İçeriğe atla
Noroxi

Yayın tarihine göre

Ekim 2026: sömürülen ve yeni ciddi CVE kayıtları

6.381 kayıt · 12 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 22 / 64

  • CVE-2026-108710
    28İzleyin

    NornicDB through 1.4.1 Missing Authorization via Vector Search Endpoints

    YüksekCVSS 7,1İstismar yokEPSS %0

    orneryd · nornicdb11 Eki 2026

  • CVE-2026-108714
    34İzleyin

    MCP Kotlin SDK through 0.15.0 Memory Exhaustion via Application.mcpWebSocket

    YüksekCVSS 8,7İstismar yokEPSS %0

    modelcontextprotocol · kotlin-sdk11 Eki 2026

  • CVE-2026-108718
    34İzleyin

    Rill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration

    YüksekCVSS 8,6İstismar yokEPSS %0

    rill data · rill11 Eki 2026

  • CVE-2026-108728
    28İzleyin

    Flyte 2.0.1 through 2.0.51 Cleartext Secret Exposure via Admission Webhook

    YüksekCVSS 7,1İstismar yokEPSS %0

    flyteorg · flyte11 Eki 2026

  • CVE-2026-108729
    32İzleyin

    Corteza through 2024.9.10 Unauthenticated Attachment Access via Compose Attachment Endpoints

    YüksekCVSS 8,2İstismar yokEPSS %0

    cortezaproject · corteza11 Eki 2026

  • CVE-2026-108737
    30İzleyin

    Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusion

    YüksekCVSS 7,6İstismar yokEPSS %0

    traccar · traccar11 Eki 2026

  • CVE-2026-108739
    34İzleyin

    OpenAgents Workspace through launcher-v1.0.17 Unauthenticated Credential Exposure via /v1/workspaces

    YüksekCVSS 8,7İstismar yokEPSS %0

    openagents-org · openagents11 Eki 2026

  • CVE-2026-108740
    28İzleyin

    GoatCounter through 2.7.0 Privilege Escalation via /user/pref Mass Assignment

    YüksekCVSS 7,2İstismar yokEPSS %0

    arp242 · goatcounter11 Eki 2026

  • CVE-2026-108744
    29İzleyin

    pbi-cli 3.10.1 through 3.12.0 OS Command Injection via Desktop Sync

    YüksekCVSS 7,3İstismar yokEPSS %0

    minasaad1 · pbi-cli11 Eki 2026

  • CVE-2026-108746
    34İzleyin

    Vearch 3.5.2 through 3.5.9 Incorrect Authorization via Role.HasPermissionForResources

    YüksekCVSS 8,7İstismar yokEPSS %0

    vearch · vearch11 Eki 2026

  • CVE-2026-108753
    37İzleyin

    Agnaistic agnai through 1.0.555 Hard-Coded Credentials in self-host Docker Compose

    KritikCVSS 9,3İstismar yokEPSS %0

    agnaistic · agnai11 Eki 2026

  • CVE-2026-108757
    28İzleyin

    Nexting pinclaw through 0.3.0 Missing Authentication via POST /pinclaw/send

    YüksekCVSS 7,1İstismar yokEPSS %0

    nexting · pinclaw11 Eki 2026

  • CVE-2026-108758
    35İzleyin

    Easy!Appointments through 1.6.0 Authorization Bypass via booking/register Endpoint

    YüksekCVSS 8,8İstismar yokEPSS %0

    alextselegidis · easyappointments11 Eki 2026

  • CVE-2026-108759
    30İzleyin

    mistral.rs 0.9.0 through 0.9.4 Sandbox Escape via Symlink Following in mistralrs-code-exec

    YüksekCVSS 7,6İstismar yokEPSS %0

    ericlbuehler · mistral.rs11 Eki 2026

  • CVE-2026-108760
    28İzleyin

    LlamaFarm through 0.0.34 Unauthenticated API Exposed on All Interfaces

    YüksekCVSS 7,2İstismar yokEPSS %0

    llama-farm · llamafarm11 Eki 2026

  • CVE-2026-108698
    33İzleyin

    hyper-mcp through 0.8.3 OCI Plugin Signature Verification TOCTOU Race Condition

    YüksekCVSS 8,3İstismar yokEPSS %0

    hyper-mcp-rs · hyper-mcp11 Eki 2026

  • CVE-2026-108699
    33İzleyin

    hyper-mcp through 0.8.3 Improper Signature Verification of OCI WebAssembly Plugins

