İçeriğe atla
Noroxi

Yayın tarihine göre

Eylül 2026: sömürülen ve yeni ciddi CVE kayıtları

7.959 kayıt · 32 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 9 / 80

  • CVE-2021-44320
    30İzleyin

    Parrot AR.Drone version 1 and 2 does not employ a suitable mechanism to prevent denial-of-service (DoS) attacks.

    YüksekCVSS 7,5İstismar yokEPSS %0

    4 Eyl 2026

  • CVE-2026-18149
    23İzleyin

    undici vulnerable to Denial of Service via orphaned RetryHandler response body

    OrtaCVSS 5,9İstismar yokEPSS %0

    nodejs · undici4 Eyl 2026

  • CVE-2026-19534
    30İzleyin

    undici vulnerable to Denial of Service via unrequested WebSocket subprotocol

    YüksekCVSS 7,5İstismar yokEPSS %0

    nodejs · undici4 Eyl 2026

  • CVE-2026-50553
    34İzleyin

    Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)

    YüksekCVSS 8,6İstismar yokEPSS %0

    enchant97 · note-mark4 Eyl 2026

  • CVE-2026-53758
    34İzleyin

    Emlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not Sanitized

    YüksekCVSS 8,7İstismar yokEPSS %0

    emlog · emlog4 Eyl 2026

  • CVE-2026-53761
    32İzleyin

    Frappe CRM: Authentication Bypass via Logged Invitation Keys in crm/api

    YüksekCVSS 8,2İstismar yokEPSS %0

    frappe · crm4 Eyl 2026

  • CVE-2026-57159
    33İzleyin

    PJSIP: SDP parser out-of-bounds write in remote payload-type map maintenance

    YüksekCVSS 8,4İstismar yokEPSS %0

    teluu · pjsip4 Eyl 2026

  • CVE-2026-57161
    35İzleyin

    PJSIP: Stack overflow handling Service-Route headers in a registration response

    YüksekCVSS 8,8İstismar yokEPSS %0

    teluu · pjsip4 Eyl 2026

  • CVE-2026-57162
    35İzleyin

    PJSIP: Stack overflow parsing SDP a=crypto attributes

    YüksekCVSS 8,8İstismar yokEPSS %0

    teluu · pjsip4 Eyl 2026

  • CVE-2026-57163
    35İzleyin

    PJSIP: Stack overflow parsing a TLS peer certificate's SubjectAltName in GnuTLS backend

    YüksekCVSS 8,8İstismar yokEPSS %0

    teluu · pjsip4 Eyl 2026

  • CVE-2026-57164
    33İzleyin

    PJSIP: Heap overflow in the HTTP client

    YüksekCVSS 8,3İstismar yokEPSS %0

    teluu · pjsip4 Eyl 2026

  • CVE-2026-61686
    30İzleyin

    SolidInvoice: PHP unserialize() called on client-controlled data in DataGrid LiveComponent context prop

    YüksekCVSS 7,5İstismar yokEPSS %0

    solidinvoice · solidinvoice4 Eyl 2026

  • CVE-2026-85654
    28İzleyin

    Code injection in the CDK generator in Amazon awslabs.dynamodb-mcp-server

    YüksekCVSS 7,1İstismar yokEPSS %0

    amazon · awslabs.dynamodb-mcp-server4 Eyl 2026

  • CVE-2026-85656
    34İzleyin

    OS command injection in Amazon log4j-cve-2021-44228-hotpatch

    YüksekCVSS 8,5İstismar yokEPSS %1

    amazon · log4j-cve-2021-44228-hotpatch4 Eyl 2026

  • CVE-2026-85769
    26İzleyin

    Libtpms: libtpms: heap out-of-bounds read in tpm2 state unmarshalling via unchecked block_skip_read() blocksize

