Yayın tarihine göre
Ekim 2026: sömürülen ve yeni ciddi CVE kayıtları
6.943 kayıt · 14 KEV. Yayın sırasıyla.
Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.
Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.
Sayfa 18 / 70
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
34İzleyin | CVE-2026-95610İstismar yok | WordPress UpSolution Core plugin <= 9.3 - SQL Injection vulnerabilityupsolution · upsolution core · CWE-89 | Yüksek8,5 | — | %0,2 | 9 Eki 2026 |
37İzleyin | CVE-2026-96327İstismar yok | WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerabilityvibethemes · wplms · CWE-89 | Kritik9,3 | — | %0,2 | 9 Eki 2026 |
37İzleyin | CVE-2026-96328İstismar yok | WordPress JNews - Pay Writer plugin <= 12.0.1 - SQL Injection vulnerabilityjegtheme · jnews - pay writer · CWE-89 | Kritik9,3 | — | %0,2 | 9 Eki 2026 |
34İzleyin | CVE-2026-96329İstismar yok | WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerabilitytagdiv · tagdiv opt-in builder · CWE-89 | Yüksek8,5 | — | %0,2 | 9 Eki 2026 |
37İzleyin | CVE-2026-96330İstismar yok | WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerabilitytagdiv · tagdiv opt-in builder · CWE-89 | Kritik9,3 | — | %0,2 | 9 Eki 2026 |
37İzleyin | CVE-2026-96331İstismar yok | WordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerabilitywpdreams · ajax search pro · CWE-89 | Kritik9,3 | — | %0,2 | 9 Eki 2026 |
28İzleyin | CVE-2026-96332İstismar yok | WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerabilityyalla ya! · simple payment · CWE-79 | Yüksek7,1 | — | %0,1 | 9 Eki 2026 |
30İzleyin | CVE-2026-96333İstismar yok | WordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerabilityliquid web / stellarwp · givewp · CWE-290 | Yüksek7,5 | — | %0,2 | 9 Eki 2026 |
30İzleyin | CVE-2026-96336İstismar yok | WordPress Forminator plugin <= 1.57.2 - Payment Bypass vulnerabilitywpmu dev · forminator · CWE-290 | Yüksek7,5 | — | %0,2 | 9 Eki 2026 |
30İzleyin | CVE-2026-96461İstismar yok | WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerabilitytms · amelia · CWE-862 | Yüksek7,5 | — | %0,1 | 9 Eki 2026 |
28İzleyin | CVE-2026-96553İstismar yok | WordPress FiboSearch plugin <= 1.34.1 - Cross Site Scripting (XSS) vulnerabilitydamian góra · fibosearch · CWE-79 | Yüksek7,1 | — | %0,1 | 9 Eki 2026 |
28İzleyin | CVE-2026-96607İstismar yok | WordPress NEX-Forms plugin <= 9.3.1 - Cross Site Scripting (XSS) vulnerabilitybasix · nex-forms · CWE-79 | Yüksek7,1 | — | %0,1 | 9 Eki 2026 |
35İzleyin | CVE-2026-96671İstismar yok | WordPress Featured Image from URL plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerabilityfifu.app · featured image from url · CWE-352 | Yüksek8,8 | — | %0,1 | 9 Eki 2026 |
28İzleyin | CVE-2026-96761İstismar yok | WordPress Welcart e-Commerce plugin <= 2.12.3 - Cross Site Scripting (XSS) vulnerabilitywelcart · welcart e-commerce · CWE-79 | Yüksek7,1 | — | %0,1 | 9 Eki 2026 |
37İzleyin | CVE-2026-96809İstismar yok | WordPress EduAdmin Booking plugin < 6.0.0 - SQL Injection vulnerabilitymultinet interactive ab · eduadmin booking · CWE-89 | Kritik9,3 | — | %0,2 | 9 Eki 2026 |
30İzleyin | CVE-2026-100227İstismar yok | Apache CXF: XML Signature wrapping in JAX-RS XML Securityapache · cxf · CWE-362 | Yüksek7,5 | — | %0,3 | 9 Eki 2026 |
30İzleyin | CVE-2026-107937İstismar yok | Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.apache · cxf · CWE-770 | Yüksek7,5 | — | %0,5 | 9 Eki 2026 |
36İzleyin | CVE-2026-107938İstismar yok | Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.apache · cxf · CWE-297 | Kritik9,1 | — | %0,1 | 9 Eki 2026 |
30İzleyin | CVE-2026-108039İstismar yok | Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limitsapache · cxf · CWE-776 | Yüksek7,5 | — | %0,4 | 9 Eki 2026 |
36İzleyin | CVE-2026-71575İstismar yok | Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilterapache · cxf · CWE-613 | Kritik9,1 | — | %0,3 | 9 Eki 2026 |
32İzleyin | CVE-2026-73179İstismar yok | Apache CXF: JPA authorization-code consume is non-atomicapache · cxf · CWE-367 | Yüksek8,1 | — | %0,4 | 9 Eki 2026 |
30İzleyin | CVE-2026-78384İstismar yok | Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)apache · cxf · CWE-409 | Yüksek7,5 | — | %0,3 | 9 Eki 2026 |
30İzleyin | CVE-2026-86463İstismar yok | Apache CXF: FIQL Query Parser Denial of Serviceapache · cxf · CWE-400 | Yüksek7,5 | — | %0,4 | 9 Eki 2026 |
