Yayın tarihine göre
Eylül 2026: sömürülen ve yeni ciddi CVE kayıtları
7.957 kayıt · 32 KEV. Yayın sırasıyla.
Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.
Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.
Sayfa 72 / 80
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
28İzleyin | CVE-2026-94286İstismar yok | Out-of-bounds read in libXtst's RECORD reply parserx.org · libxtst · CWE-126 | Yüksek7,1 | — | %0,2 | 28 Eyl 2026 |
34İzleyin | CVE-2026-95104İstismar yok | Stack-based buffer overflow vulnerability exists in BUFFALO Wi-Fi products.buffalo inc. · wsr-300hp · CWE-121 | Yüksek8,7 | — | %0,3 | 28 Eyl 2026 |
32İzleyin | CVE-2026-82323İstismar yok | Improper Authorization in Enocta Educational's Enocta Platformenocta educational technologies inc. · enocta platform · CWE-639 | Yüksek8,1 | — | %0,2 | 28 Eyl 2026 |
34İzleyin | CVE-2026-101037İstismar yok | FAST FAC1200R devdiscover Service parse_advertisement_frame stack-based overflowfast · fac1200r · CWE-119 | Yüksek8,6 | — | %0,4 | 28 Eyl 2026 |
29İzleyin | CVE-2026-90979İstismar yok | Apache Karaf: LDAP filter injection in JAAS LDAP login modulesapache · karaf · CWE-90 | Yüksek7,3 | — | %0,4 | 28 Eyl 2026 |
38İzleyin | CVE-2026-101072İstismar yok | Netcore NR289-GE CGI ap_ip.cgi system os command injectionnetcore · nr289-ge · CWE-77 | Kritik9,3 | — | %1,9 | 28 Eyl 2026 |
29İzleyin | CVE-2026-12267İstismar yok | Authenticated PowerShell Injection in DNS Query Resolution Policy leads to RCEzohocorp · ddi central · CWE-20 | Yüksek7,2 | — | %3,6 | 28 Eyl 2026 |
36İzleyin | CVE-2026-12268İstismar yok | Authenticated PowerShell Injection leads to RCEzohocorp · ddi central · CWE-20 | Yüksek8,8 | — | %4,7 | 28 Eyl 2026 |
37İzleyin | CVE-2026-12269İstismar yok | Authenticated File Write to RCE via keepalived in DDI Centralzohocorp · ddi central · CWE-269 | Yüksek8,8 | — | %6,9 | 28 Eyl 2026 |
37İzleyin | CVE-2026-19759İstismar yok | Incorrect Authorization in Application Integration allows Internal Stubby RPC Executiongoogle cloud · application integration · CWE-863 | Kritik9,4 | — | %0,2 | 28 Eyl 2026 |
33İzleyin | CVE-2026-81375İstismar yok | Confused Deputy in Application Integration allows Internal File Readgoogle cloud · application integration · CWE-610 | Yüksek8,3 | — | %0,3 | 28 Eyl 2026 |
37İzleyin | CVE-2026-81867İstismar yok | Deserialization of Untrusted Data in Application Integration allows Remote Code Executiongoogle cloud · application integration · CWE-502 | Kritik9,4 | — | %0,3 | 28 Eyl 2026 |
35İzleyin | CVE-2026-91006İstismar yok | Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)apache · karaf · CWE-78 | Yüksek8,8 | — | %1,1 | 28 Eyl 2026 |
36İzleyin | CVE-2026-12264İstismar yok | Authenticated File Write via HA Failover Config Upload leads to RCEzohocorp · ddi central · CWE-434 | Yüksek8,8 | — | %1,9 | 28 Eyl 2026 |
35İzleyin | CVE-2026-78424İstismar yok | OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes Nodessuse · neuvector · CWE-78 | Yüksek8,8 | — | %0,1 | 28 Eyl 2026 |
32İzleyin | CVE-2026-91043İstismar yok | HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memoryelixir-mint · mint · CWE-770 | Yüksek8,2 | — | %0,4 | 28 Eyl 2026 |
32İzleyin | CVE-2026-101292İstismar yok | Artemis-core-client: unsafe reflection in apache activemq artemis federation message deserializationred hat · red hat amq broker 7 · CWE-470 | Yüksek8,2 | — | %0,5 | 28 Eyl 2026 |
35İzleyin | CVE-2026-12265İstismar yok | Missing Authorization on HA Failover Config allows Complete Data Destructionzohocorp · ddi central · CWE-284 | Yüksek8,8 | — | %0,8 | 28 Eyl 2026 |
28İzleyin | CVE-2026-52748İstismar yok | Missing authentication for backup functionality in Kaon AR2140Xkaon · ar2140 · CWE-306 | Yüksek7,1 | — | %0,2 | 28 Eyl 2026 |
30İzleyin | CVE-2026-82928İstismar yok | Undocumented access path in mH-DEVELOPERf&f filipowski · mh-developer · CWE-1242 | Yüksek7,7 | — | %0,1 | 28 Eyl 2026 |
29İzleyin | CVE-2026-86330İstismar yok | Noobaa-core: noobaa-core: os command injection in cluster_internal_api.set_hostname_internalred hat · red hat openshift data foundation 4 · CWE-78 | Yüksek7,2 | — | %2,1 | 28 Eyl 2026 |
31İzleyin | GHSA-456v-xq2p-r4cjİstismar yok | code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)CWE-78 | Yüksek7,8 | — | — | 28 Eyl 2026 |
28İzleyin | CVE-2026-15952İstismar yok | Improper Permission Assignment in Scheduler Serviceabb · protection and control ied manager (pcm600) · CWE-732 | Yüksek7,1 | — | %0,0 | 28 Eyl 2026 |
