İçeriğe atla
Noroxi

Yayın tarihine göre

Ekim 2026: sömürülen ve yeni ciddi CVE kayıtları

6.181 kayıt · 12 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 19 / 62

  • CVE-2026-108259
    32İzleyin

    Tina: Code injection via unescaped Git branch name in generated client source

    YüksekCVSS 8,2İstismar yokEPSS %0

    tinacms · tinacms9 Eki 2026

  • CVE-2026-108260
    30İzleyin

    @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS

    YüksekCVSS 7,6İstismar yokEPSS %0

    tinacms · tinacms9 Eki 2026

  • CVE-2026-108261
    37İzleyin

    TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment

    KritikCVSS 9,3İstismar yokEPSS %0

    tinacms · tinacms9 Eki 2026

  • CVE-2026-108263
    39İzleyin

    Astron Agent: Unsandboxed code-node leads to cross-tenant RCE

    KritikCVSS 9,9İstismar yokEPSS %0

    iflytek · astron-agent9 Eki 2026

  • CVE-2026-108264
    36İzleyin

    Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE)

    KritikCVSS 9,1İstismar yokEPSS %0

    wizarrrr · wizarr9 Eki 2026

  • CVE-2026-108265
    36İzleyin

    enclave-os-mini: RA-TLS challenge certificates were not bound to the TLS session

    KritikCVSS 9,1İstismar yokEPSS %0

    privasys · enclave-os-mini9 Eki 2026

  • CVE-2026-108266
    36İzleyin

    Privasys rustls fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session

    KritikCVSS 9,1İstismar yokEPSS %0

    privasys · rustls9 Eki 2026

  • CVE-2026-57458
    32İzleyin

    Vikunja: Scoped API token can mint unrestricted OAuth session credentials

    YüksekCVSS 8,1İstismar yokEPSS %0

    go-vikunja · vikunja9 Eki 2026

  • CVE-2026-62367
    30İzleyin

    Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

    YüksekCVSS 7,5İstismar yokEPSS %0

    go-vikunja · vikunja9 Eki 2026

  • CVE-2026-62376
    32İzleyin

    Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

    YüksekCVSS 8,1İstismar yokEPSS %0

    go-vikunja · vikunja9 Eki 2026

  • CVE-2026-92705
    31İzleyin

    Aegisub executes arbitrary code through automatically loaded Automation scripts

    YüksekCVSS 7,8İstismar yokEPSS %0

    typesettingtools · aegisub9 Eki 2026

  • CVE-2026-108267
    36İzleyin

    Privasys Go fork: RA-TLS challenge mode did not bind attestation evidence to the TLS session

    KritikCVSS 9,1İstismar yokEPSS %0

    privasys · go9 Eki 2026

  • CVE-2026-108268
    36İzleyin

    enclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session

    KritikCVSS 9,1İstismar yokEPSS %0

    privasys · enclave-os-virtual9 Eki 2026

  • CVE-2026-108269
    36İzleyin

    ra-tls-clients: RA-TLS challenge verifier accepted quotes not bound to the TLS session

    KritikCVSS 9,1İstismar yokEPSS %0

    privasys · ra-tls-clients9 Eki 2026

  • CVE-2026-22061
    32İzleyin

    CVE-2026-22061 Debug Log Information Disclosure Vulnerability in Trident

    YüksekCVSS 8,2İstismar yokEPSS %0

    netapp · trident9 Eki 2026

  • CVE-2026-108474
    39İzleyin

    In JetBrains Exposed before 1.5.1 sQL injection was possible via unescaped string arguments of several SQL functions

    KritikCVSS 9,8İstismar yokEPSS %0

    jetbrains · exposed10 Eki 2026

  • CVE-2026-101947
    33İzleyin

    ExifTool for photo and video 5.0.1 - Local OS command injection through filenames during CSV export