36İzleyin | CVE-2026-97468İstismar yok | Apache CXF: Authentication bypass via weak cache keys for validated STS tokensapache · cxf · CWE-328 | Kritik9,1 | — | %0,2 | 9 Eki 2026 |
30İzleyin | CVE-2026-97791İstismar yok | Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requestsapache · cxf · CWE-362 | Yüksek7,5 | — | %0,3 | 9 Eki 2026 |
36İzleyin | GHSA-fwjg-cm92-j3hjİstismar yok | Pre-shared key mode transmits the TGK in cleartext, exposing the SRTP master key | Kritik9,1 | — | — | 9 Eki 2026 |
29İzleyin | GHSA-vv5m-jxxh-4627İstismar yok | Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation | Yüksek7,3 | — | — | 9 Eki 2026 |
30İzleyin | GHSA-xq78-wvcv-hqvjİstismar yok | MIKEY message MAC is never verified on receive, so forged messages are accepted | Yüksek7,5 | — | — | 9 Eki 2026 |
30İzleyin | GHSA-xr22-8pqp-gwfhİstismar yok | Poly1305 panics or computes a wrong tag on attacker-chosen messages of 64 bytes or more | Yüksek7,5 | — | — | 9 Eki 2026 |
35İzleyin | CVE-2026-103412İstismar yok | Apache Camel Karavan: project file name path traversal when committing a project to Gitapache software foundation · apache camel karavan · CWE-22 | Yüksek8,8 | — | %0,5 | 9 Eki 2026 |
35İzleyin | CVE-2026-103413İstismar yok | Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yamlapache software foundation · apache camel karavan · CWE-20 | Yüksek8,8 | — | %0,3 | 9 Eki 2026 |
35İzleyin | CVE-2026-104392İstismar yok | WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerabilityexpresstech · quiz and survey master · CWE-502 | Yüksek8,8 | — | %0,2 | 9 Eki 2026 |
28İzleyin | CVE-2026-105318İstismar yok | WordPress AcyMailing SMTP Newsletter plugin <= 11.1.0 - Cross Site Scripting (XSS) vulnerabilitydatasolution · acymailing smtp newsletter · CWE-79 | Yüksek7,1 | — | %0,1 | 9 Eki 2026 |
28İzleyin | CVE-2026-105870İstismar yok | WordPress WP Associate Post R2 plugin <= 5.0.1 - Cross Site Scripting (XSS) vulnerabilitydelight star inc. · wp associate post r2 · CWE-79 | Yüksek7,1 | — | %0,1 | 9 Eki 2026 |
28İzleyin | CVE-2026-105872İstismar yok | WordPress Product Configurator for WooCommerce plugin <= 1.7.5 - PHP Object Injection vulnerabilitymklacroix · product configurator for woocommerce · CWE-502 | Yüksek7,2 | — | %0,2 | 9 Eki 2026 |
28İzleyin | CVE-2026-105883İstismar yok | WordPress Th Shop Mania theme <= 1.9.1 - Broken Access Control vulnerabilitythemehunk · th shop mania · CWE-862 | Yüksek7,1 | — | %0,1 | 9 Eki 2026 |
39İzleyin | CVE-2026-85531İstismar yok | Payment Validation Bypass in Sipay Electronic Money's OpenCart 3.xsipay electronic money and payment services inc. · opencart virtual pos module · CWE-347 | Kritik9,8 | — | %0,2 | 9 Eki 2026 |
39İzleyin | CVE-2026-86405İstismar yok | Payment Validation Bypass in Sipay Electronic Money's SanalPos PrestaShopsipay electronic money and payment services inc. · prestashop virtual pos module · CWE-347 | Kritik9,8 | — | %0,2 | 9 Eki 2026 |
34İzleyin | CVE-2026-8374İstismar yok | Misuse and Misconfiguration of Cryptographic Algorithm in Bluetooth Communicationswitchbot · lock series lock · CWE-1204 | Yüksek8,5 | — | %0,0 | 9 Eki 2026 |
28İzleyin | CVE-2026-94058İstismar yok | WordPress Treck theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilitybracketweb · treck · CWE-79 | Yüksek7,1 | — | %0,1 | 9 Eki 2026 |
28İzleyin | CVE-2026-94059İstismar yok | WordPress Ogency theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilitybracketweb · ogency · CWE-79 | Yüksek7,1 | — | %0,1 | 9 Eki 2026 |
28İzleyin | CVE-2026-94060İstismar yok | WordPress Voldor theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilitybracketweb · voldor · CWE-79 | Yüksek7,1 | — | %0,1 | 9 Eki 2026 |
28İzleyin | CVE-2026-94061İstismar yok | WordPress Whistle - Sports Club theme <= 4.2 - Reflected Cross Site Scripting (XSS) vulnerabilitydesignthemes · whistle - sports club · CWE-79 | Yüksek7,1 | — | %0,1 | 9 Eki 2026 |
32İzleyin | CVE-2026-94062İstismar yok | WordPress Werkstatt theme <= 4.8.3 - Local File Inclusion vulnerabilityfuelthemes · werkstatt · CWE-98 | Yüksek8,1 | — | %0,3 | 9 Eki 2026 |
37İzleyin | CVE-2026-100730İstismar yok | Grid Protection Alliance openPDC and openHistorian Deserialization of Untrusted Datagrid protection alliance · openpdc · CWE-502 | Kritik9,3 | — | %0,6 | 9 Eki 2026 |