37İzleyin | CVE-2026-73640İstismar yok | Time-based SQL Injection in Dayforce ESS Excelitydayforce · payroll · CWE-89 | Kritik9,3 | — | %0,2 | 28 Eyl 2026 |
36İzleyin | CVE-2026-73642İstismar yok | Path Traversal in Dayforce ESS Excelitydayforce · payroll · CWE-22 | Kritik9,2 | — | %0,4 | 28 Eyl 2026 |
38İzleyin | CVE-2026-85185İstismar yok | Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as rootcanonical · lxd · CWE-22 | Kritik9,6 | — | %0,3 | 28 Eyl 2026 |
39İzleyin | CVE-2026-85526İstismar yok | Path traversal via Btrfs optimized-backup subvolumes[].path enables root file/dir manipulation in LXDcanonical · lxd · CWE-22 | Kritik9,9 | — | %0,5 | 28 Eyl 2026 |
35İzleyin | CVE-2026-86595Kavram kanıtı | SQLi in Iron Mountain's enVisioniron mountain archiving services inc. · envision · CWE-89 | Yüksek8,8 | — | %0,2 | 28 Eyl 2026 |
39İzleyin | CVE-2026-87799İstismar yok | Arbitrary file write on LXD host via symlink in migration streamcanonical · lxd · CWE-59 | Kritik9,9 | — | %0,4 | 28 Eyl 2026 |
39İzleyin | CVE-2026-90924İstismar yok | Default Admin Credentials in Innotim Software's Logsign SIEMinnotim software, telecommunications and consultancy trade ltd. co. · logsign siem · CWE-1392 | Kritik9,8 | — | %0,2 | 28 Eyl 2026 |
28İzleyin | CVE-2026-90925İstismar yok | Path Traversal in Innotim Software's Logsign SIEMinnotim software, telecommunications and consultancy trade ltd. co. · logsign siem · CWE-22 | Yüksek7,1 | — | %0,2 | 28 Eyl 2026 |
35İzleyin | CVE-2026-90926İstismar yok | Code Injection in Innotim Software's Logsign SIEMinnotim software, telecommunications and consultancy trade ltd. co. · logsign siem · CWE-94 | Yüksek8,8 | — | %0,2 | 28 Eyl 2026 |
30İzleyin | CVE-2026-97335İstismar yok | Incorrect authorization in LXD storage volume API allows reading volumes from other projectscanonical · lxd · CWE-863 | Yüksek7,7 | — | %0,2 | 28 Eyl 2026 |
35İzleyin | CVE-2026-101074İstismar yok | Netcore NR289-GE Authentication boa password-check stack-based overflownetcore · nr289-ge · CWE-119 | Yüksek8,9 | — | %0,7 | 28 Eyl 2026 |
38İzleyin | CVE-2026-101075İstismar yok | Netcore NR289-GE Location Time location_time.cgi system os command injectionnetcore · nr289-ge · CWE-77 | Kritik9,3 | — | %2,0 | 28 Eyl 2026 |
31İzleyin | CVE-2026-4556İstismar yok | macOS Exam4 Local Privilege Escalation via Command Injectionextegrity · exam4 · CWE-78 | Yüksek7,8 | — | %0,8 | 28 Eyl 2026 |
28İzleyin | CVE-2026-80357İstismar yok | Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access dell · boot optimized server storage (boss) · CWE-1191 | Yüksek7,0 | — | %0,1 | 28 Eyl 2026 |
28İzleyin | CVE-2026-93538İstismar yok | Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleetsuse · rancher fleet · CWE-290 | Yüksek7,1 | — | %0,1 | 28 Eyl 2026 |
34İzleyin | CVE-2026-96538İstismar yok | WarehousePG pg_file_write/pg_file_rename/pg_file_unlink/pg_logdir_ls privilege escalationenterprisedb · warehousepg · CWE-862 | Yüksek8,7 | — | %0,3 | 28 Eyl 2026 |
38İzleyin | CVE-2026-101076İstismar yok | Netcore NR289-GE CGI set_ntp_server_ip.cgi system os command injectionnetcore · nr289-ge · CWE-77 | Kritik9,3 | — | %2,0 | 28 Eyl 2026 |
37İzleyin | CVE-2026-101077İstismar yok | Netcore NR289-GE boa_temp process_request missing authenticationnetcore · nr289-ge · CWE-287 | Kritik9,3 | — | %0,7 | 28 Eyl 2026 |
38İzleyin | CVE-2026-12342İstismar yok | SailPoint IdentityIQ Improper Form Validation Vulnerabilitysailpoint technologies · identityiq · CWE-20 | Kritik9,6 | — | %0,1 | 28 Eyl 2026 |
38İzleyin | CVE-2026-88804İstismar yok | Unauthenticated update of public UI settings leading to stored cross-site scripting in Ranchersuse · rancher · CWE-79 | Kritik9,6 | — | %0,3 | 28 Eyl 2026 |
32İzleyin | CVE-2026-88805İstismar yok | Session Not Revoked Server-Side on Logout in Ranchersuse · rancher · CWE-613 | Yüksek8,1 | — | %0,2 | 28 Eyl 2026 |
35İzleyin | CVE-2026-88808İstismar yok | Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusterssuse · rancher fleet · CWE-250 | Yüksek8,8 | — | %0,2 | 28 Eyl 2026 |
34İzleyin | CVE-2026-93348İstismar yok | Unsloth Zoo Code Injection via model_type in config.jsonunslothai · unsloth-zoo · CWE-94 | Yüksek8,6 | — | %0,4 | 28 Eyl 2026 |
34İzleyin | CVE-2026-101081İstismar yok | D-Link DI-8400 Web Administration Service menu_nat_more.asp menu_nat_more_asp stack-based overflowd-link · di-8400 · CWE-119 | Yüksek8,5 | — | %0,5 | 28 Eyl 2026 |
