Yayın tarihine göre

Ekim 2026: sömürülen ve yeni ciddi CVE kayıtları

5.164 kayıt · 10 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 1 / 52

CVE kayıtları
Aksiyon	CVE	Zafiyet	Ciddiyet	KEV	EPSS	Yayın
27İzleyin	CVE-2026-103532İstismar yok	immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorizationimmich-app · immich · CWE-266 Kimlik doğrulamasız	Orta6,9	—	%0,3	1 Eki 2026
35İzleyin	CVE-2026-13313İstismar yok	An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass sasus · router · CWE-489	Yüksek8,9	—	%0,6	1 Eki 2026
37İzleyin	CVE-2026-14157İstismar yok	Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands viaasus · router · CWE-134 RCE	Kritik9,4	—	%0,7	1 Eki 2026
28İzleyin	CVE-2026-93495İstismar yok	Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a asus · motherboard(prime z390-a ) · CWE-665	Yüksek7,0	—	%0,1	1 Eki 2026
30İzleyin	CVE-2026-92245İstismar yok	Simply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recucroixhaug · simply schedule appointments · CWE-862 Kimlik doğrulamasız Erişim denetimi (IDOR)	Yüksek7,5	—	%0,4	1 Eki 2026
28İzleyin	CVE-2026-96561İstismar yok	AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injectiontigroumeow · ai engine – the chatbot, ai framework & mcp for wordpress · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,2	—	%0,3	1 Eki 2026
37İzleyin	CVE-2026-76142İstismar yok	Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interfacegenians, inc · genian nac 5.0.75 lts release · CWE-284 Kimlik doğrulamasız Erişim denetimi (IDOR)	Kritik9,3	—	%0,3	1 Eki 2026
29İzleyin	CVE-2026-76143İstismar yok	Genians, Inc Genian SSL PNS Multi Factor Authentication Bypassgenians, inc · genian ssl pns (frodo-core) · CWE-862 Kimlik doğrulama atlatma Erişim denetimi (IDOR)	Yüksek7,3	—	%0,3	1 Eki 2026
30İzleyin	CVE-2026-76145İstismar yok	Genians, Inc Genian SSL PNS Improper Privilege Managementgenians, inc · genian ssl pns (frodo-core) · CWE-269	Yüksek7,5	—	%0,2	1 Eki 2026
34İzleyin	CVE-2026-76146İstismar yok	Genians, Inc Genian SSL PNS OS Command Injectiongenians, inc · genian ssl pns (xenics_auther) · CWE-78 Girişsiz RCE Komut enjeksiyonu	Yüksek8,4	—	%1,9	1 Eki 2026
28İzleyin	CVE-2026-78210İstismar yok	In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without octopus deploy · octopus server · CWE-863 RCE Erişim denetimi (IDOR)	Yüksek7,1	—	%0,2	1 Eki 2026
37İzleyin	CVE-2026-82824İstismar yok	Path traversal may allow arbitrary files to be viewed, created, modified, or deletedhitachi industrial equipment systems · hitachi coding software suite · CWE-35 Kimlik doğrulamasız Yol geçişi	Kritik9,3	—	%0,3	1 Eki 2026
37İzleyin	CVE-2026-82825İstismar yok	Missing proper authentication for critical APIs may allow sensitive information to be obtained or modified, or unauthorized operations to be performedhitachi industrial equipment systems · hitachi coding software suite · CWE-306 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,3	—	%0,3	1 Eki 2026
34İzleyin	CVE-2026-82826İstismar yok	Authentication information or sensitive data may be intercepted in transithitachi industrial equipment systems · hitachi coding software suite · CWE-319 Kimlik doğrulamasız Zayıf kripto	Yüksek8,7	—	%0,1	1 Eki 2026
37İzleyin	CVE-2026-82827İstismar yok	A hard-coded JWT signing secret key may allow administrative functions to be abused using fraudulently generated Bearer tokenshitachi industrial equipment systems · hitachi coding software suite · CWE-321 Kimlik doğrulamasız Gömülü kimlik bilgisi	Kritik9,3	—	%0,2	1 Eki 2026
34İzleyin	CVE-2026-82828İstismar yok	Improper authorization may allow a general user to perform operations equivalent to those available with administrator privilegeshitachi industrial equipment systems · hitachi coding software suite · CWE-863 Erişim denetimi (IDOR)	Yüksek8,7	—	%0,2	1 Eki 2026
37İzleyin	CVE-2026-82829İstismar yok	Hidden accounts or hard-coded credentials may permit unauthorized access without the legitimate authentication processhitachi industrial equipment systems · hitachi coding software suite · CWE-912 Kimlik doğrulamasız Gömülü kimlik bilgisi	Kritik9,3	—	%0,2	1 Eki 2026
36İzleyin	CVE-2026-92966Kavram kanıtı	Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Fieldlatepoint · appointment booking plugin – latepoint \| calendar & scheduling for wordpress · CWE-94 Girişsiz RCE	Kritik9,1	—	%0,4	1 Eki 2026
35İzleyin	CVE-2026-101147İstismar yok	Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRFunknown · featured image from url (fifu) · CWE-352 Kimlik doğrulamasız CSRF	Yüksek8,8	—	%0,1	1 Eki 2026
40Planlayın	CVE-2026-101148İstismar yok	BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration Keyunknown · backupsheep wordpress backup plugin · CWE-73 Kimlik doğrulamasız Yol geçişi	Kritik10,0	—	%0,3	1 Eki 2026
34İzleyin	CVE-2026-19253İstismar yok	Cache Enabler < 1.8.17 - Unauthenticated Arbitrary File and Directory Deletion via cache_enabler_clear_page_cache_by_urlunknown · cache enabler · CWE-73 Kimlik doğrulamasız Yol geçişi	Yüksek8,7	—	%0,2	1 Eki 2026
35İzleyin	CVE-2026-80275İstismar yok	Comelit 1456B gateway allows low priviledge user to overwrite installer password via unauthorized endpointcomelit group s.p.a. · 1456b multi-user gateway · CWE-425	Yüksek8,8	—	%0,2	1 Eki 2026