30İzleyin | CVE-2026-104629İstismar yok | Grid Protection Alliance openPDC and openHistorian Use of Externally-Controlled Input to Select Classes or Codegrid protection alliance · openpdc · CWE-470 | Yüksek7,7 | — | %0,3 | 9 Eki 2026 |
34İzleyin | CVE-2026-105281İstismar yok | Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Functiongrid protection alliance · openpdc · CWE-306 | Yüksek8,7 | — | %0,3 | 9 Eki 2026 |
29İzleyin | CVE-2026-106581İstismar yok | Docker Desktop for Windows installer failed to verify external packagesdocker · docker desktop · CWE-347 | Yüksek7,3 | — | %0,0 | 9 Eki 2026 |
28İzleyin | CVE-2026-62026İstismar yok | WordPress Dashboard Notes plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerabilitymightyminnow · dashboard notes · CWE-352 | Yüksek7,1 | — | %0,0 | 9 Eki 2026 |
21İzleyin | CVE-2026-92085İstismar yok | Stored XSS in TMT Machine's Talassoft Industrial Management Softwaretmt machinery industry and trade co. ltd. · talassoft industrial management software · CWE-79 | Orta5,4 | — | %0,1 | 9 Eki 2026 |
28İzleyin | CVE-2026-94063İstismar yok | WordPress Education Center theme <= 3.6.12 - Reflected Cross Site Scripting (XSS) vulnerabilitythemerex · education center · CWE-79 | Yüksek7,1 | — | %0,1 | 9 Eki 2026 |
35İzleyin | CVE-2026-94064İstismar yok | WordPress Neo | Barber Shop WordPress Theme theme <= 3.5 - PHP Object Injection vulnerabilitybuddhathemes · neo | barber shop wordpress theme · CWE-502 | Yüksek8,8 | — | %0,2 | 9 Eki 2026 |
35İzleyin | CVE-2026-94065İstismar yok | WordPress ColorFolio theme <= 1.3 - PHP Object Injection vulnerabilitybuddhathemes · colorfolio · CWE-502 | Yüksek8,8 | — | %0,2 | 9 Eki 2026 |
28İzleyin | CVE-2026-94066İstismar yok | WordPress Pond theme <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerabilityspabrice · pond · CWE-79 | Yüksek7,1 | — | %0,1 | 9 Eki 2026 |
32İzleyin | CVE-2026-94067İstismar yok | WordPress The Voux theme <= 6.9.5 - Local File Inclusion vulnerabilityfuelthemes · the voux · CWE-98 | Yüksek8,1 | — | %0,3 | 9 Eki 2026 |
28İzleyin | CVE-2026-104081İstismar yok | KodExplorer < 4.55 Path Traversal via unzip_pre_name() ZIP Extractionkalcaddle · kodexplorer · CWE-22 | Yüksek7,2 | — | %0,7 | 9 Eki 2026 |
37İzleyin | CVE-2026-105278İstismar yok | Grid Protection Alliance openPDC (Docker image) Use of Hard-coded Credentialsgrid protection alliance · openpdc (docker image) · CWE-798 | Kritik9,3 | — | %0,3 | 9 Eki 2026 |
30İzleyin | CVE-2026-107805İstismar yok | Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storagenginxui · nginx ui · CWE-400 | Yüksek7,5 | — | %0,4 | 9 Eki 2026 |
37İzleyin | CVE-2026-107806Kavram kanıtı | Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwritenginxui · nginx ui · CWE-94 | Kritik9,4 | — | %0,5 | 9 Eki 2026 |
28İzleyin | CVE-2026-108100İstismar yok | HortusFox before 6.2 SQL Injection via /api/locations/list include_info Parameterdanielbrendel · hortusfox-web · CWE-89 | Yüksek7,1 | — | %0,2 | 9 Eki 2026 |
30İzleyin | CVE-2026-108101İstismar yok | HortusFox through 6.3 Unrestricted File Upload via Plant Attachmentsdanielbrendel · hortusfox-web · CWE-434 | Yüksek7,7 | — | %0,3 | 9 Eki 2026 |
32İzleyin | CVE-2026-108105İstismar yok | Open5GS through 2.8.0 MME Reachable Assertion via GTPv1 SGSN Context Requestopen5gs · open5gs · CWE-617 | Yüksek8,2 | — | %0,5 | 9 Eki 2026 |
34İzleyin | CVE-2026-108106İstismar yok | Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Servicexerial · snappy-java · CWE-789 | Yüksek8,7 | — | %0,3 | 9 Eki 2026 |
37İzleyin | CVE-2026-108107İstismar yok | PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.phphotspotbilling · phpnuxbill · CWE-89 | Kritik9,3 | — | %0,4 | 9 Eki 2026 |
28İzleyin | CVE-2026-108108İstismar yok | PHPNuxBill through 2025.3.20 CHAP Authentication Bypass via Password::chap_verify()hotspotbilling · phpnuxbill · CWE-287 | Yüksek7,1 | — | %0,3 | 9 Eki 2026 |
37İzleyin | CVE-2026-108109İstismar yok | PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Codehotspotbilling · phpnuxbill · CWE-307 | Kritik9,3 | — | %0,3 | 9 Eki 2026 |
28İzleyin | CVE-2026-108125İstismar yok | WordPress Post Author Authenticated SQLiCWE-89 | Yüksek7,1 | — | %0,2 | 9 Eki 2026 |
