İçeriğe atla
Noroxi

Yayın tarihine göre

Eylül 2026: sömürülen ve yeni ciddi CVE kayıtları

7.954 kayıt · 32 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 68 / 80

  • CVE-2026-97584
    31İzleyin

    afs: Fix incorrect free in candidate cleanup in afs_lookup_server()

    YüksekCVSS 7,8İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-97589
    28İzleyin

    s390/crypto: Fix wrong return code to engine in asynch callbacks

    YüksekCVSS 7,0İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-97594
    31İzleyin

    landlock: Fix use-after-free of the source's parent directory

    YüksekCVSS 7,8İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-97595
    30İzleyin

    mac802154: fix use-after-free of sdata via queued RX frames

    YüksekCVSS 7,5İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-97602
    31İzleyin

    inet: frags: invalidate queues before flushing them

    YüksekCVSS 7,8İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-97608
    28İzleyin

    netfilter: nf_log: unregister loggers before per-net teardown

    YüksekCVSS 7,0İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-97609
    28İzleyin

    netfilter: cttimeout: prevent UAF during module unload

    YüksekCVSS 7,0İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-97611
    31İzleyin

    net: openvswitch: fix use-after-free of the flow table mask array

    YüksekCVSS 7,8İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-97612
    31İzleyin

    net: mpls: clear inner_protocol when the last label is popped

    YüksekCVSS 7,8İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-97875
    32İzleyin

    DNS rebinding vulnerability in rojo serve HTTP API

    YüksekCVSS 8,1İstismar yokEPSS %0

    rojo-rbx · rojo25 Eyl 2026

  • CVE-2026-97903
    31İzleyin

    exit: hold a reference to thread_pid across proc_flush_pid

    YüksekCVSS 7,8İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-97910
    31İzleyin

    ASoC: sprd: validate compress buffer sizes against fixed allocations

    YüksekCVSS 7,8İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-97911
    31İzleyin

    accel: ethosu: Ensure SRAM region size matches job

    YüksekCVSS 7,8İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-97926
    28İzleyin

    ufs: validate cylinder group metadata before caching it

    YüksekCVSS 7,0İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-97931
    28İzleyin

    ALSA: us122l: Prevent write upgrades for read mappings

    YüksekCVSS 7,0İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-97937
    31İzleyin

    ftrace: fork: Initialize function graph state before copy_exec_state()

    YüksekCVSS 7,8İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-97940
    31İzleyin

    ipv6: fix fib6 walker UAF on seq stop

    YüksekCVSS 7,8İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-97941
    31İzleyin

    mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-97947
    0İzleyin

    x86/amd_node: Fix potential NULL pointer dereference

    İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-97953
    28İzleyin

    net: stmmac: fix TX descriptor availability check for TSO traffic

    YüksekCVSS 7,0İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-97957
    35İzleyin

    net: hinic: fix mailbox segment buffer overflow

    YüksekCVSS 8,8İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-97971
    31İzleyin

    nstree: check listing permission before taking a namespace reference

    YüksekCVSS 7,8İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-97990
    30İzleyin

    vdpa_sim_net: check TX pull result before RX copy

    YüksekCVSS 7,5İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-97991
    31İzleyin

    vdpa_sim_blk: reject out-of-range sector starts

    YüksekCVSS 7,8İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-98002
    31İzleyin

    iommu/amd: Fix ineffective error check in nested domain allocation

    YüksekCVSS 7,8İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-98017
    31İzleyin

    net/sched: defer qdisc freeing after failed creation

    YüksekCVSS 7,8İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-98023
    31İzleyin

    vxlan: reject dynamic fdb entries that reference a nexthop id

    YüksekCVSS 7,8İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-98027
    28İzleyin

    net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size

    YüksekCVSS 7,0İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-98029
    28İzleyin

    eth: nfp: bound the ntuple rule dump by the caller's buffer size

    YüksekCVSS 7,0İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-98030
    28İzleyin

    net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size

    YüksekCVSS 7,0İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-98041
    28İzleyin

    bpf: Don't predict JMP32 pointer vs zero comparisons

    YüksekCVSS 7,0İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-98050
    30İzleyin

    mlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context

    YüksekCVSS 7,5İstismar yokEPSS %0

    linux · linux kernel25 Eyl 2026

  • CVE-2026-98052
    31İzleyin

    net: bcmasp: clear txcb->last before writing each descriptor

    YüksekCVSS 7,8İstismar yokEPSS %0

    linux · linux kernel25 Eyl 2026

  • CVE-2026-98056
    30İzleyin

    nvme: remove stale namespaces by NSID range during scan

    YüksekCVSS 7,5İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-98069
    32İzleyin

    net/rds: acquire the fastpath locks in rds_conn_shutdown()

    YüksekCVSS 8,1İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-98070
    32İzleyin

    net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()

    YüksekCVSS 8,1İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-98073
    31İzleyin

    net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().