30İzleyin	CVE-2026-80276İstismar yok	Comelit 1456B gateway exposes remote configuration password via unauthenticated management interfacecomelit group s.p.a. · 1456b multi-user gateway · CWE-306 Kimlik doğrulamasız Kimlik doğrulama atlatma	Yüksek7,5	—	%0,3	1 Eki 2026
30İzleyin	CVE-2026-81739İstismar yok	Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callbackunknown · paytm payment gateway · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,5	—	%0,2	1 Eki 2026
30İzleyin	CVE-2026-81809İstismar yok	Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callbackunknown · paytm payment gateway · CWE-89 Kimlik doğrulamasız SQL enjeksiyonu	Yüksek7,5	—	%0,1	1 Eki 2026
28İzleyin	CVE-2026-85679İstismar yok	Extendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Keyextendify · extendify · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,2	—	%0,3	1 Eki 2026
34İzleyin	CVE-2026-89296İstismar yok	Pro Like Button < 2.0 - Unauthenticated SQLi via 'postid' Parameterunknown · pro like button · CWE-89 Kimlik doğrulamasız SQL enjeksiyonu	Yüksek8,6	—	%0,2	1 Eki 2026
28İzleyin	CVE-2026-92412İstismar yok	Five Star Restaurant Reviews < 2.3.14 - Reflected XSSunknown · five star restaurant reviews · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,1	—	%0,1	1 Eki 2026
30İzleyin	CVE-2026-96255İstismar yok	Payments for Hubtel < 1.0.2 - Unauthenticated Payment Gateway Credentials Disclosure via Debug Logunknown · payments for hubtel · CWE-200 Kimlik doğrulamasız Bilgi sızıntısı	Yüksek7,5	—	%0,2	1 Eki 2026
37İzleyin	CVE-2025-41753İstismar yok	Path traversal in dynamically created BACnet File Objectswago · 0751-9x01 · CWE-22 Kimlik doğrulamasız Yol geçişi	Kritik9,3	—	%0,5	1 Eki 2026
30İzleyin	CVE-2026-103651İstismar yok	MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypassmisp · misp · CWE-287 Kimlik doğrulama atlatma	Yüksek7,6	—	%0,1	1 Eki 2026
39İzleyin	CVE-2026-15989Kavram kanıtı	Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameterwebrehab · super forms – drag & drop form builder · CWE-269 Kimlik doğrulamasız	Kritik9,8	—	%0,2	1 Eki 2026
35İzleyin	CVE-2026-19807İstismar yok	ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Toolbytecorestack · bytecorestack – mcp connector for ai tools · CWE-269	Yüksek8,8	—	%0,3	1 Eki 2026
39İzleyin	CVE-2026-75957İstismar yok	Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' Parametersuperdav42 · ultimate multisite – wordpress multisite saas & waas platform · CWE-287 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,8	—	%0,5	1 Eki 2026
30İzleyin	CVE-2026-93882İstismar yok	LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameterthimpress · learnpress – wordpress lms plugin for create and sell online courses · CWE-639 Kimlik doğrulamasız Erişim denetimi (IDOR)	Yüksek7,5	—	%0,3	1 Eki 2026
30İzleyin	CVE-2026-103431İstismar yok	Collectl: collectl: colmux does not sanitize ansi/vt100 terminal escape sequences in data received from remote collectl instancesCWE-150	Yüksek7,7	—	%0,1	1 Eki 2026
37İzleyin	CVE-2026-103655İstismar yok	MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Periodmisp · misp · CWE-294 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,3	—	%0,3	1 Eki 2026
28İzleyin	CVE-2026-103659İstismar yok	MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributesmisp · misp · CWE-285 Erişim denetimi (IDOR)	Yüksek7,1	—	%0,2	1 Eki 2026
28İzleyin	CVE-2026-14995İstismar yok	Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Pathoptimizingmatters · autoptimize · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,2	—	%0,2	1 Eki 2026
32İzleyin	CVE-2026-15983İstismar yok	Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameterwebrehab · super forms – drag & drop form builder · CWE-73 Yol geçişi	Yüksek8,1	—	%0,5	1 Eki 2026
28İzleyin	CVE-2026-85235İstismar yok	Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Fieldwpmudev · forminator forms – contact form, payment form & custom form builder · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,2	—	%0,2	1 Eki 2026
28İzleyin	CVE-2026-92244İstismar yok	PDF Invoices & Packing Slips for WooCommerce <= 5.16.1 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fieldswpovernight · pdf invoices & packing slips for woocommerce · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,2	—	%0,2	1 Eki 2026
35İzleyin	CVE-2026-95687İstismar yok	WPC Shop as a Customer for WooCommerce <= 2.0.0 - Authenticated (Subscriber+) Privilege Escalation via Missing Role Check on Target User to wpcsa_login AJAX Endwpclever · wpc shop as a customer for woocommerce · CWE-269	Yüksek8,8	—	%0,4	1 Eki 2026
28İzleyin	CVE-2026-96573İstismar yok	Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderecodepeople · appointment hour booking – booking calendar · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,2	—	%0,2	1 Eki 2026
28İzleyin	CVE-2026-96813İstismar yok	Form Maker by 10Web <= 1.15.47 - Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields10web · form maker by 10web – mobile-friendly drag & drop contact form builder · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,2	—	%0,3	1 Eki 2026