37İzleyin | CVE-2026-101891İstismar yok | WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Accesswatchguard · watchguard ap · CWE-284 | Kritik9,3 | — | %0,3 | 28 Eyl 2026 |
36İzleyin | CVE-2026-101894Kavram kanıtı | @xhmikosr/decompress: Path traversal via symlink chainxhmikosr · decompress · CWE-22 | Kritik9,1 | — | %0,8 | 28 Eyl 2026 |
34İzleyin | CVE-2026-48100İstismar yok | Payy: agg_agg trailing message slots are unconstrained and allow forged burn messagespolybase · payy · CWE-349 | Yüksek8,7 | — | %0,1 | 28 Eyl 2026 |
32İzleyin | CVE-2026-54160İstismar yok | Network UPS Tools: A PWN Request in make-dist workflow can execute PR-controlled code with write-scoped GITHUB_TOKENnetworkupstools · nut · CWE-829 | Yüksek8,2 | — | %0,1 | 28 Eyl 2026 |
28İzleyin | CVE-2026-55096İstismar yok | SSRF via DNS-resolution gap in _validate_url_security (file download by URL)leshchenko1979 · fast-mcp-telegram · CWE-184 | Yüksek7,1 | — | %0,2 | 28 Eyl 2026 |
30İzleyin | CVE-2026-85644İstismar yok | XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array referenceCWE-125 | Yüksek7,5 | — | %0,3 | 28 Eyl 2026 |
38İzleyin | CVE-2026-86102İstismar yok | WatchGuard AP Command Injection in Internal Management API Allows Command Executionwatchguard · watchguard ap · CWE-78 | Kritik9,3 | — | %2,2 | 28 Eyl 2026 |
28İzleyin | CVE-2026-87114İstismar yok | Kube-compare: container:// reference extraction runs the image entrypoint and silently escalates to sudored hat · pen drive powered by red hat lightspeed · CWE-829 | Yüksek7,1 | — | %0,3 | 28 Eyl 2026 |
34İzleyin | CVE-2026-87969İstismar yok | WatchGuard AP Authenticated Command Injection in Diagnostic CLIwatchguard · watchguard ap · CWE-78 | Yüksek8,6 | — | %1,3 | 28 Eyl 2026 |
30İzleyin | CVE-2026-88816İstismar yok | DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyNameCWE-843 | Yüksek7,5 | — | %0,3 | 28 Eyl 2026 |
28İzleyin | CVE-2026-101898İstismar yok | Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controlsaxios · axios · CWE-918 | Yüksek7,0 | — | %0,5 | 28 Eyl 2026 |
32İzleyin | CVE-2026-101901İstismar yok | Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initializationaxios · axios · CWE-400 | Yüksek8,2 | — | %0,5 | 28 Eyl 2026 |
32İzleyin | CVE-2026-101903İstismar yok | Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)axios · axios · CWE-1333 | Yüksek8,2 | — | %0,4 | 28 Eyl 2026 |
30İzleyin | CVE-2026-101905İstismar yok | Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnectionaxios · axios · CWE-441 | Yüksek7,6 | — | %0,4 | 28 Eyl 2026 |
32İzleyin | CVE-2026-101906İstismar yok | Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Locationaxios · axios · CWE-400 | Yüksek8,2 | — | %0,4 | 28 Eyl 2026 |
28İzleyin | CVE-2026-101907İstismar yok | Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRFaxios · axios · CWE-441 | Yüksek7,0 | — | %0,4 | 28 Eyl 2026 |
33İzleyin | CVE-2026-101909İstismar yok | Axios: Prototype Pollution Gadget in axios toFormData Optionsaxios · axios · CWE-1321 | Yüksek8,3 | — | %0,4 | 28 Eyl 2026 |
30İzleyin | CVE-2026-45562İstismar yok | FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Modulesangoma · freepbx · CWE-78 | Yüksek7,7 | — | %0,3 | 28 Eyl 2026 |
36İzleyin | CVE-2026-49994İstismar yok | Bluehood: Missing authentication on Bluehood API routes when web auth is enableddannymcc · bluehood · CWE-306 | Kritik9,1 | — | %0,2 | 28 Eyl 2026 |
34İzleyin | CVE-2026-54674İstismar yok | Authenticated Command Injection in FreePBX UCP Interfacesangoma · freepbx · CWE-78 | Yüksek8,6 | — | %0,8 | 28 Eyl 2026 |
34İzleyin | CVE-2026-54675İstismar yok | FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Modulesangoma · freepbx · CWE-22 | Yüksek8,7 | — | %0,6 | 28 Eyl 2026 |
34İzleyin | CVE-2026-54708İstismar yok | Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Modulesangoma · freepbx · CWE-22 | Yüksek8,6 | — | %0,5 | 28 Eyl 2026 |
34İzleyin | CVE-2026-54710İstismar yok | FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)sangoma · freepbx · CWE-20 | Yüksek8,6 | — | %0,5 | 28 Eyl 2026 |
33İzleyin | CVE-2026-55157İstismar yok | Token Optimizer MCP: OS command injection in smart_user via username in get-user-infoooples · token-optimizer-mcp · CWE-78 | Yüksek8,4 | — | %0,8 | 28 Eyl 2026 |
30İzleyin | CVE-2026-55160İstismar yok | Authenticated Server-Side Request Forgery (SSRF) via feed URL in Stringerstringer-rss · stringer · CWE-918 | Yüksek7,6 | — | %0,2 | 28 Eyl 2026 |
34İzleyin | CVE-2026-75600İstismar yok | FreePBX: Authenticated API generatedocs Host Command Injectionsangoma · freepbx · CWE-78 | Yüksek8,6 | — | %0,8 | 28 Eyl 2026 |
