Yayın tarihine göre

Eylül 2026: sömürülen ve yeni ciddi CVE kayıtları

7.955 kayıt · 32 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 77 / 80

CVE kayıtları
Aksiyon	CVE	Zafiyet	Ciddiyet	KEV	EPSS	Yayın
28İzleyin	CVE-2026-91832İstismar yok	WP Mobile Menu 2.7.4 - 2.8.8 - Stored XSS via CSRFunknown · wp mobile menu · CWE-79 Kimlik doğrulamasız XSS CSRF	Yüksek7,1	—	%0,0	30 Eyl 2026
35İzleyin	CVE-2026-92994İstismar yok	Verge3D < 4.13.1 - Unauthenticated Stored XSS via File Storage APIunknown · verge3d publishing and e-commerce · CWE-79 Kimlik doğrulamasız XSS	Yüksek8,8	—	%0,2	30 Eyl 2026
30İzleyin	CVE-2026-89294İstismar yok	Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parametercroixhaug · simply schedule appointments · CWE-98 RCE	Yüksek7,5	—	%0,6	30 Eyl 2026
36İzleyin	CVE-2026-97196İstismar yok	WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerabilityliquid web / stellarwp · givewp · CWE-1289 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,1	—	%0,2	30 Eyl 2026
36İzleyin	CVE-2026-102508İstismar yok	Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgradeapache software foundation · apache plc4x · CWE-295 Kimlik doğrulamasız Zayıf kripto	Kritik9,2	—	%0,1	30 Eyl 2026
30İzleyin	CVE-2026-6806İstismar yok	Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parametersstylemix · motors – car dealership & classified listings plugin · CWE-89 Kimlik doğrulamasız SQL enjeksiyonu	Yüksek7,5	—	%0,2	30 Eyl 2026
34İzleyin	CVE-2026-92867İstismar yok	An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination opgpool global development group · pgpool-ii · CWE-787 RCE Bellek hatası	Yüksek8,7	—	%0,3	30 Eyl 2026
28İzleyin	CVE-2026-92869İstismar yok	An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination.pgpool global development group · pgpool-ii · CWE-787 Bellek hatası	Yüksek7,1	—	%0,2	30 Eyl 2026
34İzleyin	CVE-2026-92870İstismar yok	A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termipgpool global development group · pgpool-ii · CWE-121 Kimlik doğrulamasız Bellek hatası	Yüksek8,7	—	%0,3	30 Eyl 2026
34İzleyin	CVE-2026-92871İstismar yok	A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of tpgpool global development group · pgpool-ii · CWE-476 Kimlik doğrulamasız Bellek hatası	Yüksek8,7	—	%0,2	30 Eyl 2026
34İzleyin	CVE-2026-97150İstismar yok	When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP cbasercms users community · bcaddonmigrator · CWE-829	Yüksek8,6	—	%0,3	30 Eyl 2026
34İzleyin	CVE-2026-102454İstismar yok	DigiWin｜EasyFlow .NET - Arbitrary File Uploaddigiwin · easyflow .net · CWE-434 RCE Dosya yükleme	Yüksek8,6	—	%0,5	30 Eyl 2026
37İzleyin	CVE-2026-102455İstismar yok	DigiWin｜EasyFlow .NET - Insecure Deserializationdigiwin · easyflow .net · CWE-502 Girişsiz RCE Deserializasyon	Kritik9,3	—	%0,5	30 Eyl 2026
28İzleyin	CVE-2026-102456İstismar yok	DigiWin｜EasyFlow .NET - SQL Injectiondigiwin · easyflow .net · CWE-89 SQL enjeksiyonu	Yüksek7,1	—	%0,2	30 Eyl 2026
28İzleyin	CVE-2026-102457İstismar yok	DigiWin｜EasyFlow .NET - Arbitrary File Readdigiwin · easyflow .net · CWE-22 Yol geçişi	Yüksek7,1	—	%0,3	30 Eyl 2026
37İzleyin	CVE-2026-102458İstismar yok	DigiWin｜EasyFlow .NET - Missing Authenticationdigiwin · easyflow .net · CWE-306 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,3	—	%0,4	30 Eyl 2026
34İzleyin	CVE-2026-102509İstismar yok	Apache PLC4X, Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parserapache software foundation · apache plc4x · CWE-674 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek8,7	—	%0,4	30 Eyl 2026
34İzleyin	CVE-2026-102510İstismar yok	Apache PLC4X: Go binding: unbounded allocation and framing failures on wire-controlled lengthsapache software foundation · apache plc4x · CWE-129 Kimlik doğrulamasız	Yüksek8,7	—	%0,3	30 Eyl 2026
34İzleyin	CVE-2026-102511İstismar yok	Apache PLC4X, Apache PLC4X, Apache PLC4X, Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from themapache software foundation · apache plc4x · CWE-129 Kimlik doğrulamasız	Yüksek8,5	—	%0,1	30 Eyl 2026
35İzleyin	CVE-2026-102578İstismar yok	Moodle: sql injection in question bank web servicemoodle · moodle · CWE-89 SQL enjeksiyonu	Yüksek8,8	—	%0,2	30 Eyl 2026
30İzleyin	CVE-2026-75098İstismar yok	Product Designer App <= 1.1.3 - Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-designproductdesignerapp · product designer app · CWE-22 Kimlik doğrulamasız Yol geçişi	Yüksek7,5	—	%0,9	30 Eyl 2026
28İzleyin	CVE-2026-97347Kavram kanıtı	Post Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-Agent Headerkazukiyanamoto · post views stats counter · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,2	—	%0,2	30 Eyl 2026
34İzleyin	CVE-2026-103235İstismar yok	MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Eventsmisp · misp · CWE-639 Erişim denetimi (IDOR)	Yüksek8,7	—	%0,3	30 Eyl 2026
33İzleyin	CVE-2026-103237İstismar yok	MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rowsmisp · misp · CWE-20	Yüksek8,3	—	%0,2	30 Eyl 2026