28İzleyin	CVE-2026-97661İstismar yok	Business Essentials for Contact Form 7 <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting via 'gateway' Form Fieldscottpaterson · business essentials for contact form 7 · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,2	—	%0,2	1 Eki 2026
28İzleyin	CVE-2026-103488İstismar yok	In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access rejetbrains · youtrack · CWE-863 Erişim denetimi (IDOR)	Yüksek7,1	—	%0,2	1 Eki 2026
28İzleyin	CVE-2026-103490İstismar yok	In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group linksjetbrains · youtrack · CWE-862 Erişim denetimi (IDOR)	Yüksek7,2	—	%0,4	1 Eki 2026
32İzleyin	CVE-2026-103493İstismar yok	In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possiblejetbrains · youtrack · CWE-79 Kimlik doğrulamasız XSS	Yüksek8,1	—	%0,2	1 Eki 2026
22İzleyin	CVE-2026-103497İstismar yok	In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integrationjetbrains · youtrack · CWE-918 SSRF	Orta5,5	—	%0,1	1 Eki 2026
29İzleyin	CVE-2026-64946İstismar yok	CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Managerpandora fms · pandora fms · CWE-79 Kimlik doğrulamasız XSS CSRF	Yüksek7,4	—	%0,1	1 Eki 2026
30İzleyin	CVE-2026-64947İstismar yok	CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Managerpandora fms · pandora fms · CWE-352 Girişsiz RCE Dosya yükleme CSRF	Yüksek7,5	—	%0,2	1 Eki 2026
28İzleyin	CVE-2026-64948İstismar yok	Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Disclosurepandora fms · pandora fms · CWE-639 Erişim denetimi (IDOR)	Yüksek7,1	—	%0,2	1 Eki 2026
34İzleyin	CVE-2026-64949İstismar yok	Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Managerpandora fms · pandora fms · CWE-434 RCE Dosya yükleme	Yüksek8,6	—	%0,3	1 Eki 2026
33İzleyin	CVE-2026-64950İstismar yok	Stored Cross-Site Scripting via Directory Name in File Manager Create Directorypandora fms · pandora fms · CWE-79 XSS	Yüksek8,4	—	%0,2	1 Eki 2026
28İzleyin	CVE-2026-75786İstismar yok	SQL Injection in Grafana Integration Endpoint (query.php)pandora fms · pandora fms · CWE-89 SQL enjeksiyonu	Yüksek7,2	—	%0,2	1 Eki 2026
28İzleyin	CVE-2026-92144İstismar yok	Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameterwpmudev · forminator forms – contact form, payment form & custom form builder · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,2	—	%0,5	1 Eki 2026
28İzleyin	CVE-2026-96577İstismar yok	Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without authentication, with delete enabledred hat · assisted installer for red hat openshift container platform 2 · CWE-306 Kimlik doğrulamasız Kimlik doğrulama atlatma	Yüksek7,1	—	%0,2	1 Eki 2026
28İzleyin	CVE-2026-103082İstismar yok	WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerabilityla-studio · la-studio element kit for elementor · CWE-918 Kimlik doğrulamasız SSRF	Yüksek7,2	—	%0,1	1 Eki 2026
37İzleyin	CVE-2026-103244İstismar yok	ground-station before 0.8.0 Authentication Bypass via setup.restoresgoudelis · ground-station · CWE-306 Girişsiz RCE Kimlik doğrulama atlatma	Kritik9,3	—	%0,5	1 Eki 2026
33İzleyin	CVE-2026-103246İstismar yok	n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspectionn8n-io · n8n · CWE-639 Erişim denetimi (IDOR)	Yüksek8,3	—	%0,2	1 Eki 2026
28İzleyin	CVE-2026-103248İstismar yok	n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabasen8n-io · n8n · CWE-89 Kimlik doğrulamasız SQL enjeksiyonu	Yüksek7,1	—	%0,3	1 Eki 2026
28İzleyin	CVE-2026-103250İstismar yok	n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memoryn8n-io · n8n · CWE-943 Kimlik doğrulamasız SQL enjeksiyonu	Yüksek7,0	—	%0,2	1 Eki 2026
30İzleyin	CVE-2026-103251İstismar yok	n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSubn8n-io · n8n · CWE-862 Kimlik doğrulama atlatma Erişim denetimi (IDOR)	Yüksek7,5	—	%0,2	1 Eki 2026
28İzleyin	CVE-2026-103252İstismar yok	n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpointn8n-io · n8n · CWE-639 Erişim denetimi (IDOR)	Yüksek7,1	—	%0,2	1 Eki 2026
28İzleyin	CVE-2026-103253İstismar yok	n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop Tablen8n-io · n8n · CWE-89 Kimlik doğrulamasız SQL enjeksiyonu	Yüksek7,0	—	%0,2	1 Eki 2026
28İzleyin	CVE-2026-103254İstismar yok	n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generationn8n-io · n8n · CWE-22 Yol geçişi	Yüksek7,0	—	%0,2	1 Eki 2026
28İzleyin	CVE-2026-103255İstismar yok	n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabasen8n-io · n8n · CWE-73 Kimlik doğrulamasız Yol geçişi	Yüksek7,1	—	%0,2	1 Eki 2026
28İzleyin	CVE-2026-103256İstismar yok	n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hookn8n-io · n8n · CWE-522 Bilgi sızıntısı	Yüksek7,1	—	%0,2	1 Eki 2026
32İzleyin	CVE-2026-103257İstismar yok	n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Noden8n-io · n8n · CWE-22 Kimlik doğrulamasız Yol geçişi	Yüksek8,1	—	%0,4	1 Eki 2026
34İzleyin	CVE-2026-103259İstismar yok	n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentialsn8n-io · n8n · CWE-863 Erişim denetimi (IDOR)	Yüksek8,5	—	%0,2	1 Eki 2026
34İzleyin	CVE-2026-103262İstismar yok	Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClienttornadoweb · tornado · CWE-409 Kimlik doğrulamasız	Yüksek8,7	—	%0,5	1 Eki 2026