37İzleyin | CVE-2026-100752Kavram kanıtı | Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9ordasoft.com · real estate manager (free) extension for joomla · CWE-89 | Kritik9,3 | — | %0,2 | 28 Eyl 2026 |
37İzleyin | CVE-2026-101108Kavram kanıtı | Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8ordasoft.com · vehicle manager (free) extension for joomla · CWE-89 | Kritik9,3 | — | %0,2 | 28 Eyl 2026 |
37İzleyin | CVE-2026-101110Kavram kanıtı | Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6ordasoft · book library · CWE-89 | Kritik9,3 | — | %0,3 | 28 Eyl 2026 |
28İzleyin | CVE-2026-102010İstismar yok | Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_ifred hat · red hat enterprise linux 10 · CWE-825 | Yüksek7,0 | — | %0,3 | 28 Eyl 2026 |
30İzleyin | CVE-2026-84894İstismar yok | In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidatemeta platforms, inc · moxygen · CWE-416 | Yüksek7,5 | — | %0,2 | 28 Eyl 2026 |
28İzleyin | CVE-2026-97023İstismar yok | Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/binred hat · red hat enterprise linux 10 · CWE-61 | Yüksek7,1 | — | %0,2 | 28 Eyl 2026 |
31İzleyin | CVE-2026-102004İstismar yok | Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory management subsystem.wind river systems inc · vxworks 7 · CWE-787 | Yüksek7,8 | — | %0,1 | 28 Eyl 2026 |
73Bu hafta | CVE-2026-86950Silahlaştırılmış | An out-of-bounds write issue was addressed with improved bounds checking.apple · ipados · CWE-787 | Yüksek8,8 | KEV | %26,1 | 28 Eyl 2026 |
35İzleyin | CVE-2026-87741İstismar yok | ConvertPlus <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parameterbrainstorm force · convertplus · CWE-78 | Yüksek8,8 | — | %0,3 | 28 Eyl 2026 |
30İzleyin | CVE-2026-93355Kavram kanıtı | LiteLLM Weak JWT Authentication via Email-Based User Lookupberriai · litellm · CWE-1390 | Yüksek7,6 | — | %0,2 | 28 Eyl 2026 |
39İzleyin | CVE-2026-96760Kavram kanıtı | Authlib library contains a signature‑verification bypass vulnerabilityauthlib · authlib · CWE-20 | Kritik9,8 | — | %0,3 | 28 Eyl 2026 |
34İzleyin | CVE-2026-100371İstismar yok | InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recoveryinvoiceplane · invoiceplane · CWE-863 | Yüksek8,7 | — | %0,3 | 28 Eyl 2026 |
28İzleyin | CVE-2026-100392İstismar yok | InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)invoiceplane · invoiceplane · CWE-863 | Yüksek7,0 | — | %0,2 | 28 Eyl 2026 |
35İzleyin | CVE-2026-101187İstismar yok | Ziroom ZHOME A0101 USB Device Management API zrUsb.lua pop_usb_device command injectionziroom · zhome a0101 · CWE-74 | Yüksek8,5 | — | %2,3 | 28 Eyl 2026 |
29İzleyin | CVE-2026-101916İstismar yok | @grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorizedgrpc · grpc-node · CWE-295 | Yüksek7,4 | — | %0,2 | 28 Eyl 2026 |
30İzleyin | CVE-2026-101917İstismar yok | PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)pyjwt project · pyjwt · CWE-770 | Yüksek7,5 | — | %0,4 | 28 Eyl 2026 |
30İzleyin | CVE-2026-101918İstismar yok | PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)pyjwt project · pyjwt · CWE-248 | Yüksek7,5 | — | %0,4 | 28 Eyl 2026 |
36İzleyin | CVE-2026-102266İstismar yok | PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validationpyjwt project · pyjwt · CWE-347 | Kritik9,1 | — | %0,2 | 28 Eyl 2026 |
36İzleyin | CVE-2026-102267İstismar yok | PyJWT: PyJWKClient follows redirects when fetching JWKSpyjwt project · pyjwt · CWE-200 | Kritik9,1 | — | %0,1 | 28 Eyl 2026 |
36İzleyin | CVE-2026-102268Kavram kanıtı | PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guardpyjwt project · pyjwt · CWE-347 | Kritik9,1 | — | %0,2 | 28 Eyl 2026 |
29İzleyin | CVE-2026-102271İstismar yok | PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guardpyjwt project · pyjwt · CWE-347 | Yüksek7,4 | — | %0,2 | 28 Eyl 2026 |
29İzleyin | CVE-2026-102272İstismar yok | PyJWT is a Python implementation of JSON Web Token standards.pyjwt project · pyjwt · CWE-347 | Yüksek7,4 | — | %0,2 | 28 Eyl 2026 |
29İzleyin | CVE-2026-102273İstismar yok | PyJWT accepts public JWK containers as HMAC secretspyjwt project · pyjwt · CWE-347 | Yüksek7,4 | — | %0,1 | 28 Eyl 2026 |
30İzleyin | CVE-2026-102274İstismar yok | PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Setpyjwt project · pyjwt · CWE-755 | Yüksek7,5 | — | %0,5 | 28 Eyl 2026 |
32İzleyin | CVE-2026-102275İstismar yok | PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusionpyjwt project · pyjwt · CWE-345 | Yüksek8,2 | — | %0,1 | 28 Eyl 2026 |