34İzleyin	CVE-2026-10764İstismar yok	Information disclosure in BVMS 4.5 up to 12.3iqsight · bvms · CWE-321 Kimlik doğrulamasız Gömülü kimlik bilgisi	Yüksek8,7	—	%0,2	30 Eyl 2026
36İzleyin	CVE-2026-77185İstismar yok	Apache MINA SSHD: Asynchronous authentication can bypass signature verificationapache software foundation · apache mina sshd · CWE-305 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,1	—	%0,5	30 Eyl 2026
28İzleyin	CVE-2026-79625İstismar yok	Improper Synchronization in Monitoring in CODESYS Control Runtimecodesys · control rte (sl) · CWE-362 Yarış durumu	Yüksek7,2	—	%0,2	30 Eyl 2026
32İzleyin	CVE-2026-93994İstismar yok	Apache MINA SSHD: Repeated-publickey policy bypass on serverapache software foundation · apache mina sshd · CWE-304 Kimlik doğrulama atlatma	Yüksek8,1	—	%0,3	30 Eyl 2026
30İzleyin	CVE-2026-94002İstismar yok	Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP repliesapache software foundation · apache mina sshd · CWE-770 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek7,5	—	%0,4	30 Eyl 2026
36İzleyin	CVE-2026-94052İstismar yok	Apache MINA SSHD: LDAP password authentication ineffectiveapache software foundation · apache mina sshd · CWE-304 Kimlik doğrulamasız	Kritik9,1	—	%0,3	30 Eyl 2026
36İzleyin	CVE-2026-94053İstismar yok	Apache MINA SSHD: LDAP injection in sshd-ldapapache software foundation · apache mina sshd · CWE-90 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,1	—	%0,3	30 Eyl 2026
34İzleyin	CVE-2026-103239İstismar yok	MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injectionmisp · misp · CWE-284 Erişim denetimi (IDOR)	Yüksek8,6	—	%0,2	30 Eyl 2026
34İzleyin	CVE-2026-76992İstismar yok	Uncontrolled Memory Allocation in CODESYS Gateway Clientcodesys · development system 3 · CWE-770 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek8,7	—	%0,3	30 Eyl 2026
28İzleyin	CVE-2026-103242İstismar yok	Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tagred hat · red hat enterprise linux 10 · CWE-122 Bellek hatası	Yüksek7,1	—	%0,1	30 Eyl 2026
34İzleyin	CVE-2026-10739İstismar yok	Cato Networks SDP Client for Windows is vulnerable to Local Privilege Escalationcato networks · sdp client · CWE-23 Yol geçişi Yerel yetki yükseltme	Yüksek8,5	—	%0,1	30 Eyl 2026
31İzleyin	CVE-2026-62146Kavram kanıtı	Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socketred hat · red hat openshift container platform 4 · CWE-501	Yüksek7,8	—	%0,1	30 Eyl 2026
30İzleyin	CVE-2026-85532İstismar yok	Apache WSS4J: Insufficient Validation of Derived-Key Parametersapache · wss4j · CWE-20 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek7,5	—	%0,5	30 Eyl 2026
36İzleyin	CVE-2026-87830İstismar yok	Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.apache · wss4j · CWE-917 Girişsiz RCE	Kritik9,1	—	%0,2	30 Eyl 2026
39İzleyin	CVE-2026-88920İstismar yok	Apache WSS4J: SAML Sender-Vouches Authentication Bypassapache · wss4j · CWE-287 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,8	—	%0,5	30 Eyl 2026
28İzleyin	CVE-2026-100507İstismar yok	WordPress If-So Dynamic Content Personalization plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerabilityif-so dynamic content · if-so dynamic content personalization · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,1	30 Eyl 2026
28İzleyin	CVE-2026-102385İstismar yok	WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerabilitykevin stover · ninja forms · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,1	30 Eyl 2026
28İzleyin	CVE-2026-102395İstismar yok	WordPress Easy Google Maps plugin <= 1.14.6 - Cross Site Scripting (XSS) vulnerabilitysupsystic · easy google maps · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,1	30 Eyl 2026
28İzleyin	CVE-2026-102396İstismar yok	WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerabilitysupsystic · ultimate maps by supsystic · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,1	30 Eyl 2026
28İzleyin	CVE-2026-102398İstismar yok	WordPress Popup by Supsystic plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerabilitysupsystic · popup by supsystic · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,1	30 Eyl 2026
33İzleyin	CVE-2026-103321İstismar yok	MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Imagemisp · misp · CWE-20 XSS	Yüksek8,3	—	%0,3	30 Eyl 2026
10İzleyin	CVE-2026-27085İstismar yok	WordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerabilitybrainstorm force · astra wordpress theme · CWE-80 XSS	Düşük2,7	—	%0,2	30 Eyl 2026
28İzleyin	CVE-2026-27371İstismar yok	WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerabilitywpfunnels · wpfunnels · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,1	30 Eyl 2026
30İzleyin	CVE-2026-62085İstismar yok	WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerabilitymelapress · wp activity log · CWE-89 SQL enjeksiyonu	Yüksek7,6	—	%0,3	30 Eyl 2026
37İzleyin	CVE-2026-74864İstismar yok	Authentication Bypass in sogo_yhnyunohost-apps · sogo_yhn · CWE-639 Kimlik doğrulamasız Kimlik doğrulama atlatma Erişim denetimi (IDOR)	Kritik9,3	—	%0,4	30 Eyl 2026