    YüksekCVSS 7,8İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-98083
    28İzleyin

    btrfs: fix transaction use-after-free in raid stripe insertion

    YüksekCVSS 7,0İstismar yokEPSS %0

    linux · linux kernel25 Eyl 2026

  • CVE-2026-98093
    31İzleyin

    ASoC: fsl_micfil: balance mclk enable/disable

    YüksekCVSS 7,8İstismar yokEPSS %0

    linux · linux kernel25 Eyl 2026

  • CVE-2026-98096
    29İzleyin

    ipv6: sr: restore network header before routing and forwarding

    YüksekCVSS 7,4İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-98108
    30İzleyin

    Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan

    YüksekCVSS 7,5İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-98112
    31İzleyin

    ksmbd: fix listener task lifetime on netdev events

    YüksekCVSS 7,8İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-98115
    35İzleyin

    ksmbd: safely drain sessions during logoff

    YüksekCVSS 8,8İstismar yokEPSS %0

    linux · linux kernel25 Eyl 2026

  • CVE-2026-98116
    31İzleyin

    ALSA: pcm: Serialize PCM mmap with buffer reallocation to fix page UAF

    YüksekCVSS 7,8İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-98122
    31İzleyin

    vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()

    YüksekCVSS 7,8İstismar yokEPSS %0

    linux · linux kernel25 Eyl 2026

  • CVE-2026-98130
    32İzleyin

    sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START

    YüksekCVSS 8,1İstismar yokEPSS %0

    linux · linux kernel25 Eyl 2026

  • CVE-2026-98136
    28İzleyin

    ntfs: bound $AttrDef table walk to the loaded table size

    YüksekCVSS 7,1İstismar yokEPSS %0

    linux · linux kernel25 Eyl 2026

  • CVE-2026-98143
    31İzleyin

    accel: ethosu: Don't read the U65 rounding mode as a storage mode

    YüksekCVSS 7,8İstismar yokEPSS %0

    linux · linux25 Eyl 2026

  • CVE-2026-98149
    31İzleyin

    bpf: Fix percpu map update indexing with sparse CPU IDs

    YüksekCVSS 7,8İstismar yokEPSS %0

    linux · linux kernel25 Eyl 2026

  • CVE-2026-98150
    28İzleyin

    bpf: Fix BPF_F_CPU validation for sparse CPU IDs

    YüksekCVSS 7,0İstismar yokEPSS %0

    linux · linux kernel25 Eyl 2026

  • CVE-2026-98154
    28İzleyin

    nvme-rdma: fix -EIO cleanup order in queue_rq

    YüksekCVSS 7,0İstismar yokEPSS %0

    linux · linux kernel25 Eyl 2026

  • CVE-2026-98155
    28İzleyin

    accel/qaic: Address potential out-of-bounds read in resp_worker()

    YüksekCVSS 7,1İstismar yokEPSS %0

    linux · linux kernel25 Eyl 2026

  • CVE-2026-98156
    31İzleyin

    drm/virtio: use the DMA API for resource backing on Xen

    YüksekCVSS 7,8İstismar yokEPSS %0

    linux · linux kernel25 Eyl 2026

  • CVE-2026-96812
    35İzleyin

    Host Root Sandbox Escape in gVisor via Character Device Passthrough and CUSE

    YüksekCVSS 8,8İstismar yokEPSS %0

    google · gvisor25 Eyl 2026

  • CVE-2026-39353
    36İzleyin

    InvoicePlane: Remote Code Execution via Writable Templates Directory

    KritikCVSS 9,1İstismar yokEPSS %0

    invoiceplane · invoiceplane25 Eyl 2026

  • CVE-2026-42322
    36İzleyin

    Piwigo: Authenticated RCE via File Upload in Logo Upload Feature

    KritikCVSS 9,1İstismar yokEPSS %0

    piwigo · piwigo25 Eyl 2026

  • CVE-2026-42323
    28İzleyin

    Piwigo: SQL Injection in Batch Manager

    YüksekCVSS 7,2İstismar yokEPSS %0

    piwigo · piwigo25 Eyl 2026

  • CVE-2026-42324
    28İzleyin

    Piwigo: Second-Order SQL Injection

    YüksekCVSS 7,2İstismar yokEPSS %0

    piwigo · piwigo25 Eyl 2026

  • CVE-2026-44642
    32İzleyin

    Piwigo: SQL injection in upgrade authentication allows unauthenticated upgrade authorization bypass (PHP 8+)