    YüksekCVSS 8,4İstismar yokEPSS %0

    cellhubs · exiftool for photo and video10 Eki 2026

  • CVE-2026-104732
    39İzleyin

    Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler

    KritikCVSS 9,8İstismar yokEPSS %0

    inilerm · advanced ip blocker10 Eki 2026

  • CVE-2026-104797
    32İzleyin

    Advanced Form Integration <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to

    YüksekCVSS 8,1İstismar yokEPSS %0

    nasirahmed · advanced form integration — connect forms to 300+ apps10 Eki 2026

  • CVE-2026-107645
    36İzleyin

    Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter

    KritikCVSS 9,1İstismar yokEPSS %0

    creativethemeshq · blocksy companion10 Eki 2026

  • CVE-2026-94589
    39İzleyin

    Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Uploa

    KritikCVSS 9,8İstismar yokEPSS %0

    htplugins · extensions for cf7 (contact form 7 database, conditional fields and redirection)10 Eki 2026

  • CVE-2026-103889
    39İzleyin

    3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    expivi · 3d product configurator for woocommerce10 Eki 2026

  • CVE-2026-104021
    28İzleyin

    Fastcache by Host.it <= 1.7.4 - Authenticated (Administrator+) Code Injection via .htaccess Directive Injection via 'cache_cookie_exclude' Setting

    YüksekCVSS 7,2İstismar yokEPSS %0

    hostspa · fastcache by host.it10 Eki 2026

  • CVE-2026-89301
    30İzleyin

    rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Missing Authorization to Unauthenticated Limited File Read/Disclosure and Limited File Deletion via Si

    YüksekCVSS 7,5İstismar yokEPSS %0

    rtcamp · rtmedia for wordpress, buddypress and bbpress10 Eki 2026

  • CVE-2026-97670
    36İzleyin

    Avada (Fusion) Builder <= 7.16.1 - Unauthenticated Arbitrary WordPress Action Invocation via '{action_hook}' Dynamic-Data Token in Form Field

    KritikCVSS 9,1İstismar yokEPSS %0

    themefusion · avada (fusion) builder10 Eki 2026

  • CVE-2026-104723
    35İzleyin

    LifterLMS <= 10.2.1 - Authenticated (Custom+) PHP Object Injection via 'custom' Lesson Data

    YüksekCVSS 8,8İstismar yokEPSS %0

    lifterlms · lifterlms – wp lms for elearning, online courses, & quizzes10 Eki 2026

  • CVE-2026-104725
    35İzleyin

    Groundhogg <= 4.9 - Authenticated (Custom+) Privilege Escalation to 'user' Parameter

    YüksekCVSS 8,8İstismar yokEPSS %0

    trainingbusinesspros · groundhogg — crm, newsletters, and marketing automation10 Eki 2026

  • CVE-2026-104752
    28İzleyin

    Rank Math SEO < 1.0.280 - Admin+ Arbitrary File Upload to RCE via Settings Import

    YüksekCVSS 7,2İstismar yokEPSS %0

    unknown · rank math seo10 Eki 2026

  • CVE-2026-104766
    35İzleyin

    Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter

    YüksekCVSS 8,8İstismar yokEPSS %0

    latepoint · appointment booking plugin – latepoint | calendar & scheduling for wordpress10 Eki 2026

  • CVE-2026-104899
    32İzleyin

    GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter

    YüksekCVSS 8,1İstismar yokEPSS %0

    paoltaia · geodirectory – wp business directory plugin and classified listings directory10 Eki 2026

  • CVE-2026-14335
    28İzleyin

    Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters

    YüksekCVSS 7,2İstismar yokEPSS %0

    smub · easy digital downloads – ecommerce payments and subscriptions made easy10 Eki 2026

  • CVE-2026-77183
    35İzleyin

    FooSales <= 1.43.0 - Authenticated (Custom+) Privilege Escalation via create_update_customer REST Endpoint