36İzleyin	CVE-2026-74865İstismar yok	Authentication Bypass in sogo_yhnyunohost-apps · sogo_yhn · CWE-639 Kimlik doğrulamasız Kimlik doğrulama atlatma Erişim denetimi (IDOR)	Kritik9,2	—	%0,3	30 Eyl 2026
70Bu hafta	CVE-2026-76504Silahlaştırılmış	Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerabilitycisco · catalyst sd-wan manager · CWE-177 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,8	KEV	%1,8	30 Eyl 2026
36İzleyin	CVE-2026-89238İstismar yok	Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selectionapache · wss4j · CWE-345 Kimlik doğrulamasız	Kritik9,1	—	%0,2	30 Eyl 2026
30İzleyin	CVE-2026-92121İstismar yok	Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform referenceapache · wss4j · CWE-693 Kimlik doğrulamasız	Yüksek7,5	—	%0,5	30 Eyl 2026
28İzleyin	CVE-2026-93512İstismar yok	WordPress JW Player for WordPress plugin <= 2.3.11 - Cross Site Scripting (XSS) vulnerabilityilghera · jw player for wordpress · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,1	30 Eyl 2026
28İzleyin	CVE-2026-93514İstismar yok	WordPress Notification for Telegram plugin <= 3.5.2 - Cross Site Scripting (XSS) vulnerabilityrainafarai · notification for telegram · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,1	30 Eyl 2026
32İzleyin	CVE-2026-93621İstismar yok	WordPress WP Data Access plugin <= 5.5.84 - SQL Injection vulnerabilitypassionate programmer peter · wp data access · CWE-89 Kimlik doğrulamasız SQL enjeksiyonu	Yüksek8,2	—	%0,2	30 Eyl 2026
28İzleyin	CVE-2026-93624İstismar yok	WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerabilitycodepeople · music player for woocommerce · CWE-502 Deserializasyon	Yüksek7,2	—	%0,3	30 Eyl 2026
28İzleyin	CVE-2026-93651İstismar yok	WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.1.2 - PHP Object Injection vulnerabilitydotstore · minimum and maximum quantity for woocommerce · CWE-502 Deserializasyon	Yüksek7,2	—	%0,3	30 Eyl 2026
28İzleyin	CVE-2026-93770İstismar yok	WordPress WP Statistics plugin <= 14.16.13 - Cross Site Scripting (XSS) vulnerabilityveronalabs · wp statistics · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,2	30 Eyl 2026
28İzleyin	CVE-2026-93771İstismar yok	WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerabilitywpfactory · cost of goods for woocommerce · CWE-502 Deserializasyon	Yüksek7,2	—	%0,3	30 Eyl 2026
35İzleyin	CVE-2026-94076İstismar yok	WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerabilityseo squirrly · seo plugin by squirrly seo · CWE-502 Deserializasyon	Yüksek8,8	—	%0,3	30 Eyl 2026
28İzleyin	CVE-2026-94078İstismar yok	WordPress Site Reviews plugin <= 8.3.1 - Cross Site Scripting (XSS) vulnerabilitygemini labs · site reviews · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,2	30 Eyl 2026
28İzleyin	CVE-2026-94081İstismar yok	WordPress WordPress Persistent Login plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerabilitylukeseager · wordpress persistent login · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,1	30 Eyl 2026
30İzleyin	CVE-2026-94082İstismar yok	WordPress Quiz Cat plugin <= 3.1.1 - SQL Injection vulnerabilityfatcatapps · quiz cat · CWE-89 SQL enjeksiyonu	Yüksek7,6	—	%0,2	30 Eyl 2026
34İzleyin	CVE-2026-94115İstismar yok	WordPress Easy Pricing Tables plugin <= 4.1.2 - SQL Injection vulnerabilityfatcatapps · easy pricing tables · CWE-89 SQL enjeksiyonu	Yüksek8,5	—	%0,2	30 Eyl 2026
30İzleyin	CVE-2026-94120İstismar yok	WordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vulnerabilitygravitykit · gravityexport lite for gravity forms · CWE-862 Kimlik doğrulamasız Erişim denetimi (IDOR)	Yüksek7,5	—	%0,2	30 Eyl 2026
35İzleyin	CVE-2026-94121İstismar yok	WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.33.6 - PHP Object Injection vulnerability10web · 10web booster – website speed optimization, cache & page speed optimizer · CWE-502 Deserializasyon	Yüksek8,8	—	%0,3	30 Eyl 2026
28İzleyin	CVE-2026-94122İstismar yok	WordPress Responsive Slider Gallery plugin <= 1.5.5 - PHP Object Injection vulnerabilitya wp life · responsive slider gallery · CWE-502 Deserializasyon	Yüksek7,2	—	%0,3	30 Eyl 2026
30İzleyin	CVE-2026-94123İstismar yok	WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerabilitysyed balkhi · nextgen gallery · CWE-22 Kimlik doğrulamasız Yol geçişi	Yüksek7,5	—	%0,4	30 Eyl 2026
34İzleyin	CVE-2026-94177İstismar yok	WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerabilityruben garcia · gamipress · CWE-89 SQL enjeksiyonu	Yüksek8,5	—	%0,2	30 Eyl 2026
30İzleyin	CVE-2026-94178İstismar yok	WordPress Import and export users and customers plugin <= 2.5.2 - Privilege Escalation vulnerabilityjavier carazo · import and export users and customers · CWE-266	Yüksek7,5	—	%0,3	30 Eyl 2026
36İzleyin	CVE-2026-94389İstismar yok	WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Remote Code Execution (RCE) vulnerabilityacymailing newsletter team · acymailing smtp newsletter · CWE-94 Girişsiz RCE	Kritik9,0	—	%0,4	30 Eyl 2026