30İzleyin | CVE-2026-102276İstismar yok | brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustionjuliangruber · brace-expansion · CWE-400 | Yüksek7,5 | — | %0,4 | 28 Eyl 2026 |
30İzleyin | CVE-2026-102278İstismar yok | brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustionjuliangruber · brace-expansion · CWE-400 | Yüksek7,5 | — | %0,4 | 28 Eyl 2026 |
- CVE-2026-9428628İzleyin
Out-of-bounds read in libXtst's RECORD reply parser
YüksekCVSS 7,1İstismar yokEPSS %0x.org · libxtst28 Eyl 2026
- CVE-2026-9510434İzleyin
Stack-based buffer overflow vulnerability exists in BUFFALO Wi-Fi products.
YüksekCVSS 8,7İstismar yokEPSS %0buffalo inc. · wsr-300hp28 Eyl 2026
- CVE-2026-8232332İzleyin
Improper Authorization in Enocta Educational's Enocta Platform
YüksekCVSS 8,1İstismar yokEPSS %0enocta educational technologies inc. · enocta platform28 Eyl 2026
- CVE-2026-10103734İzleyin
FAST FAC1200R devdiscover Service parse_advertisement_frame stack-based overflow
YüksekCVSS 8,6İstismar yokEPSS %0fast · fac1200r28 Eyl 2026
- CVE-2026-9097929İzleyin
Apache Karaf: LDAP filter injection in JAAS LDAP login modules
YüksekCVSS 7,3İstismar yokEPSS %0apache · karaf28 Eyl 2026
- CVE-2026-10107238İzleyin
Netcore NR289-GE CGI ap_ip.cgi system os command injection
KritikCVSS 9,3İstismar yokEPSS %1netcore · nr289-ge28 Eyl 2026
- CVE-2026-1226729İzleyin
Authenticated PowerShell Injection in DNS Query Resolution Policy leads to RCE
YüksekCVSS 7,2İstismar yokEPSS %3zohocorp · ddi central28 Eyl 2026
- CVE-2026-1226836İzleyin
Authenticated PowerShell Injection leads to RCE
YüksekCVSS 8,8İstismar yokEPSS %4zohocorp · ddi central28 Eyl 2026
- CVE-2026-1226937İzleyin
Authenticated File Write to RCE via keepalived in DDI Central
YüksekCVSS 8,8İstismar yokEPSS %6zohocorp · ddi central28 Eyl 2026
- CVE-2026-1975937İzleyin
Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution
KritikCVSS 9,4İstismar yokEPSS %0google cloud · application integration28 Eyl 2026
- CVE-2026-8137533İzleyin
Confused Deputy in Application Integration allows Internal File Read
YüksekCVSS 8,3İstismar yokEPSS %0google cloud · application integration28 Eyl 2026
- CVE-2026-8186737İzleyin
Deserialization of Untrusted Data in Application Integration allows Remote Code Execution
KritikCVSS 9,4İstismar yokEPSS %0google cloud · application integration28 Eyl 2026
- CVE-2026-9100635İzleyin
Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)
YüksekCVSS 8,8İstismar yokEPSS %1apache · karaf28 Eyl 2026
- CVE-2026-1226436İzleyin
Authenticated File Write via HA Failover Config Upload leads to RCE
YüksekCVSS 8,8İstismar yokEPSS %1zohocorp · ddi central28 Eyl 2026
- CVE-2026-7842435İzleyin
OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes Nodes
YüksekCVSS 8,8İstismar yokEPSS %0suse · neuvector28 Eyl 2026
- CVE-2026-9104332İzleyin
HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory
YüksekCVSS 8,2İstismar yokEPSS %0elixir-mint · mint28 Eyl 2026
- CVE-2026-10129232İzleyin
Artemis-core-client: unsafe reflection in apache activemq artemis federation message deserialization
YüksekCVSS 8,2İstismar yokEPSS %0red hat · red hat amq broker 728 Eyl 2026
- CVE-2026-1226535İzleyin
Missing Authorization on HA Failover Config allows Complete Data Destruction
YüksekCVSS 8,8İstismar yokEPSS %0zohocorp · ddi central28 Eyl 2026
- CVE-2026-5274828İzleyin
Missing authentication for backup functionality in Kaon AR2140X
YüksekCVSS 7,1İstismar yokEPSS %0kaon · ar214028 Eyl 2026
- CVE-2026-8292830İzleyin
Undocumented access path in mH-DEVELOPER
YüksekCVSS 7,7İstismar yokEPSS %0f&f filipowski · mh-developer28 Eyl 2026
- CVE-2026-8633029İzleyin
Noobaa-core: noobaa-core: os command injection in cluster_internal_api.set_hostname_internal
YüksekCVSS 7,2İstismar yokEPSS %2red hat · red hat openshift data foundation 428 Eyl 2026
- GHSA-456v-xq2p-r4cj31İzleyin
code-ollama: `grep_search` Command Injection via Unescaped `$()` Shell Substitution (CWE-78)
YüksekCVSS 7,8İstismar yok28 Eyl 2026
- CVE-2026-1595228İzleyin
Improper Permission Assignment in Scheduler Service
YüksekCVSS 7,1İstismar yokEPSS %0abb · protection and control ied manager (pcm600)28 Eyl 2026
- CVE-2026-7364037İzleyin
Time-based SQL Injection in Dayforce ESS Excelity
KritikCVSS 9,3İstismar yokEPSS %0dayforce · payroll28 Eyl 2026
- CVE-2026-7364236İzleyin
Path Traversal in Dayforce ESS Excelity
KritikCVSS 9,2İstismar yokEPSS %0dayforce · payroll28 Eyl 2026
- CVE-2026-8518538İzleyin
Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root