    YüksekCVSS 8,1İstismar yokEPSS %1

    piwigo · piwigo25 Eyl 2026

  • CVE-2026-49850
    30İzleyin

    InvoicePlane: Missing CSRF Protection on State-Changing delete Actions

    YüksekCVSS 7,5İstismar yokEPSS %0

    invoiceplane · invoiceplane25 Eyl 2026

  • CVE-2026-50547
    30İzleyin

    InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier

    YüksekCVSS 7,5İstismar yokEPSS %0

    invoiceplane · invoiceplane25 Eyl 2026

  • CVE-2025-51457
    35İzleyin

    D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpo

    YüksekCVSS 8,8İstismar yokEPSS %1

    25 Eyl 2026

  • CVE-2026-56723
    28İzleyin

    Zammad: Missing authorization on ticket attachment download

    YüksekCVSS 7,1İstismar yokEPSS %0

    zammad · zammad25 Eyl 2026

  • CVE-2026-56724
    28İzleyin

    Zammad: Incorrect implementation of permission checks in the knowledge base module

    YüksekCVSS 7,1İstismar yokEPSS %0

    zammad · zammad25 Eyl 2026

  • CVE-2026-51772
    26İzleyin

    A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance.

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    25 Eyl 2026

  • CVE-2026-51773
    32İzleyin

    An issue in the VMware datastore driver of OpenStack glance_store.

    YüksekCVSS 8,1İstismar yokEPSS %0

    25 Eyl 2026

  • CVE-2026-52622
    30İzleyin

    An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows

    YüksekCVSS 7,5İstismar yokEPSS %0

    25 Eyl 2026

  • CVE-2026-79153
    31İzleyin

    Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that al

    YüksekCVSS 7,8İstismar yokEPSS %0

    25 Eyl 2026

  • CVE-2026-88421
    30İzleyin

    Incorrect access control in the BlogPage.get_entries() component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to vie

    YüksekCVSS 7,5İstismar yokEPSS %0

    25 Eyl 2026

  • CVE-2026-95832
    37İzleyin

    Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell

    KritikCVSS 9,3İstismar yokEPSS %0

    kovid goyal · kitty25 Eyl 2026

  • CVE-2026-100072
    31İzleyin

    ACPI: platform: Use acpi_bus_get_primary_device()

    YüksekCVSS 7,8İstismar yokEPSS %0

    linux · linux kernel25 Eyl 2026

  • CVE-2026-100075
    39İzleyin

    RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters

    KritikCVSS 9,8İstismar yokEPSS %0

    linux · linux kernel25 Eyl 2026

  • CVE-2026-84884
    35İzleyin

    IBM Guardium Data Protection is affected by multiple vulnerabilities.

    YüksekCVSS 8,8İstismar yokEPSS %0

    ibm · guardium data protection25 Eyl 2026

  • CVE-2026-85029
    35İzleyin

    IBM Guardium Data Protection is affected by multiple vulnerabilities.

    YüksekCVSS 8,8İstismar yokEPSS %0

    ibm · guardium data protection25 Eyl 2026

  • CVE-2026-85542
    36İzleyin

    IBM Guardium Data Protection is affected by multiple vulnerabilities.

    YüksekCVSS 8,8İstismar yokEPSS %2

    ibm · guardium data protection25 Eyl 2026

  • CVE-2026-93641
    37İzleyin

    Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation

    KritikCVSS 9,3İstismar yokEPSS %0

    zimbra · zimbra collaboration suite (zcs)25 Eyl 2026

  • CVE-2026-93642
    37İzleyin

    Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation

    KritikCVSS 9,3İstismar yokEPSS %0

    zimbra · zimbra collaboration suite (zcs)25 Eyl 2026

  • CVE-2026-93643
    39İzleyin

    Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Request

    KritikCVSS 9,8İstismar yokEPSS %0

    zimbra · zimbra collaboration suite (zcs)25 Eyl 2026

  • CVE-2026-93647
    37İzleyin

    Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address

    KritikCVSS 9,3İstismar yokEPSS %0

    zimbra · zimbra collaboration suite (zcs)25 Eyl 2026

  • CVE-2026-93834
    35İzleyin

    Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    red hat · red hat enterprise linux 1025 Eyl 2026