28İzleyin	CVE-2026-94499İstismar yok	WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerabilitywpwax · formgent · CWE-862 Erişim denetimi (IDOR)	Yüksek7,1	—	%0,2	30 Eyl 2026
28İzleyin	CVE-2026-94677İstismar yok	WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerabilitynexcess · kadence woocommerce email designer · CWE-502 Deserializasyon	Yüksek7,2	—	%0,3	30 Eyl 2026
35İzleyin	CVE-2026-94678İstismar yok	WordPress Go Live Update Urls plugin <= 7.0.8 - PHP Object Injection vulnerabilitymat lipe · go live update urls · CWE-502 Deserializasyon	Yüksek8,8	—	%0,3	30 Eyl 2026
35İzleyin	CVE-2026-94683İstismar yok	WordPress DesignSetGo plugin <= 2.8.0 - PHP Object Injection vulnerabilityjustin nealey · designsetgo · CWE-502 Deserializasyon	Yüksek8,8	—	%0,3	30 Eyl 2026
35İzleyin	CVE-2026-95531İstismar yok	WordPress Conversational Forms for ChatBot plugin <= 1.5.0 - PHP Object Injection vulnerabilityquantumcloud · conversational forms for chatbot · CWE-502 Deserializasyon	Yüksek8,8	—	%0,4	30 Eyl 2026
30İzleyin	CVE-2026-95587İstismar yok	WordPress Hostinger Migrator plugin <= 1.0 - Broken Access Control vulnerabilityhostinger · hostinger migrator · CWE-862 Kimlik doğrulamasız Erişim denetimi (IDOR)	Yüksek7,5	—	%0,2	30 Eyl 2026
30İzleyin	CVE-2026-95616İstismar yok	Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensionsapache · wss4j · CWE-190 Kimlik doğrulamasız Bellek hatası Hizmet dışı bırakma	Yüksek7,5	—	%0,4	30 Eyl 2026
28İzleyin	CVE-2026-96343İstismar yok	WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerabilitywedevs · wp erp · CWE-502 Deserializasyon	Yüksek7,2	—	%0,3	30 Eyl 2026
28İzleyin	CVE-2026-96344İstismar yok	WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerabilityimplecode · ecommerce product catalog · CWE-502 Deserializasyon	Yüksek7,2	—	%0,3	30 Eyl 2026
30İzleyin	CVE-2026-96345İstismar yok	WordPress Estatik plugin <= 4.3.5 - SQL Injection vulnerabilityestatik · estatik · CWE-89 SQL enjeksiyonu	Yüksek7,6	—	%0,2	30 Eyl 2026
30İzleyin	CVE-2026-96346İstismar yok	WordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerabilitywedevs · wp erp · CWE-89 SQL enjeksiyonu	Yüksek7,6	—	%0,2	30 Eyl 2026
30İzleyin	CVE-2026-96348İstismar yok	WordPress Bookly plugin <= 28.2 - Broken Access Control vulnerabilitybookly · bookly · CWE-862 Kimlik doğrulamasız Erişim denetimi (IDOR)	Yüksek7,5	—	%0,2	30 Eyl 2026
40Planlayın	CVE-2026-96349Kavram kanıtı	WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerabilitysiteskite · siteskite · CWE-94 Girişsiz RCE	Kritik10,0	—	%0,6	30 Eyl 2026
39İzleyin	CVE-2026-96350İstismar yok	WordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerabilityestatik · estatik · CWE-266 Kimlik doğrulamasız	Kritik9,8	—	%0,4	30 Eyl 2026
28İzleyin	CVE-2026-96351İstismar yok	WordPress Classified Listing plugin <= 6.1.3 - Cross Site Scripting (XSS) vulnerabilityradiustheme · classified listing · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,1	30 Eyl 2026
28İzleyin	CVE-2026-96352İstismar yok	WordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerabilityyithemes · yith woocommerce ajax search · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,1	30 Eyl 2026
28İzleyin	CVE-2026-96814İstismar yok	WordPress WooCommerce Product Table Lite plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerabilitywp titan labs · woocommerce product table lite · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,1	30 Eyl 2026
28İzleyin	CVE-2026-96815İstismar yok	WordPress Vitepos plugin <= 3.5.0 - Privilege Escalation vulnerabilityappsbd · vitepos · CWE-266	Yüksek7,2	—	%0,3	30 Eyl 2026
28İzleyin	CVE-2026-96816İstismar yok	WordPress Trusted Shops Easy Integration for WooCommerce plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerabilityvendidero · trusted shops easy integration for woocommerce · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,1	30 Eyl 2026
32İzleyin	CVE-2026-96817İstismar yok	WordPress MakeCommerce for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerabilitymakecommerce.net · makecommerce for woocommerce · CWE-862 Kimlik doğrulamasız Erişim denetimi (IDOR)	Yüksek8,2	—	%0,3	30 Eyl 2026
30İzleyin	CVE-2026-96818İstismar yok	WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerabilitymra13 / team tips and tricks hq · wp express checkout (accept paypal payments) · CWE-862 Kimlik doğrulamasız Erişim denetimi (IDOR)	Yüksek7,5	—	%0,2	30 Eyl 2026
28İzleyin	CVE-2026-96819İstismar yok	WordPress oik plugin <= 4.15.4 - Cross Site Scripting (XSS) vulnerabilitybobbingwide · oik · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,2	30 Eyl 2026
28İzleyin	CVE-2026-96820İstismar yok	WordPress Awesome Support plugin <= 6.3.9 - Cross Site Scripting (XSS) vulnerabilityawesomesupport · awesome support · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,2	30 Eyl 2026
37İzleyin	CVE-2026-96822İstismar yok	WordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerabilityhossni mubarak · books gallery · CWE-89 Kimlik doğrulamasız SQL enjeksiyonu	Kritik9,3	—	%0,2	30 Eyl 2026