KritikCVSS 9,6İstismar yokEPSS %0canonical · lxd28 Eyl 2026
- CVE-2026-8552639İzleyin
Path traversal via Btrfs optimized-backup subvolumes[].path enables root file/dir manipulation in LXD
KritikCVSS 9,9İstismar yokEPSS %0canonical · lxd28 Eyl 2026
- CVE-2026-8659535İzleyin
SQLi in Iron Mountain's enVision
YüksekCVSS 8,8Kavram kanıtıEPSS %0iron mountain archiving services inc. · envision28 Eyl 2026
- CVE-2026-8779939İzleyin
Arbitrary file write on LXD host via symlink in migration stream
KritikCVSS 9,9İstismar yokEPSS %0canonical · lxd28 Eyl 2026
- CVE-2026-9092439İzleyin
Default Admin Credentials in Innotim Software's Logsign SIEM
KritikCVSS 9,8İstismar yokEPSS %0innotim software, telecommunications and consultancy trade ltd. co. · logsign siem28 Eyl 2026
- CVE-2026-9092528İzleyin
Path Traversal in Innotim Software's Logsign SIEM
YüksekCVSS 7,1İstismar yokEPSS %0innotim software, telecommunications and consultancy trade ltd. co. · logsign siem28 Eyl 2026
- CVE-2026-9092635İzleyin
Code Injection in Innotim Software's Logsign SIEM
YüksekCVSS 8,8İstismar yokEPSS %0innotim software, telecommunications and consultancy trade ltd. co. · logsign siem28 Eyl 2026
- CVE-2026-9733530İzleyin
Incorrect authorization in LXD storage volume API allows reading volumes from other projects
YüksekCVSS 7,7İstismar yokEPSS %0canonical · lxd28 Eyl 2026
- CVE-2026-10107435İzleyin
Netcore NR289-GE Authentication boa password-check stack-based overflow
YüksekCVSS 8,9İstismar yokEPSS %0netcore · nr289-ge28 Eyl 2026
- CVE-2026-10107538İzleyin
Netcore NR289-GE Location Time location_time.cgi system os command injection
KritikCVSS 9,3İstismar yokEPSS %2netcore · nr289-ge28 Eyl 2026
- CVE-2026-455631İzleyin
macOS Exam4 Local Privilege Escalation via Command Injection
YüksekCVSS 7,8İstismar yokEPSS %0extegrity · exam428 Eyl 2026
- CVE-2026-8035728İzleyin
Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access
YüksekCVSS 7,0İstismar yokEPSS %0dell · boot optimized server storage (boss)28 Eyl 2026
- CVE-2026-9353828İzleyin
Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet
YüksekCVSS 7,1İstismar yokEPSS %0suse · rancher fleet28 Eyl 2026
- CVE-2026-9653834İzleyin
WarehousePG pg_file_write/pg_file_rename/pg_file_unlink/pg_logdir_ls privilege escalation
YüksekCVSS 8,7İstismar yokEPSS %0enterprisedb · warehousepg28 Eyl 2026
- CVE-2026-10107638İzleyin
Netcore NR289-GE CGI set_ntp_server_ip.cgi system os command injection
KritikCVSS 9,3İstismar yokEPSS %2netcore · nr289-ge28 Eyl 2026
- CVE-2026-10107737İzleyin
Netcore NR289-GE boa_temp process_request missing authentication
KritikCVSS 9,3İstismar yokEPSS %0netcore · nr289-ge28 Eyl 2026
- CVE-2026-1234238İzleyin
SailPoint IdentityIQ Improper Form Validation Vulnerability
KritikCVSS 9,6İstismar yokEPSS %0sailpoint technologies · identityiq28 Eyl 2026
- CVE-2026-8880438İzleyin
Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher
KritikCVSS 9,6İstismar yokEPSS %0suse · rancher28 Eyl 2026
- CVE-2026-8880532İzleyin
Session Not Revoked Server-Side on Logout in Rancher
YüksekCVSS 8,1İstismar yokEPSS %0suse · rancher28 Eyl 2026
- CVE-2026-8880835İzleyin
Fleet agent copies downstream resources with cluster-admin privileges, allowing cross-namespace writes on downstream clusters
YüksekCVSS 8,8İstismar yokEPSS %0suse · rancher fleet28 Eyl 2026
- CVE-2026-9334834İzleyin
Unsloth Zoo Code Injection via model_type in config.json
YüksekCVSS 8,6İstismar yokEPSS %0unslothai · unsloth-zoo28 Eyl 2026
- CVE-2026-10108134İzleyin
D-Link DI-8400 Web Administration Service menu_nat_more.asp menu_nat_more_asp stack-based overflow
YüksekCVSS 8,5İstismar yokEPSS %0d-link · di-840028 Eyl 2026
- CVE-2026-10189137İzleyin
WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access
KritikCVSS 9,3İstismar yokEPSS %0watchguard · watchguard ap28 Eyl 2026
- CVE-2026-10189436İzleyin
@xhmikosr/decompress: Path traversal via symlink chain
KritikCVSS 9,1Kavram kanıtıEPSS %0xhmikosr · decompress28 Eyl 2026
- CVE-2026-4810034İzleyin
Payy: agg_agg trailing message slots are unconstrained and allow forged burn messages
YüksekCVSS 8,7İstismar yokEPSS %0polybase · payy28 Eyl 2026
- CVE-2026-5416032İzleyin
Network UPS Tools: A PWN Request in make-dist workflow can execute PR-controlled code with write-scoped GITHUB_TOKEN
YüksekCVSS 8,2İstismar yokEPSS %0networkupstools · nut28 Eyl 2026
- CVE-2026-5509628İzleyin
SSRF via DNS-resolution gap in _validate_url_security (file download by URL)