32İzleyin	CVE-2026-103263İstismar yok	Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlinktornadoweb · tornado · CWE-59 Kimlik doğrulamasız Yol geçişi	Yüksek8,2	—	%0,5	1 Eki 2026
37İzleyin	CVE-2026-103264İstismar yok	Fleet before 4.87.0 Authentication Bypass via Device Identifiersfleetdm · fleet · CWE-287 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,3	—	%0,3	1 Eki 2026
28İzleyin	CVE-2026-103266İstismar yok	Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modificationtryghost · ghost · CWE-863 Kimlik doğrulamasız Kimlik doğrulama atlatma Erişim denetimi (IDOR)	Yüksek7,1	—	%0,2	1 Eki 2026
34İzleyin	CVE-2026-103268İstismar yok	Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Resettryghost · ghost · CWE-862 Kimlik doğrulama atlatma Erişim denetimi (IDOR)	Yüksek8,7	—	%0,3	1 Eki 2026
34İzleyin	CVE-2026-103271İstismar yok	Ghost 4.0.0 before 6.63.0 Restricted Content Bypasstryghost · ghost · CWE-863 Kimlik doğrulamasız Kimlik doğrulama atlatma Erişim denetimi (IDOR)	Yüksek8,7	—	%0,3	1 Eki 2026
34İzleyin	CVE-2026-103272İstismar yok	Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content APItryghost · ghost · CWE-203 Kimlik doğrulamasız Kimlik doğrulama atlatma	Yüksek8,7	—	%0,3	1 Eki 2026
34İzleyin	CVE-2026-103277İstismar yok	Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbedtryghost · ghost · CWE-79 Kimlik doğrulamasız XSS	Yüksek8,6	—	%0,2	1 Eki 2026
34İzleyin	CVE-2026-103278İstismar yok	Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframetryghost · ghost · CWE-23 Yol geçişi	Yüksek8,5	—	%0,2	1 Eki 2026
30İzleyin	CVE-2026-103279İstismar yok	Ghost 3.10.0 before 6.34.0 Session Invalidation Bypasstryghost · ghost · CWE-613	Yüksek7,6	—	%0,1	1 Eki 2026
34İzleyin	CVE-2026-103283İstismar yok	Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handlingtryghost · ghost · CWE-613 Kimlik doğrulama atlatma	Yüksek8,6	—	%0,2	1 Eki 2026
34İzleyin	CVE-2026-103286İstismar yok	Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notificationstryghost · ghost · CWE-266	Yüksek8,5	—	%0,1	1 Eki 2026
28İzleyin	CVE-2026-103288İstismar yok	Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Liketryghost · ghost · CWE-639 Erişim denetimi (IDOR)	Yüksek7,1	—	%0,2	1 Eki 2026
28İzleyin	CVE-2026-103289İstismar yok	Ghost 5.9.0 before 6.44.1 Authorization Bypass via Commentstryghost · ghost · CWE-943 SQL enjeksiyonu	Yüksek7,1	—	%0,2	1 Eki 2026
20İzleyin	CVE-2026-103290İstismar yok	Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSizetryghost · ghost · CWE-35 Yol geçişi	Orta5,1	—	%0,2	1 Eki 2026
34İzleyin	CVE-2026-103292İstismar yok	Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_headtryghost · ghost · CWE-79 XSS	Yüksek8,6	—	%0,2	1 Eki 2026
33İzleyin	CVE-2026-103757İstismar yok	Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generationbudibase · budibase · CWE-918 SSRF	Yüksek8,3	—	%0,2	1 Eki 2026
34İzleyin	CVE-2026-103758İstismar yok	Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-connect-composite/ Routeobot-platform · obot · CWE-863 Erişim denetimi (IDOR)	Yüksek8,6	—	%0,2	1 Eki 2026
34İzleyin	CVE-2026-88789Kavram kanıtı	Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardeningapache software foundation · apache camel quarkus · CWE-611 Kimlik doğrulamasız XXE	Yüksek8,6	—	%0,5	1 Eki 2026
32İzleyin	CVE-2026-103678İstismar yok	Tnef: heap out-of-bounds read in get_rtf_data_from_buf() via uncompressed rtf mapi valuetnef project · tnef · CWE-125 Kimlik doğrulamasız Bellek hatası	Yüksek8,1	—	%0,2	1 Eki 2026
32İzleyin	CVE-2026-94250İstismar yok	Apache APISIX: Batch response aggregation can exhaust worker memoryapache software foundation · apache apisix · CWE-770 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek8,2	—	%0,3	1 Eki 2026
34İzleyin	CVE-2026-102379İstismar yok	WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - SQL Injection vulnerabilityvillatheme · buildkit – product builder for woocommerce – custom pc builder · CWE-89 SQL enjeksiyonu	Yüksek8,5	—	%0,2	1 Eki 2026
26İzleyin	CVE-2026-103063İstismar yok	WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerabilitywpmet · elementskit elementor addons lite · CWE-79 XSS	Orta6,5	—	%0,1	1 Eki 2026
32İzleyin	CVE-2026-103067İstismar yok	WordPress Memberful - Membership Plugin plugin <= 1.81.0 - Cross Site Request Forgery (CSRF) vulnerabilitymemberful · memberful - membership plugin · CWE-352 CSRF	Yüksek8,0	—	%0,1	1 Eki 2026
34İzleyin	CVE-2026-103338İstismar yok	WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerabilityunlimited elements · unlimited elements for elementor (free widgets, addons, templates) · CWE-89 SQL enjeksiyonu	Yüksek8,5	—	%0,2	1 Eki 2026
30İzleyin	CVE-2026-62059Kavram kanıtı	WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerabilityultimate member · ultimate member · CWE-89 SQL enjeksiyonu	Yüksek7,6	—	%0,2	1 Eki 2026
30İzleyin	CVE-2026-62060İstismar yok	WordPress Captivate Sync plugin <= 3.3.2 - SQL Injection vulnerabilitycaptivateaudio · captivate sync · CWE-89 SQL enjeksiyonu	Yüksek7,6	—	%0,2	1 Eki 2026
30İzleyin	CVE-2026-102504İstismar yok	Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wioltonycoz · imager · CWE-190 Kimlik doğrulamasız Bellek hatası Hizmet dışı bırakma	Yüksek7,5	—	%0,3	1 Eki 2026