30İzleyin	CVE-2026-96823İstismar yok	WordPress Customer Reviews for WooCommerce plugin <= 5.120.0 - Arbitrary Content Deletion vulnerabilitycusrev · customer reviews for woocommerce · CWE-862 Kimlik doğrulamasız Erişim denetimi (IDOR) Hizmet dışı bırakma	Yüksek7,5	—	%0,3	30 Eyl 2026
30İzleyin	CVE-2026-96827İstismar yok	WordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerabilitymelapress · admin notices manager · CWE-89 SQL enjeksiyonu	Yüksek7,6	—	%0,2	30 Eyl 2026
30İzleyin	CVE-2026-96828İstismar yok	WordPress Category Discount Woocommerce plugin <= 5.18 - SQL Injection vulnerabilityvidish · category discount woocommerce · CWE-89 SQL enjeksiyonu	Yüksek7,6	—	%0,2	30 Eyl 2026
28İzleyin	CVE-2026-96830İstismar yok	WordPress GiveWP plugin <= 4.16.9 - Cross Site Scripting (XSS) vulnerabilitynexcess · givewp · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,2	30 Eyl 2026

CVE-2026-91832
28İzleyin
WP Mobile Menu 2.7.4 - 2.8.8 - Stored XSS via CSRF
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
- CSRF
unknown · wp mobile menu30 Eyl 2026
CVE-2026-92994
35İzleyin
Verge3D < 4.13.1 - Unauthenticated Stored XSS via File Storage API
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
unknown · verge3d publishing and e-commerce30 Eyl 2026
CVE-2026-89294
30İzleyin
Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter
YüksekCVSS 7,5İstismar yokEPSS %0
- RCE
croixhaug · simply schedule appointments30 Eyl 2026
CVE-2026-97196
36İzleyin
WordPress GiveWP plugin <= 4.16.9 - Broken Authentication vulnerability
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
liquid web / stellarwp · givewp30 Eyl 2026
CVE-2026-102508
36İzleyin
Apache PLC4X: OPC UA secure channel: integrity bypass, unverifiable server certificate, and silent downgrade
KritikCVSS 9,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- Zayıf kripto
apache software foundation · apache plc4x30 Eyl 2026
CVE-2026-6806
30İzleyin
Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- SQL enjeksiyonu
stylemix · motors – car dealership & classified listings plugin30 Eyl 2026
CVE-2026-92867
34İzleyin
An out-of-bounds write vulnerability exists in Pgpool-II , which may allow an authenticated attacker to cause abnormal process termination o
YüksekCVSS 8,7İstismar yokEPSS %0
- RCE
- Bellek hatası
pgpool global development group · pgpool-ii30 Eyl 2026
CVE-2026-92869
28İzleyin
An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination.
YüksekCVSS 7,1İstismar yokEPSS %0
- Bellek hatası
pgpool global development group · pgpool-ii30 Eyl 2026
CVE-2026-92870
34İzleyin
A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termi
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
pgpool global development group · pgpool-ii30 Eyl 2026
CVE-2026-92871
34İzleyin
A NULL pointer dereference vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal termination of t
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
pgpool global development group · pgpool-ii30 Eyl 2026
CVE-2026-97150
34İzleyin
When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP c
YüksekCVSS 8,6İstismar yokEPSS %0
basercms users community · bcaddonmigrator30 Eyl 2026
CVE-2026-102454
34İzleyin
DigiWin｜EasyFlow .NET - Arbitrary File Upload
YüksekCVSS 8,6İstismar yokEPSS %0
- RCE
- Dosya yükleme
digiwin · easyflow .net30 Eyl 2026
CVE-2026-102455
37İzleyin
DigiWin｜EasyFlow .NET - Insecure Deserialization
KritikCVSS 9,3İstismar yokEPSS %0
- Girişsiz RCE
- Deserializasyon
digiwin · easyflow .net30 Eyl 2026
CVE-2026-102456
28İzleyin
DigiWin｜EasyFlow .NET - SQL Injection
YüksekCVSS 7,1İstismar yokEPSS %0
- SQL enjeksiyonu
digiwin · easyflow .net30 Eyl 2026
CVE-2026-102457
28İzleyin
DigiWin｜EasyFlow .NET - Arbitrary File Read
YüksekCVSS 7,1İstismar yokEPSS %0
- Yol geçişi
digiwin · easyflow .net30 Eyl 2026
CVE-2026-102458
37İzleyin
DigiWin｜EasyFlow .NET - Missing Authentication
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
digiwin · easyflow .net30 Eyl 2026
CVE-2026-102509
34İzleyin
Apache PLC4X, Apache PLC4X: Pre-authentication resource exhaustion in the OPC UA driver and the Java SPI parser
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
apache software foundation · apache plc4x30 Eyl 2026
CVE-2026-102510
34İzleyin
Apache PLC4X: Go binding: unbounded allocation and framing failures on wire-controlled lengths
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
apache software foundation · apache plc4x30 Eyl 2026
CVE-2026-102511
34İzleyin
Apache PLC4X, Apache PLC4X, Apache PLC4X, Apache PLC4X: ADS discovery accepts spoofed responses and derives the connection target from them
YüksekCVSS 8,5İstismar yokEPSS %0
- Kimlik doğrulamasız
apache software foundation · apache plc4x30 Eyl 2026
CVE-2026-102578
35İzleyin
Moodle: sql injection in question bank web service
YüksekCVSS 8,8İstismar yokEPSS %0
- SQL enjeksiyonu
moodle · moodle30 Eyl 2026
CVE-2026-75098
30İzleyin
Product Designer App <= 1.1.3 - Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-design
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Yol geçişi
productdesignerapp · product designer app30 Eyl 2026