    YüksekCVSS 8,3İstismar yokEPSS %0

    hyper-mcp-rs · hyper-mcp11 Eki 2026

  • CVE-2026-108853
    28İzleyin

    UnicomAI Wanwu before 0.6.3 IDOR via DELETE /v1/appspace/app

    YüksekCVSS 7,2İstismar yokEPSS %0

    unicomai · wanwu11 Eki 2026

  • CVE-2026-108859
    34İzleyin

    mcp-go through 1.2.1 Denial of Service via Unbounded POST Body Buffering

    YüksekCVSS 8,7İstismar yokEPSS %0

    mark3labs · mcp-go11 Eki 2026

  • CVE-2026-108860
    37İzleyin

    BotSharp through 5.2.0 Authentication Bypass via Hard-Coded JWT Signing Key

    KritikCVSS 9,3İstismar yokEPSS %0

    scisharp · botsharp11 Eki 2026

  • CVE-2026-108863
    34İzleyin

    Katanemo Plano through 0.4.37 Missing Authentication on Envoy Admin Interface

    YüksekCVSS 8,7İstismar yokEPSS %0

    katanemo · plano11 Eki 2026

  • CVE-2026-108865
    35İzleyin

    AmoyLab Unla through 0.10.0 OAuth2 Authentication Bypass via /authorize

    YüksekCVSS 8,8İstismar yokEPSS %0

    amoylab · unla11 Eki 2026

  • CVE-2026-108883
    28İzleyin

    JeecgBoot through 3.9.5 Missing Authorization via /sys/thirdApp/editThirdAppConfig

    YüksekCVSS 7,1İstismar yokEPSS %0

    jeecgboot · jeecgboot11 Eki 2026

  • CVE-2026-108902
    28İzleyin

    pH7Builder before 18.5.0 Path Traversal Arbitrary File Deletion via picture_link

    YüksekCVSS 7,2İstismar yokEPSS %0

    ph7software · ph7builder11 Eki 2026

  • CVE-2026-108904
    28İzleyin

    pH7Builder before 18.5.0 Sensitive Data Exposure via Member API UserController

    YüksekCVSS 7,1İstismar yokEPSS %0

    ph7software · ph7builder11 Eki 2026

  • CVE-2026-108905
    34İzleyin

    pH7Builder before 18.6.0 Hard-Coded API Key Bypass via Host Header

    YüksekCVSS 8,7İstismar yokEPSS %0

    ph7software · ph7builder11 Eki 2026

  • CVE-2026-108913
    28İzleyin

    omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ~/.local/state/omarc

    YüksekCVSS 7,1İstismar yokEPSS %0

    omarchy · omarchy11 Eki 2026

  • CVE-2026-19577
    28İzleyin

    Out-of-bounds read in IPv6 route forwarding when the nexthop neighbor has no link-layer address

    YüksekCVSS 7,1İstismar yokEPSS %0

    zephyrproject · zephyr11 Eki 2026

  • CVE-2026-19669
    31İzleyin

    Unbounded variable-length array in fuel gauge syscall verifiers allows kernel stack overflow from user mode

    YüksekCVSS 7,8İstismar yokEPSS %0

    zephyrproject · zephyr11 Eki 2026

  • CVE-2026-19736
    31İzleyin

    Out-of-bounds write in the NXP MCUX TRNG entropy driver for non-word-multiple request lengths

    YüksekCVSS 7,8İstismar yokEPSS %0

    zephyrproject · zephyr11 Eki 2026

  • CVE-2026-19935
    30İzleyin

    Use-after-free of an L2CAP CoC channel object in the Zephyr Bluetooth host: RX work item is not cancelled on channel teardown

    YüksekCVSS 7,5İstismar yokEPSS %0

    zephyrproject · zephyr11 Eki 2026

  • CVE-2026-108963
    36İzleyin

    databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can b

    YüksekCVSS 8,8İstismar yokEPSS %1

    david-crty · databasement11 Eki 2026

  • CVE-2026-108976
    31İzleyin

    GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list

    YüksekCVSS 7,8İstismar yokEPSS %0

    gnu · emacs11 Eki 2026

  • CVE-2026-108980
    35İzleyin

    Blinko through 1.8.8 allows directory traversal, overwriting startup files as root, via installPlugin.

    YüksekCVSS 8,8İstismar yokEPSS %1

    blinko · blinko12 Eki 2026

  • CVE-2026-66086
    39İzleyin

    Stack-based Buffer Overflow in Modem

    KritikCVSS 9,8İstismar yokEPSS %0

    unisoc (shanghai) technologies co., ltd. · modem12 Eki 2026

  • CVE-2026-108982
    28İzleyin

    VeraCrypt 1.26.29 (FUSE-T build) on macOS sometimes allows unintended access to decrypted data.

    YüksekCVSS 7,2İstismar yokEPSS %0

    idrix · veracrypt12 Eki 2026

  • CVE-2026-108985
    28İzleyin

    ZDR decoding in libnfs through 6.0.2 before 7613236 has an out-of-bounds write related to lib/libnfs-zdr.c with libnfs_zdr_bytes(), libnfs_z

    YüksekCVSS 7,1İstismar yokEPSS %0

    sahlberg · libnfs12 Eki 2026

  • CVE-2026-21114
    28İzleyin

    Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code.