    OrtaCVSS 6,5Kavram kanıtıEPSS %0

    red hat · red hat enterprise linux 104 Eyl 2026

  • CVE-2026-9317
    36İzleyin

    Nango < 0.71.6 Missing Authentication RCE via runner tRPC server

    KritikCVSS 9,2İstismar yokEPSS %1

    nangohq · nango4 Eyl 2026

  • CVE-2026-71620
    32İzleyin

    File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file

    YüksekCVSS 8,1İstismar yokEPSS %0

    4 Eyl 2026

  • CVE-2026-78327
    36İzleyin

    An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Securit

    KritikCVSS 9,1İstismar yokEPSS %1

    sonicwall · network security manager (nsm)4 Eyl 2026

  • CVE-2026-78328
    36İzleyin

    A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged

    KritikCVSS 9,1İstismar yokEPSS %0

    sonicwall · network security manager (nsm)4 Eyl 2026

  • CVE-2026-78839
    32İzleyin

    An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar fil

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    4 Eyl 2026

  • CVE-2026-80112
    34İzleyin

    PassMark PerformanceTest, BurnInTest, and OSForensics Improper Access Control via DirectIo64.sys

    YüksekCVSS 8,5İstismar yokEPSS %0

    passmark software · performancetest4 Eyl 2026

  • CVE-2026-80114
    34İzleyin

    PassMark PerformanceTest, BurnInTest, and OSForensics Hard-coded Credentials Authentication Bypass via DirectIo64.sys

    YüksekCVSS 8,5İstismar yokEPSS %0

    passmark software · performancetest4 Eyl 2026

  • CVE-2026-80116
    34İzleyin

    PassMark PerformanceTest, BurnInTest, and OSForensics Privilege Escalation via DirectIo64.sys IOCTL

    YüksekCVSS 8,5İstismar yokEPSS %0

    passmark software · performancetest4 Eyl 2026

  • CVE-2026-80118
    33İzleyin

    PassMark PerformanceTest, BurnInTest, and OSForensics Kernel Null Pointer Dereference via DirectIo64.sys IOCTL

    YüksekCVSS 8,4İstismar yokEPSS %0

    passmark software · performancetest4 Eyl 2026

  • CVE-2026-80119
    34İzleyin

    PassMark PerformanceTest, BurnInTest, and OSForensics Physical Memory Disclosure via DirectIo64.sys IOCTL

    YüksekCVSS 8,5İstismar yokEPSS %0

    passmark software · performancetest4 Eyl 2026

  • CVE-2026-81939
    36İzleyin

    A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an

    KritikCVSS 9,1İstismar yokEPSS %0

    sonicwall · network security manager (nsm)4 Eyl 2026

  • CVE-2026-53603
    28İzleyin

    nebula-mesh: Operator session tokens stored in plaintext in the database

    YüksekCVSS 7,1İstismar yokEPSS %0

    forgekeep · nebula-mesh4 Eyl 2026

  • CVE-2026-53604
    28İzleyin

    nebula-mesh: CA private key not zeroized on web mobile-bundle error paths

    YüksekCVSS 7,1İstismar yokEPSS %0

    forgekeep · nebula-mesh4 Eyl 2026

  • CVE-2026-53932
    33İzleyin

    wnx/laravel-backup-restore: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') and Improper Neutralization of Special El

    YüksekCVSS 8,0İstismar yokEPSS %1

    stefanzweifel · laravel-backup-restore4 Eyl 2026

  • CVE-2026-19304
    30İzleyin

    Langflow is vulnerable to Server-Side Request Forgery due to missing or bypassable URL validation in multiple components

    YüksekCVSS 7,7İstismar yokEPSS %0

    langflow · langflow4 Eyl 2026

  • CVE-2026-61699
    32İzleyin

    nebula-mesh: Certificate revocation is never enforced at the mesh

    YüksekCVSS 8,1İstismar yokEPSS %0

    forgekeep · nebula-mesh4 Eyl 2026

  • CVE-2026-63464
    30İzleyin

    Nebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`

    YüksekCVSS 7,7İstismar yokEPSS %0

    forgekeep · nebula-mesh4 Eyl 2026

  • CVE-2026-71622
    29İzleyin

    SQL injection vulnerability in Zhao-github APiAdmin v.5.0.1 allows a remote attacker to obtain sensitive information via the User.php compon