CVE-2026-97347
28İzleyin
Post Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
YüksekCVSS 7,2Kavram kanıtıEPSS %0
- Kimlik doğrulamasız
- XSS
kazukiyanamoto · post views stats counter30 Eyl 2026
CVE-2026-103235
34İzleyin
MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Events
YüksekCVSS 8,7İstismar yokEPSS %0
- Erişim denetimi (IDOR)
misp · misp30 Eyl 2026
CVE-2026-103237
33İzleyin
MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows
YüksekCVSS 8,3İstismar yokEPSS %0
misp · misp30 Eyl 2026
CVE-2026-10764
34İzleyin
Information disclosure in BVMS 4.5 up to 12.3
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Gömülü kimlik bilgisi
iqsight · bvms30 Eyl 2026
CVE-2026-77185
36İzleyin
Apache MINA SSHD: Asynchronous authentication can bypass signature verification
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
apache software foundation · apache mina sshd30 Eyl 2026
CVE-2026-79625
28İzleyin
Improper Synchronization in Monitoring in CODESYS Control Runtime
YüksekCVSS 7,2İstismar yokEPSS %0
- Yarış durumu
codesys · control rte (sl)30 Eyl 2026
CVE-2026-93994
32İzleyin
Apache MINA SSHD: Repeated-publickey policy bypass on server
YüksekCVSS 8,1İstismar yokEPSS %0
- Kimlik doğrulama atlatma
apache software foundation · apache mina sshd30 Eyl 2026
CVE-2026-94002
30İzleyin
Apache MINA SSHD: Memory exhaustion in SFTP client via unsolicited SFTP replies
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
apache software foundation · apache mina sshd30 Eyl 2026
CVE-2026-94052
36İzleyin
Apache MINA SSHD: LDAP password authentication ineffective
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
apache software foundation · apache mina sshd30 Eyl 2026
CVE-2026-94053
36İzleyin
Apache MINA SSHD: LDAP injection in sshd-ldap
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
apache software foundation · apache mina sshd30 Eyl 2026
CVE-2026-103239
34İzleyin
MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection
YüksekCVSS 8,6İstismar yokEPSS %0
- Erişim denetimi (IDOR)
misp · misp30 Eyl 2026
CVE-2026-76992
34İzleyin
Uncontrolled Memory Allocation in CODESYS Gateway Client
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
codesys · development system 330 Eyl 2026
CVE-2026-103242
28İzleyin
Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag
YüksekCVSS 7,1İstismar yokEPSS %0
- Bellek hatası
red hat · red hat enterprise linux 1030 Eyl 2026
CVE-2026-10739
34İzleyin
Cato Networks SDP Client for Windows is vulnerable to Local Privilege Escalation
YüksekCVSS 8,5İstismar yokEPSS %0
- Yol geçişi
- Yerel yetki yükseltme
cato networks · sdp client30 Eyl 2026
CVE-2026-62146
31İzleyin
Cri-o: cri-o: sandbox state poisoning via pod annotations may expose runtime socket
YüksekCVSS 7,8Kavram kanıtıEPSS %0
red hat · red hat openshift container platform 430 Eyl 2026
CVE-2026-85532
30İzleyin
Apache WSS4J: Insufficient Validation of Derived-Key Parameters
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
apache · wss4j30 Eyl 2026
CVE-2026-87830
36İzleyin
Apache WSS4J: Streaming WS-SecurityPolicy validation may skip element-protection checks.
KritikCVSS 9,1İstismar yokEPSS %0
- Girişsiz RCE
apache · wss4j30 Eyl 2026
CVE-2026-88920
39İzleyin
Apache WSS4J: SAML Sender-Vouches Authentication Bypass
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
apache · wss4j30 Eyl 2026
CVE-2026-100507
28İzleyin
WordPress If-So Dynamic Content Personalization plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
if-so dynamic content · if-so dynamic content personalization30 Eyl 2026
CVE-2026-102385
28İzleyin
WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
kevin stover · ninja forms30 Eyl 2026
CVE-2026-102395
28İzleyin
WordPress Easy Google Maps plugin <= 1.14.6 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
supsystic · easy google maps30 Eyl 2026
CVE-2026-102396
28İzleyin
WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
supsystic · ultimate maps by supsystic30 Eyl 2026
CVE-2026-102398
28İzleyin
WordPress Popup by Supsystic plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
supsystic · popup by supsystic30 Eyl 2026
CVE-2026-103321
33İzleyin
MISP Stored Cross-Site Scripting (XSS) via Unvalidated Event Graph Preview Image
YüksekCVSS 8,3İstismar yokEPSS %0
- XSS
misp · misp30 Eyl 2026
CVE-2026-27085
10İzleyin
WordPress Astra WordPress theme theme <= 4.13.12 - Content Injection vulnerability
DüşükCVSS 2,7İstismar yokEPSS %0
- XSS
brainstorm force · astra wordpress theme30 Eyl 2026
CVE-2026-27371
28İzleyin
WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
wpfunnels · wpfunnels30 Eyl 2026
CVE-2026-62085
30İzleyin
WordPress WP Activity Log plugin <= 5.6.6 - SQL Injection vulnerability
YüksekCVSS 7,6İstismar yokEPSS %0
- SQL enjeksiyonu
melapress · wp activity log30 Eyl 2026
CVE-2026-74864
37İzleyin
Authentication Bypass in sogo_yhn
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
- Erişim denetimi (IDOR)
yunohost-apps · sogo_yhn30 Eyl 2026
CVE-2026-74865
36İzleyin