    YüksekCVSS 8,8İstismar yokEPSS %0

    foosales · foosales – point of sale (pos) for woocommerce10 Eki 2026

  • CVE-2026-83526
    35İzleyin

    FV Player 8 <= 8.1.7 - Authenticated (Subscriber+) Arbitrary File Upload via videos[].fv_wp_flowplayer_field_src Parameter

    YüksekCVSS 8,8İstismar yokEPSS %0

    foliovision · fv player 810 Eki 2026

  • CVE-2026-87780
    35İzleyin

    LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored XSS via Shipping Rules

    YüksekCVSS 8,8İstismar yokEPSS %0

    unknown · ltl freight quotes10 Eki 2026

  • CVE-2026-87781
    34İzleyin

    LTL Freight Quotes – Old Dominion Edition 4.2.11 - 4.2.18 - Unauthenticated SQLi via Shipping Rule 'edit_id' Parameter

    YüksekCVSS 8,6İstismar yokEPSS %0

    unknown · ltl freight quotes10 Eki 2026

  • CVE-2026-92975
    32İzleyin

    Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion

    YüksekCVSS 8,1İstismar yokEPSS %0

    trainingbusinesspros · groundhogg — crm, newsletters, and marketing automation10 Eki 2026

  • CVE-2026-93775
    28İzleyin

    Podlove Podcast Publisher <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook

    YüksekCVSS 7,2İstismar yokEPSS %0

    eteubert · podlove podcast publisher10 Eki 2026

  • CVE-2026-94256
    32İzleyin

    SMS Alert 4.0.0 - Unauthenticated Authentication Bypass via Login with OTP

    YüksekCVSS 8,1İstismar yokEPSS %0

    unknown · sms alert10 Eki 2026

  • CVE-2026-94257
    32İzleyin

    SMS Alert 3.9.6 - 4.0.0 - Unauthenticated Privilege Escalation via Arbitrary Password Reset

    YüksekCVSS 8,1İstismar yokEPSS %0

    unknown · sms alert10 Eki 2026

  • CVE-2026-96667
    28İzleyin

    Real Estate Manager <= 7.3 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter

    YüksekCVSS 7,2İstismar yokEPSS %0

    rameez_iqbal · real estate manager – property listing and agent management10 Eki 2026

  • CVE-2026-96682
    28İzleyin

    Presto Player <= 4.5.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag

    YüksekCVSS 7,2İstismar yokEPSS %0

    2winfactor · presto player10 Eki 2026

  • CVE-2026-100161
    28İzleyin

    Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter

    YüksekCVSS 7,2İstismar yokEPSS %0

    villatheme · photo reviews for woocommerce10 Eki 2026

  • CVE-2026-100196
    28İzleyin

    LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content

    YüksekCVSS 7,2İstismar yokEPSS %0

    wp_media · lazyload plugin – lazy load images, videos, and iframes10 Eki 2026

  • CVE-2026-104801
    36İzleyin

    PPOM <= 34.0.10 - Unauthenticated Arbitrary File Deletion via 'ppom[fields][<data_name>][n][org]' Parameter

    KritikCVSS 9,1İstismar yokEPSS %0

    themeisle · ppom – product addons & custom fields for woocommerce10 Eki 2026

  • CVE-2026-107742
    28İzleyin

    10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

    YüksekCVSS 7,2İstismar yokEPSS %0

    10web · 10web booster – website speed optimization, cache & page speed optimizer10 Eki 2026

  • CVE-2026-12626
    28İzleyin

    Online Scheduling and Appointment Booking System <= 28.2 - Authenticated (Custom+) PHP Object Injection via 'value' Parameter

    YüksekCVSS 7,2İstismar yokEPSS %0

    ladela · online scheduling and appointment booking system – bookly10 Eki 2026

  • CVE-2026-94538
    32İzleyin

    WP File Download <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple Functions

    YüksekCVSS 8,1İstismar yokEPSS %0

    joomunited · wp file download10 Eki 2026

  • CVE-2026-95684
    28İzleyin

    VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter

    YüksekCVSS 7,2İstismar yokEPSS %0

    e4jvikwp · vikbooking hotel booking engine & pms10 Eki 2026

  • CVE-2026-96558
    28İzleyin

    Quiz and Survey Master (QSM) <= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter

    YüksekCVSS 7,2İstismar yokEPSS %0

    expresstech · quiz and survey master (qsm) – quiz maker & survey maker10 Eki 2026

  • CVE-2026-96572
    28İzleyin

    WP Meteor Website Speed Optimization Addon <= 3.4.18 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

    YüksekCVSS 7,2İstismar yokEPSS %0

    aguidrevitch · wp meteor website speed optimization addon10 Eki 2026

  • CVE-2026-96840
    28İzleyin

    Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display_name User Field

    YüksekCVSS 7,2İstismar yokEPSS %0

    wpxpo · post grid gutenberg blocks – postx10 Eki 2026

  • CVE-2026-100147
    28İzleyin

    FunnelKit <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)

    YüksekCVSS 7,2İstismar yokEPSS %0

    teamfunnelkit · funnelkit – funnel builder for woocommerce checkout10 Eki 2026

  • CVE-2026-100178
    28İzleyin

    WPAdverts <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via 'adverts_location' Parameter

    YüksekCVSS 7,2İstismar yokEPSS %0

    gwin · wpadverts – classifieds plugin10 Eki 2026

  • CVE-2026-101920
    28İzleyin

    Molongui Authorship <= 5.2.12 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment href Attribute

    YüksekCVSS 7,2İstismar yokEPSS %0

    molongui · molongui authorship – author boxes, guest authors & co-authors for wordpress10 Eki 2026

  • CVE-2026-104759
    32İzleyin

    WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Authentication Bypass via OIDC Nonce Replay via id_token Nonce Ve

    YüksekCVSS 8,1İstismar yokEPSS %0

    wpo365 · wpo365 | seamless wordpress + microsoft integration (wpo365 | login)10 Eki 2026

  • CVE-2026-104803
    39İzleyin

    WPCOM Member <= 1.7.27 - Unauthenticated Authentication Bypass via 'uuid' and 'code' Parameters on Social-Login Callback

    KritikCVSS 9,8İstismar yokEPSS %0

    whyun · wpcom member10 Eki 2026

  • CVE-2026-106606
    28İzleyin

    WordPress YITH WooCommerce Affiliates plugin <= 3.31.0 - PHP Object Injection vulnerability

    YüksekCVSS 7,2İstismar yokEPSS %0

    yith · yith woocommerce affiliates10 Eki 2026

  • CVE-2026-62045
    39İzleyin

    WordPress Booklovers theme <= 2.13.0 - PHP Object Injection vulnerability

    KritikCVSS 9,8İstismar yokEPSS %0

    themerex group · booklovers10 Eki 2026

  • CVE-2026-62046
    39İzleyin

    WordPress Gutentype theme <= 2.1.12 - PHP Object Injection vulnerability

    KritikCVSS 9,8İstismar yokEPSS %0

    themerex group · gutentype10 Eki 2026

  • CVE-2026-93746
    30İzleyin

    WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized

    YüksekCVSS 7,5İstismar yokEPSS %0

    webtoffee · webtoffee woocommerce pdf invoices, packing slips, delivery notes & shipping labels10 Eki 2026