37İzleyin | CVE-2026-15340İstismar yok | Savannah lwIP SMTP client Classic Buffer Overflowsavannah · lwip smtp client · CWE-120 | Kritik9,3 | — | %0,3 | 9 Eki 2026 |
37İzleyin | CVE-2026-28745İstismar yok | Red Lion Controls N-Tron 700 Series Storing Passwords in a Recoverable Formatred lion controls · 700 series · CWE-257 | Kritik9,3 | — | %0,2 | 9 Eki 2026 |
33İzleyin | CVE-2026-29797İstismar yok | Red Lion Controls N-Tron 700 Series Download of Code Without Integrity Checkred lion controls · 700 series · CWE-494 | Yüksek8,4 | — | %0,1 | 9 Eki 2026 |
36İzleyin | CVE-2026-32645İstismar yok | Red Lion Controls N-Tron 700 Series Use of Hard-Coded Credentialsred lion controls · 700 series · CWE-798 | Kritik9,2 | — | %0,1 | 9 Eki 2026 |
37İzleyin | CVE-2026-33367İstismar yok | Red Lion Controls N-Tron 700 Series Missing Authentication for Critical Functionred lion controls · 700 series · CWE-306 | Kritik9,3 | — | %0,2 | 9 Eki 2026 |
34İzleyin | CVE-2026-39453İstismar yok | Red Lion Controls N-Tron 700 Series Reachable Assertionred lion controls · 700 series · CWE-617 | Yüksek8,5 | — | %0,2 | 9 Eki 2026 |
37İzleyin | CVE-2026-39460İstismar yok | Red Lion Controls N-Tron 700 Series Insufficiently Protected Credentialsred lion controls · 700 series · CWE-522 | Kritik9,3 | — | %0,2 | 9 Eki 2026 |
30İzleyin | CVE-2026-78795İstismar yok | An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to CWE-200 | Yüksek7,5 | — | %0,4 | 9 Eki 2026 |
39İzleyin | CVE-2026-78796İstismar yok | An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to CWE-78 | Kritik9,8 | — | %0,6 | 9 Eki 2026 |
34İzleyin | CVE-2026-95702İstismar yok | Code Execution in Host Sentry Process via Double Free in gVisor VFS MemoryFilegoogle · gvisor · CWE-415 | Yüksek8,5 | — | %0,0 | 9 Eki 2026 |
32İzleyin | CVE-2026-102554İstismar yok | Denial of Service via Eager Array Allocation During Deserialization in Guavagoogle · guava · CWE-502 | Yüksek8,2 | — | %0,3 | 9 Eki 2026 |
34İzleyin | CVE-2026-104082Kavram kanıtı | SmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume Mountsmartertools · smartermail · CWE-94 | Yüksek8,6 | — | %0,8 | 9 Eki 2026 |
34İzleyin | CVE-2026-104084İstismar yok | SmarterMail < Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh Tokensmartertools · smartermail · CWE-613 | Yüksek8,7 | — | %0,3 | 9 Eki 2026 |
35İzleyin | CVE-2026-107807İstismar yok | Nginx UI: Node Secret Credential Exposure via URL Query Parameternginxui · nginx ui · CWE-312 | Yüksek8,8 | — | %0,2 | 9 Eki 2026 |
32İzleyin | CVE-2026-107808İstismar yok | Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)nginxui · nginx ui · CWE-287 | Yüksek8,1 | — | %0,4 | 9 Eki 2026 |
35İzleyin | CVE-2026-107809İstismar yok | Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIsnginxui · nginx ui · CWE-352 | Yüksek8,8 | — | %0,2 | 9 Eki 2026 |
32İzleyin | CVE-2026-107810İstismar yok | Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are appliednginxui · nginx ui · CWE-59 | Yüksek8,1 | — | %0,4 | 9 Eki 2026 |
35İzleyin | CVE-2026-107811İstismar yok | 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUsernginxui · nginx ui · CWE-200 | Yüksek8,8 | — | %0,4 | 9 Eki 2026 |
30İzleyin | CVE-2026-107812İstismar yok | Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITMnginxui · nginx ui · CWE-494 | Yüksek7,5 | — | %0,1 | 9 Eki 2026 |
35İzleyin | CVE-2026-107813İstismar yok | Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP stenginxui · nginx ui · CWE-862 | Yüksek8,8 | — | %0,3 | 9 Eki 2026 |
33İzleyin | CVE-2026-107814İstismar yok | MariaDB: Insecure $HOME in MariaDB rpm packagesmariadb · mariadb · CWE-732 | Yüksek8,4 | — | %0,4 | 9 Eki 2026 |
30İzleyin | CVE-2026-108110İstismar yok | MOVO through 0.2.3 Authorization Bypass via Document Endpointshimovo · movo · CWE-639 | Yüksek7,6 | — | %0,3 | 9 Eki 2026 |
34İzleyin | CVE-2026-108113İstismar yok | ILIAS before 9.24, 10.12, and 11.5 Unrestricted File Upload via QTI Importilias-elearning e.v. · ilias · CWE-434 | Yüksek8,7 | — | %0,6 | 9 Eki 2026 |
30İzleyin | CVE-2026-75345İstismar yok | OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging path.CWE-400 | Yüksek7,5 | — | %0,5 | 9 Eki 2026 |
30İzleyin | CVE-2026-75346İstismar yok | An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master through commit 76b95cf in the server-side CIP SetAttributCWE-125 | Yüksek7,5 | — | %0,5 | 9 Eki 2026 |