Authentication Bypass in sogo_yhn
KritikCVSS 9,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
- Erişim denetimi (IDOR)
yunohost-apps · sogo_yhn30 Eyl 2026
CVE-2026-76504
70Bu hafta
Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability
KritikCVSS 9,8KEVSilahlaştırılmışEPSS %1
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
cisco · catalyst sd-wan manager30 Eyl 2026
CVE-2026-89238
36İzleyin
Apache WSS4J: WSS4J EncryptedHeader child confusion causing wrong protected-header selection
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
apache · wss4j30 Eyl 2026
CVE-2026-92121
30İzleyin
Apache WSS4J: WS-SecurityPolicy signature checks skipped in the streaming code after an STR-Transform reference
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
apache · wss4j30 Eyl 2026
CVE-2026-93512
28İzleyin
WordPress JW Player for WordPress plugin <= 2.3.11 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
ilghera · jw player for wordpress30 Eyl 2026
CVE-2026-93514
28İzleyin
WordPress Notification for Telegram plugin <= 3.5.2 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
rainafarai · notification for telegram30 Eyl 2026
CVE-2026-93621
32İzleyin
WordPress WP Data Access plugin <= 5.5.84 - SQL Injection vulnerability
YüksekCVSS 8,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- SQL enjeksiyonu
passionate programmer peter · wp data access30 Eyl 2026
CVE-2026-93624
28İzleyin
WordPress Music Player for WooCommerce plugin <= 1.9.1 - PHP Object Injection vulnerability
YüksekCVSS 7,2İstismar yokEPSS %0
- Deserializasyon
codepeople · music player for woocommerce30 Eyl 2026
CVE-2026-93651
28İzleyin
WordPress Minimum and Maximum Quantity for WooCommerce plugin <= 2.1.2 - PHP Object Injection vulnerability
YüksekCVSS 7,2İstismar yokEPSS %0
- Deserializasyon
dotstore · minimum and maximum quantity for woocommerce30 Eyl 2026
CVE-2026-93770
28İzleyin
WordPress WP Statistics plugin <= 14.16.13 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
veronalabs · wp statistics30 Eyl 2026
CVE-2026-93771
28İzleyin
WordPress Cost of Goods for WooCommerce plugin <= 3.5.2 - PHP Object Injection vulnerability
YüksekCVSS 7,2İstismar yokEPSS %0
- Deserializasyon
wpfactory · cost of goods for woocommerce30 Eyl 2026
CVE-2026-94076
35İzleyin
WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.5 - PHP Object Injection vulnerability
YüksekCVSS 8,8İstismar yokEPSS %0
- Deserializasyon
seo squirrly · seo plugin by squirrly seo30 Eyl 2026
CVE-2026-94078
28İzleyin
WordPress Site Reviews plugin <= 8.3.1 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
gemini labs · site reviews30 Eyl 2026
CVE-2026-94081
28İzleyin
WordPress WordPress Persistent Login plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
lukeseager · wordpress persistent login30 Eyl 2026
CVE-2026-94082
30İzleyin
WordPress Quiz Cat plugin <= 3.1.1 - SQL Injection vulnerability
YüksekCVSS 7,6İstismar yokEPSS %0
- SQL enjeksiyonu
fatcatapps · quiz cat30 Eyl 2026
CVE-2026-94115
34İzleyin
WordPress Easy Pricing Tables plugin <= 4.1.2 - SQL Injection vulnerability
YüksekCVSS 8,5İstismar yokEPSS %0
- SQL enjeksiyonu
fatcatapps · easy pricing tables30 Eyl 2026
CVE-2026-94120
30İzleyin
WordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vulnerability
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
gravitykit · gravityexport lite for gravity forms30 Eyl 2026
CVE-2026-94121
35İzleyin
WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.33.6 - PHP Object Injection vulnerability
YüksekCVSS 8,8İstismar yokEPSS %0
- Deserializasyon
10web · 10web booster – website speed optimization, cache & page speed optimizer30 Eyl 2026
CVE-2026-94122
28İzleyin
WordPress Responsive Slider Gallery plugin <= 1.5.5 - PHP Object Injection vulnerability
YüksekCVSS 7,2İstismar yokEPSS %0
- Deserializasyon
a wp life · responsive slider gallery30 Eyl 2026
CVE-2026-94123
30İzleyin
WordPress NextGEN Gallery plugin <= 4.5.0 - Arbitrary File Download vulnerability
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Yol geçişi
syed balkhi · nextgen gallery30 Eyl 2026
CVE-2026-94177
34İzleyin
WordPress GamiPress plugin <= 8.0.2 - SQL Injection vulnerability
YüksekCVSS 8,5İstismar yokEPSS %0
- SQL enjeksiyonu
ruben garcia · gamipress30 Eyl 2026
CVE-2026-94178
30İzleyin
WordPress Import and export users and customers plugin <= 2.5.2 - Privilege Escalation vulnerability
YüksekCVSS 7,5İstismar yokEPSS %0
javier carazo · import and export users and customers30 Eyl 2026
CVE-2026-94389
36İzleyin
WordPress AcyMailing SMTP Newsletter plugin <= 11.0.5 - Remote Code Execution (RCE) vulnerability
KritikCVSS 9,0İstismar yokEPSS %0
- Girişsiz RCE
acymailing newsletter team · acymailing smtp newsletter30 Eyl 2026
CVE-2026-94499
28İzleyin
WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
wpwax · formgent30 Eyl 2026
CVE-2026-94677
28İzleyin
WordPress Kadence WooCommerce Email Designer plugin <= 1.5.19.1 - PHP Object Injection vulnerability
YüksekCVSS 7,2İstismar yokEPSS %0
- Deserializasyon