    YüksekCVSS 7,4İstismar yokEPSS %0

    4 Eyl 2026

  • CVE-2026-71624
    39İzleyin

    An issue in esoTalk v.1.0.0g4 allows a remote attacker to execute arbitrary code via the core/models/ETMemberModel.class.php, core/controlle

    KritikCVSS 9,8İstismar yokEPSS %0

    4 Eyl 2026

  • CVE-2026-71625
    39İzleyin

    An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges via the ResetPasswordController.php component

    KritikCVSS 9,8İstismar yokEPSS %0

    4 Eyl 2026

  • CVE-2026-71626
    30İzleyin

    An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information via the StoreWebhookRequest.php, UpdateWebhookRe

    YüksekCVSS 7,5İstismar yokEPSS %0

    4 Eyl 2026

  • CVE-2026-79389
    29İzleyin

    Trueview T18161 S 6.0.23.4 contains an improper verification in MQTT command processing.

    YüksekCVSS 7,4İstismar yokEPSS %0

    4 Eyl 2026

  • CVE-2026-79390
    30İzleyin

    Trueview TI8161 6.0.23.4 is vulnerable to information disclosure due to the transmission of MQTT communications in plaintext over TCP port 1

    YüksekCVSS 7,5İstismar yokEPSS %0

    4 Eyl 2026

  • CVE-2026-79391
    39İzleyin

    No authentication exists in the MQTT service of Trueview 6.0.23.4.

    KritikCVSS 9,8İstismar yokEPSS %0

    4 Eyl 2026

  • CVE-2026-85786
    34İzleyin

    Incomplete fix for CVE-2026-75936 memory-amplification denial of service in Amazon ion-java

    YüksekCVSS 8,7İstismar yokEPSS %0

    amazon · ion-java4 Eyl 2026

  • CVE-2026-80775
    0İzleyin

    futex: Fix race on the initial mm->futex.phash.ref allocation

    Kavram kanıtıEPSS %0

    linux · linux4 Eyl 2026

  • CVE-2026-80844
    0İzleyin

    xfrm: ah6: validate routing header segments_left

    Kavram kanıtıEPSS %0

    linux · linux4 Eyl 2026

  • CVE-2026-50894
    39İzleyin

    easyadmin v2.0.2.2 is vulnerable to Unrestricted Upload of File with Dangerous Type in the background management interface which allows auth

    KritikCVSS 9,8İstismar yokEPSS %0

    4 Eyl 2026

  • CVE-2026-75438
    30İzleyin

    Buffer Overflow vulnerability in Open5GS v2.7.7 allows a remote attacker to cause a denial of service via the ogs_sbi_time_parse() function

    YüksekCVSS 7,5İstismar yokEPSS %0

    4 Eyl 2026

  • CVE-2026-75439
    30İzleyin

    An issue in Free5GC v.4.2.2 allows a remote attacker to cause a denial of service via the UPF component

    YüksekCVSS 7,5İstismar yokEPSS %0

    4 Eyl 2026

  • CVE-2026-77847
    28İzleyin

    Tycon Systems TPDIN-Monitor-WEB3 Use of Hard-coded Credentials

    YüksekCVSS 7,1İstismar yokEPSS %0

    tycon systems · tpdin-monitor-web34 Eyl 2026

  • CVE-2026-79423
    35İzleyin

    An authenticated remote code execution (RCE) vulnerability in the admin_config.php component of seacms v13.6 allows attackers to execute arb

    YüksekCVSS 8,8İstismar yokEPSS %0

    4 Eyl 2026

  • CVE-2026-79426
    28İzleyin

    An arbitrary file deletion vulnerability in the /adminapi/file/video_data_save component of CRMEB v6.0.0 allows authenticated attackers to d