30İzleyin | CVE-2026-75348İstismar yok | An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/IP TCP SendRRData CoCWE-125 | Yüksek7,5 | — | %0,5 | 9 Eki 2026 |
30İzleyin | CVE-2026-75349İstismar yok | EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bounds read vulnerability in Connection Manager request parsing.CWE-400 | Yüksek7,5 | — | %0,4 | 9 Eki 2026 |
32İzleyin | CVE-2026-90983İstismar yok | OTP Code Exposure in Hayat Hospital's Hayat Mobilehayat health facilities inc. (hayat hospital) · hayat mobile · CWE-603 | Yüksek8,2 | — | %0,2 | 9 Eki 2026 |
32İzleyin | GHSA-r44w-v6gf-x3p6İstismar yok | pyLoad has an authentication bypass in API key validation (check_apikey cache)CWE-287 | Yüksek8,1 | — | — | 9 Eki 2026 |
30İzleyin | GHSA-889w-m37p-88m5İstismar yok | pyLoad: Api.set_user_permission never invalidates the target's sessionCWE-613 | Yüksek7,5 | — | — | 9 Eki 2026 |
30İzleyin | GHSA-jq7h-wrvp-3rgxİstismar yok | pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's sessionCWE-613 | Yüksek7,5 | — | — | 9 Eki 2026 |
32İzleyin | GHSA-68w4-83fh-f2w8İstismar yok | pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator passwordCWE-287 | Yüksek8,1 | — | — | 9 Eki 2026 |
32İzleyin | CVE-2025-61560İstismar yok | A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass raCWE-362 | Yüksek8,1 | — | %0,3 | 9 Eki 2026 |
- CVE-2026-9561034İzleyin
WordPress UpSolution Core plugin <= 9.3 - SQL Injection vulnerability
YüksekCVSS 8,5İstismar yokEPSS %0upsolution · upsolution core9 Eki 2026
- CVE-2026-9632737İzleyin
WordPress WPLMS plugin < 1.9.9.8.2 - SQL Injection vulnerability
KritikCVSS 9,3İstismar yokEPSS %0vibethemes · wplms9 Eki 2026
- CVE-2026-9632837İzleyin
WordPress JNews - Pay Writer plugin <= 12.0.1 - SQL Injection vulnerability
KritikCVSS 9,3İstismar yokEPSS %0jegtheme · jnews - pay writer9 Eki 2026
- CVE-2026-9632934İzleyin
WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability
YüksekCVSS 8,5İstismar yokEPSS %0tagdiv · tagdiv opt-in builder9 Eki 2026
- CVE-2026-9633037İzleyin
WordPress tagDiv Opt-In Builder plugin <= 1.7.6 - SQL Injection vulnerability
KritikCVSS 9,3İstismar yokEPSS %0tagdiv · tagdiv opt-in builder9 Eki 2026
- CVE-2026-9633137İzleyin
WordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerability
KritikCVSS 9,3İstismar yokEPSS %0wpdreams · ajax search pro9 Eki 2026
- CVE-2026-9633228İzleyin
WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0yalla ya! · simple payment9 Eki 2026
- CVE-2026-9633330İzleyin
WordPress GiveWP plugin <= 4.16.8.1 - Payment Bypass vulnerability
YüksekCVSS 7,5İstismar yokEPSS %0liquid web / stellarwp · givewp9 Eki 2026
- CVE-2026-9633630İzleyin
WordPress Forminator plugin <= 1.57.2 - Payment Bypass vulnerability
YüksekCVSS 7,5İstismar yokEPSS %0wpmu dev · forminator9 Eki 2026
- CVE-2026-9646130İzleyin
WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability
YüksekCVSS 7,5İstismar yokEPSS %0tms · amelia9 Eki 2026
- CVE-2026-9655328İzleyin
WordPress FiboSearch plugin <= 1.34.1 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0damian góra · fibosearch9 Eki 2026
- CVE-2026-9660728İzleyin
WordPress NEX-Forms plugin <= 9.3.1 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0basix · nex-forms9 Eki 2026
- CVE-2026-9667135İzleyin
WordPress Featured Image from URL plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability
YüksekCVSS 8,8İstismar yokEPSS %0fifu.app · featured image from url9 Eki 2026
- CVE-2026-9676128İzleyin
WordPress Welcart e-Commerce plugin <= 2.12.3 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0welcart · welcart e-commerce9 Eki 2026
- CVE-2026-9680937İzleyin
WordPress EduAdmin Booking plugin < 6.0.0 - SQL Injection vulnerability
KritikCVSS 9,3İstismar yokEPSS %0multinet interactive ab · eduadmin booking9 Eki 2026
- CVE-2026-10022730İzleyin
Apache CXF: XML Signature wrapping in JAX-RS XML Security
YüksekCVSS 7,5İstismar yokEPSS %0apache · cxf9 Eki 2026
- CVE-2026-10793730İzleyin
Apache CXF: The attachment header size and count limits can be bypassed, which allows denial of service through memory exhaustion.
YüksekCVSS 7,5İstismar yokEPSS %0apache · cxf9 Eki 2026
- CVE-2026-10793836İzleyin
Apache CXF: The Netty HTTP client transport does not perform TLS hostname verification.