nexcess · kadence woocommerce email designer30 Eyl 2026
CVE-2026-94678
35İzleyin
WordPress Go Live Update Urls plugin <= 7.0.8 - PHP Object Injection vulnerability
YüksekCVSS 8,8İstismar yokEPSS %0
- Deserializasyon
mat lipe · go live update urls30 Eyl 2026
CVE-2026-94683
35İzleyin
WordPress DesignSetGo plugin <= 2.8.0 - PHP Object Injection vulnerability
YüksekCVSS 8,8İstismar yokEPSS %0
- Deserializasyon
justin nealey · designsetgo30 Eyl 2026
CVE-2026-95531
35İzleyin
WordPress Conversational Forms for ChatBot plugin <= 1.5.0 - PHP Object Injection vulnerability
YüksekCVSS 8,8İstismar yokEPSS %0
- Deserializasyon
quantumcloud · conversational forms for chatbot30 Eyl 2026
CVE-2026-95587
30İzleyin
WordPress Hostinger Migrator plugin <= 1.0 - Broken Access Control vulnerability
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
hostinger · hostinger migrator30 Eyl 2026
CVE-2026-95616
30İzleyin
Apache WSS4J: Unauthenticated denial of service via integer overflow in DER parsing of X.509 certificate extensions
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
- Hizmet dışı bırakma
apache · wss4j30 Eyl 2026
CVE-2026-96343
28İzleyin
WordPress WP ERP plugin <= 1.17.9 - PHP Object Injection vulnerability
YüksekCVSS 7,2İstismar yokEPSS %0
- Deserializasyon
wedevs · wp erp30 Eyl 2026
CVE-2026-96344
28İzleyin
WordPress eCommerce Product Catalog plugin <= 3.6.0 - PHP Object Injection vulnerability
YüksekCVSS 7,2İstismar yokEPSS %0
- Deserializasyon
implecode · ecommerce product catalog30 Eyl 2026
CVE-2026-96345
30İzleyin
WordPress Estatik plugin <= 4.3.5 - SQL Injection vulnerability
YüksekCVSS 7,6İstismar yokEPSS %0
- SQL enjeksiyonu
estatik · estatik30 Eyl 2026
CVE-2026-96346
30İzleyin
WordPress WP ERP plugin <= 1.17.9 - SQL Injection vulnerability
YüksekCVSS 7,6İstismar yokEPSS %0
- SQL enjeksiyonu
wedevs · wp erp30 Eyl 2026
CVE-2026-96348
30İzleyin
WordPress Bookly plugin <= 28.2 - Broken Access Control vulnerability
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
bookly · bookly30 Eyl 2026
CVE-2026-96349
40Planlayın
WordPress SiteSkite plugin <= 2.1.8 - Remote Code Execution (RCE) vulnerability
KritikCVSS 10,0Kavram kanıtıEPSS %0
- Girişsiz RCE
siteskite · siteskite30 Eyl 2026
CVE-2026-96350
39İzleyin
WordPress Estatik plugin <= 4.3.5 - Privilege Escalation vulnerability
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
estatik · estatik30 Eyl 2026
CVE-2026-96351
28İzleyin
WordPress Classified Listing plugin <= 6.1.3 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
radiustheme · classified listing30 Eyl 2026
CVE-2026-96352
28İzleyin
WordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
yithemes · yith woocommerce ajax search30 Eyl 2026
CVE-2026-96814
28İzleyin
WordPress WooCommerce Product Table Lite plugin <= 5.6.7 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
wp titan labs · woocommerce product table lite30 Eyl 2026
CVE-2026-96815
28İzleyin
WordPress Vitepos plugin <= 3.5.0 - Privilege Escalation vulnerability
YüksekCVSS 7,2İstismar yokEPSS %0
appsbd · vitepos30 Eyl 2026
CVE-2026-96816
28İzleyin
WordPress Trusted Shops Easy Integration for WooCommerce plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
vendidero · trusted shops easy integration for woocommerce30 Eyl 2026
CVE-2026-96817
32İzleyin
WordPress MakeCommerce for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerability
YüksekCVSS 8,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
makecommerce.net · makecommerce for woocommerce30 Eyl 2026
CVE-2026-96818
30İzleyin
WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
mra13 / team tips and tricks hq · wp express checkout (accept paypal payments)30 Eyl 2026
CVE-2026-96819
28İzleyin
WordPress oik plugin <= 4.15.4 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
bobbingwide · oik30 Eyl 2026
CVE-2026-96820
28İzleyin
WordPress Awesome Support plugin <= 6.3.9 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
awesomesupport · awesome support30 Eyl 2026
CVE-2026-96822
37İzleyin
WordPress Books Gallery plugin <= 4.8.3 - SQL Injection vulnerability
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- SQL enjeksiyonu
hossni mubarak · books gallery30 Eyl 2026
CVE-2026-96823
30İzleyin
WordPress Customer Reviews for WooCommerce plugin <= 5.120.0 - Arbitrary Content Deletion vulnerability
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
- Hizmet dışı bırakma
cusrev · customer reviews for woocommerce30 Eyl 2026
CVE-2026-96827
30İzleyin
WordPress Admin Notices Manager plugin <= 1.6.0 - SQL Injection vulnerability
YüksekCVSS 7,6İstismar yokEPSS %0
- SQL enjeksiyonu
melapress · admin notices manager30 Eyl 2026
CVE-2026-96828
30İzleyin
WordPress Category Discount Woocommerce plugin <= 5.18 - SQL Injection vulnerability
YüksekCVSS 7,6İstismar yokEPSS %0
- SQL enjeksiyonu
vidish · category discount woocommerce30 Eyl 2026
CVE-2026-96830
28İzleyin
WordPress GiveWP plugin <= 4.16.9 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
nexcess · givewp30 Eyl 2026