YüksekCVSS 7,1İstismar yokEPSS %0leshchenko1979 · fast-mcp-telegram28 Eyl 2026
- CVE-2026-8564430İzleyin
XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference
YüksekCVSS 7,5İstismar yokEPSS %028 Eyl 2026
- CVE-2026-8610238İzleyin
WatchGuard AP Command Injection in Internal Management API Allows Command Execution
KritikCVSS 9,3İstismar yokEPSS %2watchguard · watchguard ap28 Eyl 2026
- CVE-2026-8711428İzleyin
Kube-compare: container:// reference extraction runs the image entrypoint and silently escalates to sudo
YüksekCVSS 7,1İstismar yokEPSS %0red hat · pen drive powered by red hat lightspeed28 Eyl 2026
- CVE-2026-8796934İzleyin
WatchGuard AP Authenticated Command Injection in Diagnostic CLI
YüksekCVSS 8,6İstismar yokEPSS %1watchguard · watchguard ap28 Eyl 2026
- CVE-2026-8881630İzleyin
DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName
YüksekCVSS 7,5İstismar yokEPSS %028 Eyl 2026
- CVE-2026-10189828İzleyin
Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls
YüksekCVSS 7,0İstismar yokEPSS %0axios · axios28 Eyl 2026
- CVE-2026-10190132İzleyin
Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization
YüksekCVSS 8,2İstismar yokEPSS %0axios · axios28 Eyl 2026
- CVE-2026-10190332İzleyin
Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)
YüksekCVSS 8,2İstismar yokEPSS %0axios · axios28 Eyl 2026
- CVE-2026-10190530İzleyin
Axios: Node HTTP adapter prototype-pollution gadget allows request socket hijack via inherited createConnection
YüksekCVSS 7,6İstismar yokEPSS %0axios · axios28 Eyl 2026
- CVE-2026-10190632İzleyin
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location
YüksekCVSS 8,2İstismar yokEPSS %0axios · axios28 Eyl 2026
- CVE-2026-10190728İzleyin
Axios: maxRedirects: 0 is not enforced by the fetch adapter, allowing redirect-based SSRF
YüksekCVSS 7,0İstismar yokEPSS %0axios · axios28 Eyl 2026
- CVE-2026-10190933İzleyin
Axios: Prototype Pollution Gadget in axios toFormData Options
YüksekCVSS 8,3İstismar yokEPSS %0axios · axios28 Eyl 2026
- CVE-2026-4556230İzleyin
FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module
YüksekCVSS 7,7İstismar yokEPSS %0sangoma · freepbx28 Eyl 2026
- CVE-2026-4999436İzleyin
Bluehood: Missing authentication on Bluehood API routes when web auth is enabled
KritikCVSS 9,1İstismar yokEPSS %0dannymcc · bluehood28 Eyl 2026
- CVE-2026-5467434İzleyin
Authenticated Command Injection in FreePBX UCP Interface
YüksekCVSS 8,6İstismar yokEPSS %0sangoma · freepbx28 Eyl 2026
- CVE-2026-5467534İzleyin
FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module
YüksekCVSS 8,7İstismar yokEPSS %0sangoma · freepbx28 Eyl 2026
- CVE-2026-5470834İzleyin
Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module
YüksekCVSS 8,6İstismar yokEPSS %0sangoma · freepbx28 Eyl 2026
- CVE-2026-5471034İzleyin
FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)
YüksekCVSS 8,6İstismar yokEPSS %0sangoma · freepbx28 Eyl 2026
- CVE-2026-5515733İzleyin
Token Optimizer MCP: OS command injection in smart_user via username in get-user-info
YüksekCVSS 8,4İstismar yokEPSS %0ooples · token-optimizer-mcp28 Eyl 2026
- CVE-2026-5516030İzleyin
Authenticated Server-Side Request Forgery (SSRF) via feed URL in Stringer
YüksekCVSS 7,6İstismar yokEPSS %0stringer-rss · stringer28 Eyl 2026
- CVE-2026-7560034İzleyin
FreePBX: Authenticated API generatedocs Host Command Injection
YüksekCVSS 8,6İstismar yokEPSS %0sangoma · freepbx28 Eyl 2026
- CVE-2026-10075237İzleyin
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9
KritikCVSS 9,3Kavram kanıtıEPSS %0ordasoft.com · real estate manager (free) extension for joomla28 Eyl 2026
- CVE-2026-10110837İzleyin
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8
KritikCVSS 9,3Kavram kanıtıEPSS %0ordasoft.com · vehicle manager (free) extension for joomla28 Eyl 2026
- CVE-2026-10111037İzleyin
Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6
KritikCVSS 9,3Kavram kanıtıEPSS %0ordasoft · book library28 Eyl 2026
- CVE-2026-10201028İzleyin
Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if
YüksekCVSS 7,0İstismar yokEPSS %0red hat · red hat enterprise linux 1028 Eyl 2026
- CVE-2026-8489430İzleyin
In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidate
YüksekCVSS 7,5İstismar yokEPSS %0meta platforms, inc · moxygen28 Eyl 2026
- CVE-2026-9702328İzleyin
Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin
YüksekCVSS 7,1İstismar yokEPSS %0red hat · red hat enterprise linux 1028 Eyl 2026
- CVE-2026-10200431İzleyin
Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory management subsystem.