KritikCVSS 9,1İstismar yokEPSS %0apache · cxf9 Eki 2026
- CVE-2026-10803930İzleyin
Apache CXF: Prevent unbounded XML document size in StaxUtils by adding default element and character limits
YüksekCVSS 7,5İstismar yokEPSS %0apache · cxf9 Eki 2026
- CVE-2026-7157536İzleyin
Apache CXF: Inoperative max_age authentication-freshness check in OidcClientCodeRequestFilter
KritikCVSS 9,1İstismar yokEPSS %0apache · cxf9 Eki 2026
- CVE-2026-7317932İzleyin
Apache CXF: JPA authorization-code consume is non-atomic
YüksekCVSS 8,1İstismar yokEPSS %0apache · cxf9 Eki 2026
- CVE-2026-7838430İzleyin
Apache CXF: Unbounded DEFLATE Decompression in CXF JOSE/JWE and SAML Processing (Decompression Bomb)
YüksekCVSS 7,5İstismar yokEPSS %0apache · cxf9 Eki 2026
- CVE-2026-8646330İzleyin
Apache CXF: FIQL Query Parser Denial of Service
YüksekCVSS 7,5İstismar yokEPSS %0apache · cxf9 Eki 2026
- CVE-2026-9746836İzleyin
Apache CXF: Authentication bypass via weak cache keys for validated STS tokens
KritikCVSS 9,1İstismar yokEPSS %0apache · cxf9 Eki 2026
- CVE-2026-9779130İzleyin
Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests
YüksekCVSS 7,5İstismar yokEPSS %0apache · cxf9 Eki 2026
- GHSA-fwjg-cm92-j3hj36İzleyin
Pre-shared key mode transmits the TGK in cleartext, exposing the SRTP master key
KritikCVSS 9,1İstismar yok9 Eki 2026
- GHSA-vv5m-jxxh-462729İzleyin
Insecure Preservation of SUID/SGID Bits during ZIP Extraction Leading to Potential Privilege Escalation
YüksekCVSS 7,3İstismar yok9 Eki 2026
- GHSA-xq78-wvcv-hqvj30İzleyin
MIKEY message MAC is never verified on receive, so forged messages are accepted
YüksekCVSS 7,5İstismar yok9 Eki 2026
- GHSA-xr22-8pqp-gwfh30İzleyin
Poly1305 panics or computes a wrong tag on attacker-chosen messages of 64 bytes or more
YüksekCVSS 7,5İstismar yok9 Eki 2026
- CVE-2026-10341235İzleyin
Apache Camel Karavan: project file name path traversal when committing a project to Git
YüksekCVSS 8,8İstismar yokEPSS %0apache software foundation · apache camel karavan9 Eki 2026
- CVE-2026-10341335İzleyin
Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml
YüksekCVSS 8,8İstismar yokEPSS %0apache software foundation · apache camel karavan9 Eki 2026
- CVE-2026-10439235İzleyin
WordPress Quiz And Survey Master plugin <= 11.2.7 - PHP Object Injection vulnerability
YüksekCVSS 8,8İstismar yokEPSS %0expresstech · quiz and survey master9 Eki 2026
- CVE-2026-10531828İzleyin
WordPress AcyMailing SMTP Newsletter plugin <= 11.1.0 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0datasolution · acymailing smtp newsletter9 Eki 2026
- CVE-2026-10587028İzleyin
WordPress WP Associate Post R2 plugin <= 5.0.1 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0delight star inc. · wp associate post r29 Eki 2026
- CVE-2026-10587228İzleyin
WordPress Product Configurator for WooCommerce plugin <= 1.7.5 - PHP Object Injection vulnerability
YüksekCVSS 7,2İstismar yokEPSS %0mklacroix · product configurator for woocommerce9 Eki 2026
- CVE-2026-10588328İzleyin
WordPress Th Shop Mania theme <= 1.9.1 - Broken Access Control vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0themehunk · th shop mania9 Eki 2026
- CVE-2026-8553139İzleyin
Payment Validation Bypass in Sipay Electronic Money's OpenCart 3.x
KritikCVSS 9,8İstismar yokEPSS %0sipay electronic money and payment services inc. · opencart virtual pos module9 Eki 2026
- CVE-2026-8640539İzleyin
Payment Validation Bypass in Sipay Electronic Money's SanalPos PrestaShop
KritikCVSS 9,8İstismar yokEPSS %0sipay electronic money and payment services inc. · prestashop virtual pos module9 Eki 2026
- CVE-2026-837434İzleyin
Misuse and Misconfiguration of Cryptographic Algorithm in Bluetooth Communication
YüksekCVSS 8,5İstismar yokEPSS %0switchbot · lock series lock9 Eki 2026
- CVE-2026-9405828İzleyin
WordPress Treck theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0bracketweb · treck9 Eki 2026
- CVE-2026-9405928İzleyin
WordPress Ogency theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0bracketweb · ogency9 Eki 2026
- CVE-2026-9406028İzleyin
WordPress Voldor theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0bracketweb · voldor9 Eki 2026
- CVE-2026-9406128İzleyin
WordPress Whistle - Sports Club theme <= 4.2 - Reflected Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0designthemes · whistle - sports club9 Eki 2026
- CVE-2026-9406232İzleyin
WordPress Werkstatt theme <= 4.8.3 - Local File Inclusion vulnerability
YüksekCVSS 8,1İstismar yokEPSS %0fuelthemes · werkstatt9 Eki 2026
- CVE-2026-10073037İzleyin