    YüksekCVSS 7,2İstismar yokEPSS %0

    4 Eyl 2026

  • CVE-2026-82712
    34İzleyin

    Tycon Systems TPDIN-Monitor-WEB3 Cross-Site Request Forgery

    YüksekCVSS 8,6İstismar yokEPSS %0

    tycon systems · tpdin-monitor-web34 Eyl 2026

  • CVE-2026-85787
    28İzleyin

    An incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-server

    YüksekCVSS 7,1İstismar yokEPSS %0

    amazon · postgres-mcp-server4 Eyl 2026

  • CVE-2026-46636
    34İzleyin

    Twig: Sandbox method allowlist bypass via `Markup` subclass

    YüksekCVSS 8,7İstismar yokEPSS %0

    twigphp · twig4 Eyl 2026

  • CVE-2026-75925
    37İzleyin

    IXON VPN Client CRLF Injection

    KritikCVSS 9,4İstismar yokEPSS %0

    ixon · ixon vpn client4 Eyl 2026

  • CVE-2026-77393
    34İzleyin

    Inductive Automation Ignition Incorrect Default Permissions

    YüksekCVSS 8,7İstismar yokEPSS %0

    inductive automation · ignition4 Eyl 2026

  • CVE-2026-82684
    34İzleyin

    Tycon Systems TPDIN-Monitor-WEB3 Missing Authorization

    YüksekCVSS 8,6İstismar yokEPSS %0

    tycon systems · tpdin-monitor-web34 Eyl 2026

  • CVE-2026-86090
    28İzleyin

    ntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers

    YüksekCVSS 7,1İstismar yokEPSS %0

    ntop · ntopng4 Eyl 2026

  • CVE-2026-86091
    28İzleyin

    ntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler

    YüksekCVSS 7,1İstismar yokEPSS %0

    ntop · ntopng4 Eyl 2026

  • CVE-2026-82538
    34İzleyin

    ILIAS Arbitrary SQL Injection via Repository Trash Table Sort Parameter

    YüksekCVSS 8,7İstismar yokEPSS %0

    ilias-elearning e.v. · ilias4 Eyl 2026

  • CVE-2026-48019
    35İzleyin

    CRLF injection in Laravel's default email rule enables SMTP smuggling and spoofed-mail relay

    YüksekCVSS 8,9Kavram kanıtıEPSS %0

    laravel · framework4 Eyl 2026

  • CVE-2026-86095
    34İzleyin

    Unidata netcdf-c through 4.10.1 Out-of-bounds Write via Oversized HDF5 Attribute Name

    YüksekCVSS 8,5İstismar yokEPSS %0

    unidata · netcdf-c4 Eyl 2026

  • CVE-2026-86097
    28İzleyin

    PX4 Autopilot through 1.17.0 Null Pointer Dereference via param select

    YüksekCVSS 7,1İstismar yokEPSS %0

    px4 · px4-autopilot4 Eyl 2026

  • CVE-2026-86098
    33İzleyin

    ntop nDPI before 6.0 Heap Buffer Overflow via ndpi_json_string_escape

    YüksekCVSS 8,3İstismar yokEPSS %0

    ntop · ndpi4 Eyl 2026

  • CVE-2026-52762
    28İzleyin

    YesWiki: Authenticated (Admin) Server-Side Template Injection to Remote Code Execution via Bazar Semantic Templates

    YüksekCVSS 7,1İstismar yokEPSS %0

    yeswiki · yeswiki4 Eyl 2026

  • CVE-2026-52763
    26İzleyin

    YesWiki: SQL injection via the `recentchanges` action `period` argument leading to arbitrary DB read

    OrtaCVSS 6,5İstismar yokEPSS %0

    yeswiki · yeswiki4 Eyl 2026

  • CVE-2026-52766
    36İzleyin

    YesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action

    KritikCVSS 9,1İstismar yokEPSS %0

    yeswiki · yeswiki4 Eyl 2026

  • CVE-2026-52767
    32İzleyin

    YesWiki: Unauthenticated ActivityPub Signature-Verification Bypass via `!openssl_verify(...)` accepting `int(-1)`