35İzleyin	CVE-2026-66246İstismar yok	HCL iControl is affected by multiple security vulnerabilitieshcl software · icontrol · CWE-250 Kimlik doğrulama atlatma Erişim denetimi (IDOR)	Yüksek8,8	—	%0,3	1 Eki 2026

CVE-2026-103532
27İzleyin
immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization
OrtaCVSS 6,9İstismar yokEPSS %0
- Kimlik doğrulamasız
immich-app · immich1 Eki 2026
CVE-2026-13313
35İzleyin
An Active Debug Code vulnerability in certain ASUS router models allows a remote authenticated user, via a crafted HTTP request, to bypass s
YüksekCVSS 8,9İstismar yokEPSS %0
asus · router1 Eki 2026
CVE-2026-14157
37İzleyin
Use of an Externally Controlled Format String in the ASUS Router modules allow a remote authenticated user to execute arbitrary commands via
KritikCVSS 9,4İstismar yokEPSS %0
- RCE
asus · router1 Eki 2026
CVE-2026-93495
28İzleyin
Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a
YüksekCVSS 7,0İstismar yokEPSS %0
asus · motherboard(prime z390-a )1 Eki 2026
CVE-2026-92245
30İzleyin
Simply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recu
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
croixhaug · simply schedule appointments1 Eki 2026
CVE-2026-96561
28İzleyin
AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection
YüksekCVSS 7,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
tigroumeow · ai engine – the chatbot, ai framework & mcp for wordpress1 Eki 2026
CVE-2026-76142
37İzleyin
Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
genians, inc · genian nac 5.0.75 lts release1 Eki 2026
CVE-2026-76143
29İzleyin
Genians, Inc Genian SSL PNS Multi Factor Authentication Bypass
YüksekCVSS 7,3İstismar yokEPSS %0
- Kimlik doğrulama atlatma
- Erişim denetimi (IDOR)
genians, inc · genian ssl pns (frodo-core)1 Eki 2026
CVE-2026-76145
30İzleyin
Genians, Inc Genian SSL PNS Improper Privilege Management
YüksekCVSS 7,5İstismar yokEPSS %0
genians, inc · genian ssl pns (frodo-core)1 Eki 2026
CVE-2026-76146
34İzleyin
Genians, Inc Genian SSL PNS OS Command Injection
YüksekCVSS 8,4İstismar yokEPSS %1
- Girişsiz RCE
- Komut enjeksiyonu
genians, inc · genian ssl pns (xenics_auther)1 Eki 2026
CVE-2026-78210
28İzleyin
In affected versions of Octopus Server, users with certain scoped permission sets could execute arbitrary scripts in an environment without
YüksekCVSS 7,1İstismar yokEPSS %0
- RCE
- Erişim denetimi (IDOR)
octopus deploy · octopus server1 Eki 2026
CVE-2026-82824
37İzleyin
Path traversal may allow arbitrary files to be viewed, created, modified, or deleted
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Yol geçişi
hitachi industrial equipment systems · hitachi coding software suite1 Eki 2026
CVE-2026-82825
37İzleyin
Missing proper authentication for critical APIs may allow sensitive information to be obtained or modified, or unauthorized operations to be performed
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
hitachi industrial equipment systems · hitachi coding software suite1 Eki 2026
CVE-2026-82826
34İzleyin
Authentication information or sensitive data may be intercepted in transit
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Zayıf kripto
hitachi industrial equipment systems · hitachi coding software suite1 Eki 2026
CVE-2026-82827
37İzleyin
A hard-coded JWT signing secret key may allow administrative functions to be abused using fraudulently generated Bearer tokens
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Gömülü kimlik bilgisi
hitachi industrial equipment systems · hitachi coding software suite1 Eki 2026
CVE-2026-82828
34İzleyin
Improper authorization may allow a general user to perform operations equivalent to those available with administrator privileges
YüksekCVSS 8,7İstismar yokEPSS %0
- Erişim denetimi (IDOR)
hitachi industrial equipment systems · hitachi coding software suite1 Eki 2026
CVE-2026-82829
37İzleyin
Hidden accounts or hard-coded credentials may permit unauthorized access without the legitimate authentication process
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Gömülü kimlik bilgisi
hitachi industrial equipment systems · hitachi coding software suite1 Eki 2026
CVE-2026-92966
36İzleyin
Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field
KritikCVSS 9,1Kavram kanıtıEPSS %0
- Girişsiz RCE
latepoint · appointment booking plugin – latepoint | calendar & scheduling for wordpress1 Eki 2026
CVE-2026-101147
35İzleyin
Featured Image from URL (FIFU) Free & Premium - Administrator Account Creation via CSRF
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- CSRF
unknown · featured image from url (fifu)1 Eki 2026
CVE-2026-101148
40Planlayın
BackupSheep <= 1.8 - Unauthenticated Arbitrary File Deletion and Backup Exfiltration via Empty Integration Key
KritikCVSS 10,0İstismar yokEPSS %0
- Kimlik doğrulamasız
- Yol geçişi
unknown · backupsheep wordpress backup plugin1 Eki 2026
CVE-2026-19253
34İzleyin
Cache Enabler < 1.8.17 - Unauthenticated Arbitrary File and Directory Deletion via cache_enabler_clear_page_cache_by_url
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Yol geçişi
unknown · cache enabler1 Eki 2026
CVE-2026-80275
35İzleyin
Comelit 1456B gateway allows low priviledge user to overwrite installer password via unauthorized endpoint
