5İstismar yokEPSS %0

    klever-io · klever-go23 Eyl 2026

  • CVE-2026-89078
    39İzleyin

    Double Free in GitLab

    KritikCVSS 9,9İstismar yokEPSS %0

    gitlab · gitlab23 Eyl 2026

  • CVE-2026-93577
    39İzleyin

    Integer Overflow or Wraparound in GitLab

    KritikCVSS 9,9İstismar yokEPSS %0

    gitlab · gitlab23 Eyl 2026

  • CVE-2026-96762
    22İzleyin

    kvcache-ai mooncake RPC Path UnmountSegment authorization

    OrtaCVSS 5,5İstismar yokEPSS %0

    kvcache-ai · mooncake23 Eyl 2026

  • CVE-2026-96889
    31İzleyin

    Librsvg: use-after-free when xml includes have duplicated entities

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    red hat · red hat enterprise linux 1023 Eyl 2026

  • CVE-2026-66077
    29İzleyin

    RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI

    YüksekCVSS 7,3İstismar yokEPSS %0

    broadcom · rabbitmq server23 Eyl 2026

  • CVE-2026-67231
    36İzleyin

    RabbitMQ: Trust-store whitelist by Issuer+Serial only

    KritikCVSS 9,1İstismar yokEPSS %0

    broadcom · rabbitmq server23 Eyl 2026

  • CVE-2026-67232
    32İzleyin

    RabbitMQ: Web-MQTT decompression bomb

    YüksekCVSS 8,2İstismar yokEPSS %0

    broadcom · rabbitmq server23 Eyl 2026

  • CVE-2026-67235
    28İzleyin

    RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size

    YüksekCVSS 7,1İstismar yokEPSS %0

    broadcom · rabbitmq server23 Eyl 2026

  • CVE-2026-67404
    36İzleyin

    RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch

    KritikCVSS 9,2İstismar yokEPSS %0

    broadcom · rabbitmq server23 Eyl 2026