    YüksekCVSS 8,2İstismar yokEPSS %0

    yeswiki · yeswiki4 Eyl 2026

  • CVE-2026-52769
    33İzleyin

    YesWiki: Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`

    YüksekCVSS 8,3İstismar yokEPSS %0

    yeswiki · yeswiki4 Eyl 2026

  • CVE-2026-52770
    30İzleyin

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in yeswiki/yeswiki

    YüksekCVSS 7,5İstismar yokEPSS %0

    yeswiki · yeswiki4 Eyl 2026

  • CVE-2026-52771
    33İzleyin

    YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)

    YüksekCVSS 8,3İstismar yokEPSS %0

    yeswiki · yeswiki4 Eyl 2026

  • CVE-2026-52773
    24İzleyin

    Reflected XSS via Unescaped Archived-Revision `time` Parameter in `handlers/page/show.php` in YesWiki

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    yeswiki · yeswiki4 Eyl 2026

  • CVE-2026-52774
    24İzleyin

    Reflected XSS via Unescaped `id` Parameter in Bazar Widget HTML Attributes in YesWiki

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    yeswiki · yeswiki4 Eyl 2026

  • CVE-2026-52775
    35İzleyin

    YesWiki Authenticated SQL Injection in ReactionManager

    YüksekCVSS 8,8İstismar yokEPSS %0

    yeswiki · yeswiki4 Eyl 2026

  • CVE-2026-52777
    37İzleyin

    YesWiki: Authenticated PHP Object Injection in BazarImportAction via unserialize

    KritikCVSS 9,4İstismar yokEPSS %0

    yeswiki · yeswiki4 Eyl 2026

  • CVE-2025-67066
    39İzleyin

    SQL Injection vulnerability in oasys sysoa version 1.0 allows a remote attacker to execute arbitrary code via the outtype parameter in the /

    KritikCVSS 9,8İstismar yokEPSS %0

    4 Eyl 2026

  • GHSA-7q9c-hpx7-9cwm
    30İzleyin

    TypeSpec: Unauthenticated Remote Shutdown of Spector Mock Server via POST /.admin/stop

    YüksekCVSS 7,5İstismar yok

    npm · @typespec/spector4 Eyl 2026

  • CVE-2026-86138
    31İzleyin

    In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow.

    YüksekCVSS 7,8İstismar yokEPSS %0

    xmlsoft · libxml25 Eyl 2026

  • CVE-2026-86139
    31İzleyin

    In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow.

    YüksekCVSS 7,8İstismar yokEPSS %0

    xmlsoft · libxml25 Eyl 2026

  • CVE-2026-86140
    31İzleyin

    In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow.

    YüksekCVSS 7,8İstismar yokEPSS %0

    xmlsoft · libxml25 Eyl 2026

  • CVE-2026-86142
    31İzleyin

    In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation.

    YüksekCVSS 7,8İstismar yokEPSS %0

    xmlsoft · libxml25 Eyl 2026

  • CVE-2026-86143
    29İzleyin

    In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks

    YüksekCVSS 7,3İstismar yokEPSS %0

    xmlsoft · libxml25 Eyl 2026

  • CVE-2026-86144
    31İzleyin

    In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags.

    YüksekCVSS 7,8İstismar yokEPSS %0

    xmlsoft · libxml25 Eyl 2026

  • CVE-2026-13447
    39İzleyin

    MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via 'id_token' Parameter JWT Forgery

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    inspireui · mstore api – create native android & ios apps on the cloud5 Eyl 2026

  • CVE-2026-77233
    28İzleyin

    iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Re

    YüksekCVSS 7,2İstismar yokEPSS %0

    iubenda · iubenda | all-in-one compliance for gdpr / ccpa cookie consent + more5 Eyl 2026

  • CVE-2026-77263
    28İzleyin

    iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content

    YüksekCVSS 7,2İstismar yokEPSS %0

    iubenda · iubenda | all-in-one compliance for gdpr / ccpa cookie consent + more5 Eyl 2026