YüksekCVSS 8,8İstismar yokEPSS %0
comelit group s.p.a. · 1456b multi-user gateway1 Eki 2026
CVE-2026-80276
30İzleyin
Comelit 1456B gateway exposes remote configuration password via unauthenticated management interface
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
comelit group s.p.a. · 1456b multi-user gateway1 Eki 2026
CVE-2026-81739
30İzleyin
Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
unknown · paytm payment gateway1 Eki 2026
CVE-2026-81809
30İzleyin
Paytm Payment Gateway < 2.8.9 - Unauthenticated SQLi via Payment Callback
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- SQL enjeksiyonu
unknown · paytm payment gateway1 Eki 2026
CVE-2026-85679
28İzleyin
Extendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key
YüksekCVSS 7,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
extendify · extendify1 Eki 2026
CVE-2026-89296
34İzleyin
Pro Like Button < 2.0 - Unauthenticated SQLi via 'postid' Parameter
YüksekCVSS 8,6İstismar yokEPSS %0
- Kimlik doğrulamasız
- SQL enjeksiyonu
unknown · pro like button1 Eki 2026
CVE-2026-92412
28İzleyin
Five Star Restaurant Reviews < 2.3.14 - Reflected XSS
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
unknown · five star restaurant reviews1 Eki 2026
CVE-2026-96255
30İzleyin
Payments for Hubtel < 1.0.2 - Unauthenticated Payment Gateway Credentials Disclosure via Debug Log
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bilgi sızıntısı
unknown · payments for hubtel1 Eki 2026
CVE-2025-41753
37İzleyin
Path traversal in dynamically created BACnet File Objects
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Yol geçişi
wago · 0751-9x011 Eki 2026
CVE-2026-103651
30İzleyin
MISP HOTP Token Replay via Stale Session-Cached Counter Allows Second-Factor Authentication Bypass
YüksekCVSS 7,6İstismar yokEPSS %0
- Kimlik doğrulama atlatma
misp · misp1 Eki 2026
CVE-2026-15989
39İzleyin
Super Forms <= 6.3.316 - Unauthenticated Privilege Escalation via 'role' Parameter
KritikCVSS 9,8Kavram kanıtıEPSS %0
- Kimlik doğrulamasız
webrehab · super forms – drag & drop form builder1 Eki 2026
CVE-2026-19807
35İzleyin
ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool
YüksekCVSS 8,8İstismar yokEPSS %0
bytecorestack · bytecorestack – mcp connector for ai tools1 Eki 2026
CVE-2026-75957
39İzleyin
Ultimate Multisite <= 2.15.0 - Unauthenticated Authentication Bypass via 'checkout_form' Parameter
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
superdav42 · ultimate multisite – wordpress multisite saas & waas platform1 Eki 2026
CVE-2026-93882
30İzleyin
LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
thimpress · learnpress – wordpress lms plugin for create and sell online courses1 Eki 2026
CVE-2026-103431
30İzleyin
Collectl: collectl: colmux does not sanitize ansi/vt100 terminal escape sequences in data received from remote collectl instances
YüksekCVSS 7,7İstismar yokEPSS %0
1 Eki 2026
CVE-2026-103655
37İzleyin
MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
misp · misp1 Eki 2026
CVE-2026-103659
28İzleyin
MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes
YüksekCVSS 7,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
misp · misp1 Eki 2026
CVE-2026-14995
28İzleyin
Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path
YüksekCVSS 7,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
optimizingmatters · autoptimize1 Eki 2026
CVE-2026-15983
32İzleyin
Super Forms <= 6.3.316 - Authenticated (Subscriber+) Arbitrary File/Directory Deletion via 'subdir' / 'path' Parameter
YüksekCVSS 8,1İstismar yokEPSS %0
- Yol geçişi
webrehab · super forms – drag & drop form builder1 Eki 2026
CVE-2026-85235
28İzleyin
Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
YüksekCVSS 7,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
wpmudev · forminator forms – contact form, payment form & custom form builder1 Eki 2026
CVE-2026-92244
28İzleyin
PDF Invoices & Packing Slips for WooCommerce <= 5.16.1 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields
YüksekCVSS 7,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
wpovernight · pdf invoices & packing slips for woocommerce1 Eki 2026
CVE-2026-95687
35İzleyin
WPC Shop as a Customer for WooCommerce <= 2.0.0 - Authenticated (Subscriber+) Privilege Escalation via Missing Role Check on Target User to wpcsa_login AJAX End
YüksekCVSS 8,8İstismar yokEPSS %0
wpclever · wpc shop as a customer for woocommerce1 Eki 2026
CVE-2026-96573
28İzleyin
Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Rendere
YüksekCVSS 7,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
codepeople · appointment hour booking – booking calendar1 Eki 2026
CVE-2026-96813
28İzleyin
Form Maker by 10Web <= 1.15.47 - Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields
YüksekCVSS 7,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
10web · form maker by 10web – mobile-friendly drag & drop contact form builder1 Eki 2026
CVE-2026-97661
28İzleyin
Business Essentials for Contact Form 7 <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting via 'gateway' Form Field
YüksekCVSS 7,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