Grid Protection Alliance openPDC and openHistorian Deserialization of Untrusted Data
KritikCVSS 9,3İstismar yokEPSS %0grid protection alliance · openpdc9 Eki 2026
- CVE-2026-10462930İzleyin
Grid Protection Alliance openPDC and openHistorian Use of Externally-Controlled Input to Select Classes or Code
YüksekCVSS 7,7İstismar yokEPSS %0grid protection alliance · openpdc9 Eki 2026
- CVE-2026-10528134İzleyin
Grid Protection Alliance openPDC and openHistorian Missing Authentication for Critical Function
YüksekCVSS 8,7İstismar yokEPSS %0grid protection alliance · openpdc9 Eki 2026
- CVE-2026-10658129İzleyin
Docker Desktop for Windows installer failed to verify external packages
YüksekCVSS 7,3İstismar yokEPSS %0docker · docker desktop9 Eki 2026
- CVE-2026-6202628İzleyin
WordPress Dashboard Notes plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0mightyminnow · dashboard notes9 Eki 2026
- CVE-2026-9208521İzleyin
Stored XSS in TMT Machine's Talassoft Industrial Management Software
OrtaCVSS 5,4İstismar yokEPSS %0tmt machinery industry and trade co. ltd. · talassoft industrial management software9 Eki 2026
- CVE-2026-9406328İzleyin
WordPress Education Center theme <= 3.6.12 - Reflected Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0themerex · education center9 Eki 2026
- CVE-2026-9406435İzleyin
WordPress Neo | Barber Shop WordPress Theme theme <= 3.5 - PHP Object Injection vulnerability
YüksekCVSS 8,8İstismar yokEPSS %0buddhathemes · neo | barber shop wordpress theme9 Eki 2026
- CVE-2026-9406535İzleyin
WordPress ColorFolio theme <= 1.3 - PHP Object Injection vulnerability
YüksekCVSS 8,8İstismar yokEPSS %0buddhathemes · colorfolio9 Eki 2026
- CVE-2026-9406628İzleyin
WordPress Pond theme <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0spabrice · pond9 Eki 2026
- CVE-2026-9406732İzleyin
WordPress The Voux theme <= 6.9.5 - Local File Inclusion vulnerability
YüksekCVSS 8,1İstismar yokEPSS %0fuelthemes · the voux9 Eki 2026
- CVE-2026-10408128İzleyin
KodExplorer < 4.55 Path Traversal via unzip_pre_name() ZIP Extraction
YüksekCVSS 7,2İstismar yokEPSS %0kalcaddle · kodexplorer9 Eki 2026
- CVE-2026-10527837İzleyin
Grid Protection Alliance openPDC (Docker image) Use of Hard-coded Credentials
KritikCVSS 9,3İstismar yokEPSS %0grid protection alliance · openpdc (docker image)9 Eki 2026
- CVE-2026-10780530İzleyin
Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage
YüksekCVSS 7,5İstismar yokEPSS %0nginxui · nginx ui9 Eki 2026
- CVE-2026-10780637İzleyin
Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite
KritikCVSS 9,4Kavram kanıtıEPSS %0nginxui · nginx ui9 Eki 2026
- CVE-2026-10810028İzleyin
HortusFox before 6.2 SQL Injection via /api/locations/list include_info Parameter
YüksekCVSS 7,1İstismar yokEPSS %0danielbrendel · hortusfox-web9 Eki 2026
- CVE-2026-10810130İzleyin
HortusFox through 6.3 Unrestricted File Upload via Plant Attachments
YüksekCVSS 7,7İstismar yokEPSS %0danielbrendel · hortusfox-web9 Eki 2026
- CVE-2026-10810532İzleyin
Open5GS through 2.8.0 MME Reachable Assertion via GTPv1 SGSN Context Request
YüksekCVSS 8,2İstismar yokEPSS %0open5gs · open5gs9 Eki 2026
- CVE-2026-10810634İzleyin
Xerial snappy-java before 1.1.10.9 Unbounded Memory Allocation Denial of Service
YüksekCVSS 8,7İstismar yokEPSS %0xerial · snappy-java9 Eki 2026
- CVE-2026-10810737İzleyin
PHPNuxBill through 2025.3.20 Unauthenticated SQL Injection via radius.php
KritikCVSS 9,3İstismar yokEPSS %0hotspotbilling · phpnuxbill9 Eki 2026
- CVE-2026-10810828İzleyin
PHPNuxBill through 2025.3.20 CHAP Authentication Bypass via Password::chap_verify()
YüksekCVSS 7,1İstismar yokEPSS %0hotspotbilling · phpnuxbill9 Eki 2026
- CVE-2026-10810937İzleyin
PHPNuxBill through 2025.3.20 Account Takeover via Brute-Forceable Password Reset Code
KritikCVSS 9,3İstismar yokEPSS %0hotspotbilling · phpnuxbill9 Eki 2026
- CVE-2026-10812528İzleyin
WordPress Post Author Authenticated SQLi
YüksekCVSS 7,1İstismar yokEPSS %09 Eki 2026
- CVE-2026-1534037İzleyin
Savannah lwIP SMTP client Classic Buffer Overflow
KritikCVSS 9,3İstismar yokEPSS %0savannah · lwip smtp client9 Eki 2026
- CVE-2026-2874537İzleyin
Red Lion Controls N-Tron 700 Series Storing Passwords in a Recoverable Format
KritikCVSS 9,3İstismar yokEPSS %0red lion controls · 700 series9 Eki 2026
- CVE-2026-2979733İzleyin
Red Lion Controls N-Tron 700 Series Download of Code Without Integrity Check
YüksekCVSS 8,4İstismar yokEPSS %0red lion controls · 700 series9 Eki 2026
- CVE-2026-3264536İzleyin
Red Lion Controls N-Tron 700 Series Use of Hard-Coded Credentials
KritikCVSS 9,2İstismar yokEPSS %0red lion controls · 700 series9 Eki 2026