  • CVE-2026-56727
    28İzleyin

    Zammad: PGP signature spoofing via unvalidated verification return

    YüksekCVSS 7,1İstismar yokEPSS %0

    zammad · zammad25 Eyl 2026

  • CVE-2026-56731
    33İzleyin

    Zammad: Cross-Site Scripting in Ticket Notifications

    YüksekCVSS 8,4İstismar yokEPSS %0

    zammad · zammad25 Eyl 2026

  • CVE-2026-56733
    34İzleyin

    Zammad: Incorrect Authorization and Improper Privilege Management

    YüksekCVSS 8,7İstismar yokEPSS %0

    zammad · zammad25 Eyl 2026

  • CVE-2026-61525
    35İzleyin

    Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controller

    YüksekCVSS 8,8İstismar yokEPSS %0

    zammad · zammad25 Eyl 2026

  • CVE-2026-84462
    34İzleyin

    Zammad: AI Agent template sanitizer bypass leads to remote code execution

    YüksekCVSS 8,6İstismar yokEPSS %0

    zammad · zammad25 Eyl 2026

  • CVE-2026-47679
    34İzleyin

    GLPI: arbitrary file deletion

    YüksekCVSS 8,5İstismar yokEPSS %0

    glpi-project · glpi25 Eyl 2026

  • CVE-2026-49470
    30İzleyin

    GLPI: Missing Rate Limiting on Login and TOTP Verification — Account Takeover via Brute Force

    YüksekCVSS 7,7İstismar yokEPSS %0

    glpi-project · glpi25 Eyl 2026

  • CVE-2026-53625
    30İzleyin

    GLPI: Privilege Escalation via authtype API manipulation

    YüksekCVSS 7,5Kavram kanıtıEPSS %0

    glpi-project · glpi25 Eyl 2026

  • CVE-2026-53629
    28İzleyin

    GLPI: SQL injection in history tab

    YüksekCVSS 7,1Kavram kanıtıEPSS %1

    glpi-project · glpi25 Eyl 2026

  • CVE-2026-84862
    28İzleyin

    IBM Guardium Data Protection is affected by multiple vulnerabilities.

    YüksekCVSS 7,2İstismar yokEPSS %0

    ibm · guardium data protection25 Eyl 2026

  • CVE-2026-93306
    28İzleyin

    This Power System update is being released to address

    YüksekCVSS 7,1İstismar yokEPSS %0

    ibm · power system e1080 (9080-hex) firmware25 Eyl 2026

  • CVE-2026-84458
    36İzleyin

    Zammad: Account takeover via unverified email matching during SSO auto-link

    KritikCVSS 9,1İstismar yokEPSS %0

    zammad · zammad25 Eyl 2026

  • CVE-2026-84464
    28İzleyin

    Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization data

    YüksekCVSS 7,1İstismar yokEPSS %0

    zammad · zammad25 Eyl 2026

  • CVE-2026-33639
    28İzleyin

    InvoicePlane permits DDL injection through tax_rate_decimal_places

    YüksekCVSS 7,2İstismar yokEPSS %0

    invoiceplane · invoiceplane25 Eyl 2026

  • CVE-2026-62262
    36İzleyin

    Piwigo: Unauthenticated SQL injection in `pwg.images.filteredSearch.create`

    KritikCVSS 9,1İstismar yokEPSS %0

    piwigo · piwigo25 Eyl 2026

  • CVE-2026-67236
    32İzleyin

    RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login

    YüksekCVSS 8,2İstismar yokEPSS %0

    broadcom · rabbitmq server25 Eyl 2026

  • CVE-2026-92161
    39İzleyin

    FriendsOfFlarum OAuth: Unauthenticated account takeover via unverified email trust in Discord OAuth provider

    KritikCVSS 9,8İstismar yokEPSS %0

    friendsofflarum · oauth25 Eyl 2026

  • CVE-2026-96874
    9İzleyin

    Stored XSS in Cargo Drilldown tab names

    DüşükCVSS 2,3Kavram kanıtıEPSS %0

    the wikimedia foundation · mediawiki - cargo extension25 Eyl 2026

  • CVE-2026-100248
    33İzleyin

    The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an unintended value of current_admin.

    YüksekCVSS 8,4İstismar yokEPSS %0

    rattadan · cosmowarp contract25 Eyl 2026

  • CVE-2026-67237
    30İzleyin

    RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint

    YüksekCVSS 7,5İstismar yokEPSS %0

    broadcom · rabbitmq server25 Eyl 2026