  • CVE-2026-83627
    39İzleyin

    Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    wpmudev · hummingbird performance – cache & page speed optimization for core web vitals | critical css | minify css | defer css javascript | cdn5 Eyl 2026

  • CVE-2026-86145
    32İzleyin

    PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching works

    YüksekCVSS 8,2İstismar yokEPSS %0

    pcre · pcre25 Eyl 2026

  • CVE-2026-15984
    28İzleyin

    QuickCal <= 1.0.20 - Unauthenticated Stored Cross-Site Scripting via Custom Field Parameters

    YüksekCVSS 7,2İstismar yokEPSS %0

    themovation · quickcal5 Eyl 2026

  • CVE-2026-16649
    28İzleyin

    Gravity Forms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field Value

    YüksekCVSS 7,2İstismar yokEPSS %0

    gravity forms · gravity forms5 Eyl 2026

  • CVE-2026-18406
    28İzleyin

    SureForms <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload

    YüksekCVSS 7,2İstismar yokEPSS %0

    brainstormforce · sureforms – contact form builder, ai forms, payment form, survey & quiz5 Eyl 2026

  • CVE-2026-19769
    28İzleyin

    Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key

    YüksekCVSS 7,2İstismar yokEPSS %0

    kstover · ninja forms – the contact form builder that grows with you5 Eyl 2026

  • CVE-2026-19858
    30İzleyin

    JetFormBuilder < 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic Preset

    YüksekCVSS 7,5İstismar yokEPSS %0

    unknown · jetformbuilder — dynamic blocks form builder5 Eyl 2026

  • CVE-2026-19887
    35İzleyin

    Welcart e-Commerce <= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback

    YüksekCVSS 8,8İstismar yokEPSS %1

    uscnanbu · welcart e-commerce5 Eyl 2026

  • CVE-2026-77826
    35İzleyin

    RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Facebook Token Audience Validation

    YüksekCVSS 8,8İstismar yokEPSS %0

    unknown · registrationmagic5 Eyl 2026

  • CVE-2026-77830
    28İzleyin

    Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.86 - Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder

    YüksekCVSS 7,2İstismar yokEPSS %0

    cleantalk · spam protection, honeypot, anti-spam by cleantalk5 Eyl 2026

  • CVE-2026-78362
    39İzleyin

    SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation via API Key Authentication

    KritikCVSS 9,8İstismar yokEPSS %0

    unknown · seo flow by lupsonline5 Eyl 2026

  • CVE-2026-78438
    28İzleyin

    W3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator

    YüksekCVSS 7,2İstismar yokEPSS %0

    boldgrid · w3 total cache5 Eyl 2026

  • CVE-2026-81404
    28İzleyin

    IPGP Visitors Origin < 1.6 - Reflected XSS

    YüksekCVSS 7,1İstismar yokEPSS %0

    unknown · ipgp visitors origin5 Eyl 2026

  • CVE-2026-82304
    34İzleyin

    Music Store – WordPress eCommerce < 1.4.5 - Unauthenticated SQLi via paypal-data Handler

    YüksekCVSS 8,6İstismar yokEPSS %0

    unknown · music store5 Eyl 2026

  • CVE-2026-84934
    32İzleyin

    JCH Optimize < 6.0.1 - Subscriber+ Stored XSS via getcacheinfo Task Override

    YüksekCVSS 8,0İstismar yokEPSS %0

    unknown · jch optimize5 Eyl 2026

  • CVE-2026-84935
    32İzleyin

    HT Menu < 1.2.7 - Subscriber+ Stored XSS via Menu Settings

    YüksekCVSS 8,0İstismar yokEPSS %0

    unknown · ht menu5 Eyl 2026

  • CVE-2026-81543
    35İzleyin

    Abandoned Cart Pro for WooCommerce <= 10.7.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

    YüksekCVSS 8,8İstismar yokEPSS %0

    tyche softwares · abandoned cart pro for woocommerce5 Eyl 2026