scottpaterson · business essentials for contact form 71 Eki 2026
CVE-2026-103488
28İzleyin
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access re
YüksekCVSS 7,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
jetbrains · youtrack1 Eki 2026
CVE-2026-103490
28İzleyin
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links
YüksekCVSS 7,2İstismar yokEPSS %0
- Erişim denetimi (IDOR)
jetbrains · youtrack1 Eki 2026
CVE-2026-103493
32İzleyin
In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible
YüksekCVSS 8,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
jetbrains · youtrack1 Eki 2026
CVE-2026-103497
22İzleyin
In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration
OrtaCVSS 5,5İstismar yokEPSS %0
- SSRF
jetbrains · youtrack1 Eki 2026
CVE-2026-64946
29İzleyin
CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager
YüksekCVSS 7,4İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
- CSRF
pandora fms · pandora fms1 Eki 2026
CVE-2026-64947
30İzleyin
CSRF Bypass Leading to Remote Code Execution via Unrestricted File Upload in Plugin File Manager
YüksekCVSS 7,5İstismar yokEPSS %0
- Girişsiz RCE
- Dosya yükleme
- CSRF
pandora fms · pandora fms1 Eki 2026
CVE-2026-64948
28İzleyin
Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Disclosure
YüksekCVSS 7,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
pandora fms · pandora fms1 Eki 2026
CVE-2026-64949
34İzleyin
Unrestricted File Upload Leading to Remote Code Execution in Admin Tools File Manager
YüksekCVSS 8,6İstismar yokEPSS %0
- RCE
- Dosya yükleme
pandora fms · pandora fms1 Eki 2026
CVE-2026-64950
33İzleyin
Stored Cross-Site Scripting via Directory Name in File Manager Create Directory
YüksekCVSS 8,4İstismar yokEPSS %0
- XSS
pandora fms · pandora fms1 Eki 2026
CVE-2026-75786
28İzleyin
SQL Injection in Grafana Integration Endpoint (query.php)
YüksekCVSS 7,2İstismar yokEPSS %0
- SQL enjeksiyonu
pandora fms · pandora fms1 Eki 2026
CVE-2026-92144
28İzleyin
Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter
YüksekCVSS 7,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
wpmudev · forminator forms – contact form, payment form & custom form builder1 Eki 2026
CVE-2026-96577
28İzleyin
Oc-mirror__release-4.21: embedded local cache registry listens on all interfaces without authentication, with delete enabled
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
red hat · assisted installer for red hat openshift container platform 21 Eki 2026
CVE-2026-103082
28İzleyin
WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerability
YüksekCVSS 7,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- SSRF
la-studio · la-studio element kit for elementor1 Eki 2026
CVE-2026-103244
37İzleyin
ground-station before 0.8.0 Authentication Bypass via setup.restore
KritikCVSS 9,3İstismar yokEPSS %0
- Girişsiz RCE
- Kimlik doğrulama atlatma
sgoudelis · ground-station1 Eki 2026
CVE-2026-103246
33İzleyin
n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection
YüksekCVSS 8,3İstismar yokEPSS %0
- Erişim denetimi (IDOR)
n8n-io · n8n1 Eki 2026
CVE-2026-103248
28İzleyin
n8n before 1.123.80, 2.39.6, and 2.40.1 PostgREST Filter Injection via Supabase
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- SQL enjeksiyonu
n8n-io · n8n1 Eki 2026
CVE-2026-103250
28İzleyin
n8n before 1.123.80, 2.39.6, and 2.40.1 NoSQL Injection via MongoDB Chat Memory
YüksekCVSS 7,0İstismar yokEPSS %0
- Kimlik doğrulamasız
- SQL enjeksiyonu
n8n-io · n8n1 Eki 2026
CVE-2026-103251
30İzleyin
n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulama atlatma
- Erişim denetimi (IDOR)
n8n-io · n8n1 Eki 2026
CVE-2026-103252
28İzleyin
n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint
YüksekCVSS 7,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
n8n-io · n8n1 Eki 2026
CVE-2026-103253
28İzleyin
n8n before 1.123.80, 2.39.6, and 2.40.1 SQL Injection via Oracle Database Drop Table
YüksekCVSS 7,0İstismar yokEPSS %0
- Kimlik doğrulamasız
- SQL enjeksiyonu
n8n-io · n8n1 Eki 2026
CVE-2026-103254
28İzleyin
n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via Resume URL Generation
YüksekCVSS 7,0İstismar yokEPSS %0
- Yol geçişi
n8n-io · n8n1 Eki 2026
CVE-2026-103255
28İzleyin
n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal and Query Injection via Supabase
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- Yol geçişi
n8n-io · n8n1 Eki 2026
CVE-2026-103256
28İzleyin
n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook
YüksekCVSS 7,1İstismar yokEPSS %0
- Bilgi sızıntısı
n8n-io · n8n1 Eki 2026
CVE-2026-103257
32İzleyin
n8n before 1.123.80, 2.39.6, and 2.40.1 Path Traversal via n8n Node
YüksekCVSS 8,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- Yol geçişi
n8n-io · n8n1 Eki 2026
CVE-2026-103259
34İzleyin
n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials
YüksekCVSS 8,5İstismar yokEPSS %0
- Erişim denetimi (IDOR)
n8n-io · n8n1 Eki 2026
CVE-2026-103262
34İzleyin
Tornado before 6.5.9 Denial of Service via CurlAsyncHTTPClient
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
tornadoweb · tornado1 Eki 2026
CVE-2026-103263
32İzleyin
Tornado before 6.5.9 StaticFileHandler Path Traversal via Symlink
YüksekCVSS 8,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- Yol geçişi