- CVE-2026-3336737İzleyin
Red Lion Controls N-Tron 700 Series Missing Authentication for Critical Function
KritikCVSS 9,3İstismar yokEPSS %0red lion controls · 700 series9 Eki 2026
- CVE-2026-3945334İzleyin
Red Lion Controls N-Tron 700 Series Reachable Assertion
YüksekCVSS 8,5İstismar yokEPSS %0red lion controls · 700 series9 Eki 2026
- CVE-2026-3946037İzleyin
Red Lion Controls N-Tron 700 Series Insufficiently Protected Credentials
KritikCVSS 9,3İstismar yokEPSS %0red lion controls · 700 series9 Eki 2026
- CVE-2026-7879530İzleyin
An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to
YüksekCVSS 7,5İstismar yokEPSS %09 Eki 2026
- CVE-2026-7879639İzleyin
An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to
KritikCVSS 9,8İstismar yokEPSS %09 Eki 2026
- CVE-2026-9570234İzleyin
Code Execution in Host Sentry Process via Double Free in gVisor VFS MemoryFile
YüksekCVSS 8,5İstismar yokEPSS %0google · gvisor9 Eki 2026
- CVE-2026-10255432İzleyin
Denial of Service via Eager Array Allocation During Deserialization in Guava
YüksekCVSS 8,2İstismar yokEPSS %0google · guava9 Eki 2026
- CVE-2026-10408234İzleyin
SmarterMail < Build 9777 SysAdmin Remote Code Execution via Volume Mount
YüksekCVSS 8,6Kavram kanıtıEPSS %0smartertools · smartermail9 Eki 2026
- CVE-2026-10408434İzleyin
SmarterMail < Build 9777 Stale JWT Role Claim Privilege Escalation via Refresh Token
YüksekCVSS 8,7İstismar yokEPSS %0smartertools · smartermail9 Eki 2026
- CVE-2026-10780735İzleyin
Nginx UI: Node Secret Credential Exposure via URL Query Parameter
YüksekCVSS 8,8İstismar yokEPSS %0nginxui · nginx ui9 Eki 2026
- CVE-2026-10780832İzleyin
Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass)
YüksekCVSS 8,1İstismar yokEPSS %0nginxui · nginx ui9 Eki 2026
- CVE-2026-10780935İzleyin
Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs
YüksekCVSS 8,8İstismar yokEPSS %0nginxui · nginx ui9 Eki 2026
- CVE-2026-10781032İzleyin
Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied
YüksekCVSS 8,1İstismar yokEPSS %0nginxui · nginx ui9 Eki 2026
- CVE-2026-10781135İzleyin
0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser
YüksekCVSS 8,8İstismar yokEPSS %0nginxui · nginx ui9 Eki 2026
- CVE-2026-10781230İzleyin
Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM
YüksekCVSS 7,5İstismar yokEPSS %0nginxui · nginx ui9 Eki 2026
- CVE-2026-10781335İzleyin
Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP ste
YüksekCVSS 8,8İstismar yokEPSS %0nginxui · nginx ui9 Eki 2026
- CVE-2026-10781433İzleyin
MariaDB: Insecure $HOME in MariaDB rpm packages
YüksekCVSS 8,4İstismar yokEPSS %0mariadb · mariadb9 Eki 2026
- CVE-2026-10811030İzleyin
MOVO through 0.2.3 Authorization Bypass via Document Endpoints
YüksekCVSS 7,6İstismar yokEPSS %0himovo · movo9 Eki 2026
- CVE-2026-10811334İzleyin
ILIAS before 9.24, 10.12, and 11.5 Unrestricted File Upload via QTI Import
YüksekCVSS 8,7İstismar yokEPSS %0ilias-elearning e.v. · ilias9 Eki 2026
- CVE-2026-7534530İzleyin
OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging path.
YüksekCVSS 7,5İstismar yokEPSS %09 Eki 2026
- CVE-2026-7534630İzleyin
An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master through commit 76b95cf in the server-side CIP SetAttribut
YüksekCVSS 7,5İstismar yokEPSS %09 Eki 2026
- CVE-2026-7534830İzleyin
An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/IP TCP SendRRData Co
YüksekCVSS 7,5İstismar yokEPSS %09 Eki 2026
- CVE-2026-7534930İzleyin
EIPStackGroup OpENer v2.3.0/master up to commit 76b95cf contains an out-of-bounds read vulnerability in Connection Manager request parsing.
YüksekCVSS 7,5İstismar yokEPSS %09 Eki 2026
- CVE-2026-9098332İzleyin
OTP Code Exposure in Hayat Hospital's Hayat Mobile
YüksekCVSS 8,2İstismar yokEPSS %0hayat health facilities inc. (hayat hospital) · hayat mobile9 Eki 2026
- GHSA-r44w-v6gf-x3p632İzleyin
pyLoad has an authentication bypass in API key validation (check_apikey cache)
YüksekCVSS 8,1İstismar yok9 Eki 2026
- GHSA-889w-m37p-88m530İzleyin
pyLoad: Api.set_user_permission never invalidates the target's session
YüksekCVSS 7,5İstismar yok9 Eki 2026
- GHSA-jq7h-wrvp-3rgx30İzleyin
pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session
YüksekCVSS 7,5İstismar yok9 Eki 2026
- GHSA-68w4-83fh-f2w832İzleyin
pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password
YüksekCVSS 8,1İstismar yok9 Eki 2026
- CVE-2025-6156032İzleyin
A race condition vulnerability in the SessionManager of CNCF: Cloud Native Computing Foundation Argo CD v3.0.6 allows attackers to bypass ra
YüksekCVSS 8,1İstismar yokEPSS %09 Eki 2026