  • CVE-2026-93927
    39İzleyin

    WordPress Veto theme <= 1.6.0 - PHP Object Injection vulnerability

    KritikCVSS 9,8İstismar yokEPSS %0

    axiomthemes · veto10 Eki 2026

  • CVE-2026-93929
    39İzleyin

    WordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerability

    KritikCVSS 9,8İstismar yokEPSS %0

    themerex group · travesia10 Eki 2026

  • CVE-2026-93930
    39İzleyin

    WordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerability

    KritikCVSS 9,8İstismar yokEPSS %0

    themerex group · tantra10 Eki 2026

  • CVE-2026-93931
    39İzleyin

    WordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerability

    KritikCVSS 9,8İstismar yokEPSS %0

    themerex group · smash10 Eki 2026

  • CVE-2026-93932
    39İzleyin

    WordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerability

    KritikCVSS 9,8İstismar yokEPSS %0

    themerex group · smart casa10 Eki 2026

  • CVE-2026-93933
    39İzleyin

    WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability

    KritikCVSS 9,8İstismar yokEPSS %0

    themerex group · rosalinda10 Eki 2026

  • CVE-2026-93934
    39İzleyin

    WordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerability

    KritikCVSS 9,8İstismar yokEPSS %0

    themerex group · partiso10 Eki 2026

  • CVE-2026-93935
    39İzleyin

    WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerability

    KritikCVSS 9,8İstismar yokEPSS %0

    themerex group · let's play10 Eki 2026

  • CVE-2026-93936
    39İzleyin

    WordPress IPharm theme <= 1.2.4 - PHP Object Injection vulnerability

    KritikCVSS 9,8İstismar yokEPSS %0

    themerex group · ipharm10 Eki 2026

  • CVE-2026-93937
    39İzleyin

    WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerability

    KritikCVSS 9,8İstismar yokEPSS %0

    themerex group · hygia10 Eki 2026

  • CVE-2026-93938
    39İzleyin

    WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerability

    KritikCVSS 9,8İstismar yokEPSS %0

    themerex group · hogwords10 Eki 2026

  • CVE-2026-93940
    39İzleyin

    WordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerability

    KritikCVSS 9,8İstismar yokEPSS %0

    themerex group · greeny10 Eki 2026

  • CVE-2026-93941
    39İzleyin

    WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerability

    KritikCVSS 9,8İstismar yokEPSS %0

    themerex group · edema10 Eki 2026

  • CVE-2026-93942
    39İzleyin

    WordPress Dwell theme <= 1.16.0 - PHP Object Injection vulnerability

    KritikCVSS 9,8İstismar yokEPSS %0

    themerex group · dwell10 Eki 2026

  • CVE-2026-93943
    39İzleyin

    WordPress Convex theme <= 1.16.0 - PHP Object Injection vulnerability

    KritikCVSS 9,8İstismar yokEPSS %0

    themerex group · convex10 Eki 2026

  • CVE-2026-93944
    39İzleyin

    WordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerability

    KritikCVSS 9,8İstismar yokEPSS %0

    themerex group · camelia10 Eki 2026

  • CVE-2026-93945
    39İzleyin

    WordPress Balance theme <= 1.12.0 - PHP Object Injection vulnerability

    KritikCVSS 9,8İstismar yokEPSS %0

    axiomthemes · balance10 Eki 2026

  • CVE-2026-93949
    28İzleyin

    WordPress Grocery Shopping Store theme <= 1.3.3 - Broken Authentication vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    omegathemes · grocery shopping store10 Eki 2026

  • CVE-2026-93950
    30İzleyin

    WordPress Motors theme <= 1.4.108 - Broken Access Control vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %0

    stylemixthemes · motors10 Eki 2026

  • CVE-2026-93951
    28İzleyin

    WordPress Zeinet theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    bracketweb · zeinet10 Eki 2026

  • CVE-2026-96278
    28İzleyin

    WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History

    YüksekCVSS 7,2İstismar yokEPSS %0

    opajaap · wp photo album plus10 Eki 2026

  • CVE-2026-96662
    30İzleyin

    Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter

    YüksekCVSS 7,5İstismar yokEPSS %0

    latepoint · appointment booking plugin – latepoint | calendar & scheduling for wordpress10 Eki 2026

  • CVE-2026-96765
    28İzleyin

    WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Stored Cross-Site Scripting via 'id_token' Parameter (iss / uniqu

    YüksekCVSS 7,2İstismar yokEPSS %0

    wpo365 · wpo365 | seamless wordpress + microsoft integration (wpo365 | login)10 Eki 2026