tornadoweb · tornado1 Eki 2026
CVE-2026-103264
37İzleyin
Fleet before 4.87.0 Authentication Bypass via Device Identifiers
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
fleetdm · fleet1 Eki 2026
CVE-2026-103266
28İzleyin
Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification
YüksekCVSS 7,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
- Erişim denetimi (IDOR)
tryghost · ghost1 Eki 2026
CVE-2026-103268
34İzleyin
Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulama atlatma
- Erişim denetimi (IDOR)
tryghost · ghost1 Eki 2026
CVE-2026-103271
34İzleyin
Ghost 4.0.0 before 6.63.0 Restricted Content Bypass
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
- Erişim denetimi (IDOR)
tryghost · ghost1 Eki 2026
CVE-2026-103272
34İzleyin
Ghost 2.10.0 before 6.63.0 Staff Enumeration via Content API
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
tryghost · ghost1 Eki 2026
CVE-2026-103277
34İzleyin
Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed
YüksekCVSS 8,6İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
tryghost · ghost1 Eki 2026
CVE-2026-103278
34İzleyin
Ghost 5.8.0 before 6.34.0 Staff Account Takeover via Admin iframe
YüksekCVSS 8,5İstismar yokEPSS %0
- Yol geçişi
tryghost · ghost1 Eki 2026
CVE-2026-103279
30İzleyin
Ghost 3.10.0 before 6.34.0 Session Invalidation Bypass
YüksekCVSS 7,6İstismar yokEPSS %0
tryghost · ghost1 Eki 2026
CVE-2026-103283
34İzleyin
Ghost 6.20.0 before 6.57.1 Authentication Bypass via Session Handling
YüksekCVSS 8,6İstismar yokEPSS %0
- Kimlik doğrulama atlatma
tryghost · ghost1 Eki 2026
CVE-2026-103286
34İzleyin
Ghost 2.21.0 before 6.56.0 Privilege Escalation via Notifications
YüksekCVSS 8,5İstismar yokEPSS %0
tryghost · ghost1 Eki 2026
CVE-2026-103288
28İzleyin
Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like
YüksekCVSS 7,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
tryghost · ghost1 Eki 2026
CVE-2026-103289
28İzleyin
Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comments
YüksekCVSS 7,1İstismar yokEPSS %0
- SQL enjeksiyonu
tryghost · ghost1 Eki 2026
CVE-2026-103290
20İzleyin
Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize
OrtaCVSS 5,1İstismar yokEPSS %0
- Yol geçişi
tryghost · ghost1 Eki 2026
CVE-2026-103292
34İzleyin
Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head
YüksekCVSS 8,6İstismar yokEPSS %0
- XSS
tryghost · ghost1 Eki 2026
CVE-2026-103757
33İzleyin
Budibase before 3.41.0 SSRF via uploadUrl in AI Table Generation
YüksekCVSS 8,3İstismar yokEPSS %0
- SSRF
budibase · budibase1 Eki 2026
CVE-2026-103758
34İzleyin
Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-connect-composite/ Route
YüksekCVSS 8,6İstismar yokEPSS %0
- Erişim denetimi (IDOR)
obot-platform · obot1 Eki 2026
CVE-2026-88789
34İzleyin
Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening
YüksekCVSS 8,6Kavram kanıtıEPSS %0
- Kimlik doğrulamasız
- XXE
apache software foundation · apache camel quarkus1 Eki 2026
CVE-2026-103678
32İzleyin
Tnef: heap out-of-bounds read in get_rtf_data_from_buf() via uncompressed rtf mapi value
YüksekCVSS 8,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
tnef project · tnef1 Eki 2026
CVE-2026-94250
32İzleyin
Apache APISIX: Batch response aggregation can exhaust worker memory
YüksekCVSS 8,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
apache software foundation · apache apisix1 Eki 2026
CVE-2026-102379
34İzleyin
WordPress BuildKit – Product Builder for WooCommerce – Custom PC Builder plugin <= 1.0.28 - SQL Injection vulnerability
YüksekCVSS 8,5İstismar yokEPSS %0
- SQL enjeksiyonu
villatheme · buildkit – product builder for woocommerce – custom pc builder1 Eki 2026
CVE-2026-103063
26İzleyin
WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability
OrtaCVSS 6,5İstismar yokEPSS %0
- XSS
wpmet · elementskit elementor addons lite1 Eki 2026
CVE-2026-103067
32İzleyin
WordPress Memberful - Membership Plugin plugin <= 1.81.0 - Cross Site Request Forgery (CSRF) vulnerability
YüksekCVSS 8,0İstismar yokEPSS %0
- CSRF
memberful · memberful - membership plugin1 Eki 2026
CVE-2026-103338
34İzleyin
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability
YüksekCVSS 8,5İstismar yokEPSS %0
- SQL enjeksiyonu
unlimited elements · unlimited elements for elementor (free widgets, addons, templates)1 Eki 2026
CVE-2026-62059
30İzleyin
WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability
YüksekCVSS 7,6Kavram kanıtıEPSS %0
- SQL enjeksiyonu
ultimate member · ultimate member1 Eki 2026
CVE-2026-62060
30İzleyin
WordPress Captivate Sync plugin <= 3.3.2 - SQL Injection vulnerability
YüksekCVSS 7,6İstismar yokEPSS %0
- SQL enjeksiyonu
captivateaudio · captivate sync1 Eki 2026
CVE-2026-102504
30İzleyin
Imager versions before 1.037 for Perl exit the process reading a raw image with an out-of-range raw_datachannels value in i_readraw_wiol
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
- Hizmet dışı bırakma
tonycoz · imager1 Eki 2026
CVE-2026-66246
35İzleyin
HCL iControl is affected by multiple security vulnerabilities
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulama atlatma
- Erişim denetimi (IDOR)
hcl software · icontrol1 Eki 2026