YüksekCVSS 7,8İstismar yokEPSS %0wind river systems inc · vxworks 728 Eyl 2026
- CVE-2026-8695073Bu hafta
An out-of-bounds write issue was addressed with improved bounds checking.
YüksekCVSS 8,8KEVSilahlaştırılmışEPSS %26apple · ipados28 Eyl 2026
- CVE-2026-8774135İzleyin
ConvertPlus <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter
YüksekCVSS 8,8İstismar yokEPSS %0brainstorm force · convertplus28 Eyl 2026
- CVE-2026-9335530İzleyin
LiteLLM Weak JWT Authentication via Email-Based User Lookup
YüksekCVSS 7,6Kavram kanıtıEPSS %0berriai · litellm28 Eyl 2026
- CVE-2026-9676039İzleyin
Authlib library contains a signature‑verification bypass vulnerability
KritikCVSS 9,8Kavram kanıtıEPSS %0authlib · authlib28 Eyl 2026
- CVE-2026-10037134İzleyin
InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recovery
YüksekCVSS 8,7İstismar yokEPSS %0invoiceplane · invoiceplane28 Eyl 2026
- CVE-2026-10039228İzleyin
InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)
YüksekCVSS 7,0İstismar yokEPSS %0invoiceplane · invoiceplane28 Eyl 2026
- CVE-2026-10118735İzleyin
Ziroom ZHOME A0101 USB Device Management API zrUsb.lua pop_usb_device command injection
YüksekCVSS 8,5İstismar yokEPSS %2ziroom · zhome a010128 Eyl 2026
- CVE-2026-10191629İzleyin
@grpc/grpc-js: In certain configurations, getAuthContext can return unauthorized certificates as though they were authorized
YüksekCVSS 7,4İstismar yokEPSS %0grpc · grpc-node28 Eyl 2026
- CVE-2026-10191730İzleyin
PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)
YüksekCVSS 7,5İstismar yokEPSS %0pyjwt project · pyjwt28 Eyl 2026
- CVE-2026-10191830İzleyin
PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)
YüksekCVSS 7,5İstismar yokEPSS %0pyjwt project · pyjwt28 Eyl 2026
- CVE-2026-10226636İzleyin
PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
KritikCVSS 9,1İstismar yokEPSS %0pyjwt project · pyjwt28 Eyl 2026
- CVE-2026-10226736İzleyin
PyJWT: PyJWKClient follows redirects when fetching JWKS
KritikCVSS 9,1İstismar yokEPSS %0pyjwt project · pyjwt28 Eyl 2026
- CVE-2026-10226836İzleyin
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
KritikCVSS 9,1Kavram kanıtıEPSS %0pyjwt project · pyjwt28 Eyl 2026
- CVE-2026-10227129İzleyin
PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guard
YüksekCVSS 7,4İstismar yokEPSS %0pyjwt project · pyjwt28 Eyl 2026
- CVE-2026-10227229İzleyin
PyJWT is a Python implementation of JSON Web Token standards.
YüksekCVSS 7,4İstismar yokEPSS %0pyjwt project · pyjwt28 Eyl 2026
- CVE-2026-10227329İzleyin
PyJWT accepts public JWK containers as HMAC secrets
YüksekCVSS 7,4İstismar yokEPSS %0pyjwt project · pyjwt28 Eyl 2026
- CVE-2026-10227430İzleyin
PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set
YüksekCVSS 7,5İstismar yokEPSS %0pyjwt project · pyjwt28 Eyl 2026
- CVE-2026-10227532İzleyin
PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion
YüksekCVSS 8,2İstismar yokEPSS %0pyjwt project · pyjwt28 Eyl 2026
- CVE-2026-10227630İzleyin
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
YüksekCVSS 7,5İstismar yokEPSS %0juliangruber · brace-expansion28 Eyl 2026
- CVE-2026-10227830İzleyin
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
YüksekCVSS 7,5İstismar yokEPSS %0juliangruber · brace-expansion28 Eyl 2026