  • CVE-2026-107657
    28İzleyin

    HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form

    YüksekCVSS 7,2İstismar yokEPSS %0

    hivepress · hivepress – business directory, listings & classified ads plugin10 Eki 2026

  • CVE-2026-91136
    31İzleyin

    Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read via 'svg_image' Parameter

    YüksekCVSS 7,5Kavram kanıtıEPSS %1

    divi essential · divi plus10 Eki 2026

  • CVE-2026-103501
    39İzleyin

    Apache DataSketches: datasketches-cpp: HLL CouponList Deserialization Buffer Overflow allows memory corruption via a crafted sketch

    KritikCVSS 9,8İstismar yokEPSS %0

    apache software foundation · apache datasketches10 Eki 2026

  • CVE-2026-103513
    39İzleyin

    Apache DataSketches: datasketches-cpp: Out-of-bounds read and write in the CPC sketch deserialization allows memory corruption via a crafted sketch

    KritikCVSS 9,8İstismar yokEPSS %0

    apache software foundation · apache datasketches10 Eki 2026

  • CVE-2026-103635
    36İzleyin

    Apache DataSketches: datasketches-cpp: Out-of-bounds read in compact Theta sketch deserialization allows denial of service via a crafted sketch

    KritikCVSS 9,1İstismar yokEPSS %0

    apache software foundation · apache datasketches10 Eki 2026

  • CVE-2026-103636
    30İzleyin

    Apache DataSketches: datasketches-cpp: Out-of-bounds read in VarOpt union deserialization allows denial of service via a truncated sketch

    YüksekCVSS 7,5İstismar yokEPSS %0

    apache software foundation · apache datasketches10 Eki 2026

  • CVE-2013-10076
    30İzleyin

    ExtUtils::Typemaps::STL::Vector versions before 1.05 for Perl allocate a 32 GiB array on an empty list

    YüksekCVSS 7,5İstismar yokEPSS %0

    10 Eki 2026

  • CVE-2026-107373
    36İzleyin

    ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument

    KritikCVSS 9,1İstismar yokEPSS %0

    10 Eki 2026

  • CVE-2026-107794
    30İzleyin

    ExtUtils::Typemaps::STL::List versions before 1.07 for Perl allocate a 32 GiB array on an empty list

    YüksekCVSS 7,5İstismar yokEPSS %0

    10 Eki 2026

  • CVE-2026-102388
    28İzleyin

    WordPress Forminator plugin <= 1.57.3 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    wpmu dev · forminator10 Eki 2026

  • CVE-2026-105885
    35İzleyin

    WordPress Slider by 10Web plugin <= 1.2.62 - PHP Object Injection vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %0

    10web · slider by 10web10 Eki 2026

  • CVE-2026-108161
    30İzleyin

    FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download

    YüksekCVSS 7,7İstismar yokEPSS %1

    fusionpbx · fusionpbx10 Eki 2026

  • CVE-2026-108164
    28İzleyin

    Open Source Social Network (OSSN) through 10.1 IDOR via Message Attachment Route

    YüksekCVSS 7,1İstismar yokEPSS %0

    opensource-socialnetwork · opensource-socialnetwork10 Eki 2026

  • CVE-2026-94676
    28İzleyin

    WordPress Tainacan plugin <= 1.3.0 - PHP Object Injection vulnerability

    YüksekCVSS 7,2İstismar yokEPSS %0

    tainacan community · tainacan10 Eki 2026

  • CVE-2026-97263
    28İzleyin

    WordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    greg winiarski · wpadverts10 Eki 2026

  • CVE-2026-97264
    28İzleyin

    WordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    greg winiarski · wpadverts10 Eki 2026

  • CVE-2026-108545
    32İzleyin

    SillyTavern 1.12.13 through 1.19.0 Pre-Authentication Denial of Service via Body Parsing

    YüksekCVSS 8,2İstismar yokEPSS %0

    sillytavern · sillytavern10 Eki 2026