    YüksekCVSS 7,0İstismar yokEPSS %0

    samsung mobile · samsung mobile devices12 Eki 2026

  • CVE-2026-21120
    35İzleyin

    Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code with system privi

    YüksekCVSS 8,9İstismar yokEPSS %0

    samsung mobile · samsung mobile devices12 Eki 2026

  • CVE-2026-21122
    28İzleyin

    Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code.

    YüksekCVSS 7,0İstismar yokEPSS %0

    samsung mobile · samsung mobile devices12 Eki 2026

  • CVE-2026-21124
    34İzleyin

    Improper input validation in getting cover image in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers

    YüksekCVSS 8,6İstismar yokEPSS %0

    samsung mobile · samsung mobile devices12 Eki 2026

  • CVE-2026-21125
    34İzleyin

    Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to p

    YüksekCVSS 8,6İstismar yokEPSS %0

    samsung mobile · samsung mobile devices12 Eki 2026

  • CVE-2026-21139
    29İzleyin

    Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the co

    YüksekCVSS 7,3İstismar yokEPSS %0

    samsung mobile · samsung continuity service for windows12 Eki 2026

  • CVE-2026-87690
    35İzleyin

    Metasploit Framework ios_image_gather Path Traversal Leading to Arbitrary File Write and Code Execution

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    rapid7 · metasploit framework12 Eki 2026

  • CVE-2026-108804
    38İzleyin

    TRENDnet TEW-751DR/TEW-752DRU/TEW733GR Web Management Backend pigwidgeon.cgi fwrite os command injection

    KritikCVSS 9,3İstismar yokEPSS %2

    trendnet · tew-751dr12 Eki 2026

  • CVE-2026-109080
    28İzleyin

    SQL injection in Night Shift bulk license plate search allows cross-organization data access

    YüksekCVSS 7,1İstismar yokEPSS %0

    flock · night shift12 Eki 2026

  • CVE-2026-98385
    0İzleyin

    sched/cache: Decouple sched_cache_group from mm to fix UAF

    Kavram kanıtıEPSS %0

    linux · linux12 Eki 2026

  • CVE-2026-78355
    34İzleyin

    Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directory

    YüksekCVSS 8,7İstismar yokEPSS %0

    otrs gmbh (former otrs ag) · otrs12 Eki 2026

  • CVE-2026-78357
    36İzleyin

    Insufficient Session Revocation for JWT Authentication

    KritikCVSS 9,1İstismar yokEPSS %0

    otrs gmbh (former otrs ag) · otrs12 Eki 2026

  • CVE-2026-93582
    37İzleyin

    Authentication Bypass via Spoofed Remote-User Header in HTTP Basic Authentication

    KritikCVSS 9,4İstismar yokEPSS %0

    otrs gmbh (former otrs ag) · otrs12 Eki 2026

  • CVE-2026-1907
    30İzleyin

    SQL Injection in Clustering Communication (Hybrid Mode)

    YüksekCVSS 7,5İstismar yokEPSS %0

    kong · kong enterprise gateway12 Eki 2026

  • CVE-2026-103902
    30İzleyin

    DigiDoc improper signature verification

    YüksekCVSS 7,5İstismar yokEPSS %0

    digidoc · libdigidocpp12 Eki 2026

  • CVE-2026-103903
    34İzleyin

    MikroTik RouterOS WinBox split-principal authentication bypass allows privilege escalation

    YüksekCVSS 8,7İstismar yokEPSS %0

    mikrotik · routeros12 Eki 2026

  • CVE-2026-105407
    36İzleyin

    OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5

    YüksekCVSS 8,8İstismar yokEPSS %1

    dassault systèmes · tuleap enterprise edition12 Eki 2026

  • CVE-2026-105408
    34İzleyin

    Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5

    YüksekCVSS 8,7İstismar yokEPSS %0

    dassault systèmes · tuleap enterprise edition12 Eki 2026

  • CVE-2026-105409
    34İzleyin

    Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5

    YüksekCVSS 8,7İstismar yokEPSS %0

    dassault systèmes · tuleap enterprise edition12 Eki 2026

  • CVE-2026-105410
    34İzleyin

    Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5

    YüksekCVSS 8,7İstismar yokEPSS %0

    dassault systèmes · tuleap enterprise edition12 Eki 2026

  • CVE-2026-105411
    32İzleyin

    Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5

    YüksekCVSS 8,1İstismar yokEPSS %0

    dassault systèmes · tuleap enterprise edition12 Eki 2026

  • CVE-2026-105412
    28İzleyin

    SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5

    YüksekCVSS 7,1İstismar yokEPSS %0

    dassault systèmes · tuleap enterprise edition12 Eki 2026

  • CVE-2026-85499
    36İzleyin

    Apache SkyWalking BanyanDB: Canopy does not enforce readonly-role restrictions on the /monitoring/* proxy

    KritikCVSS 9,1İstismar yokEPSS %0

    apache software foundation · apache skywalking banyandb12 Eki 2026

  • CVE-2026-108951
    28İzleyin

    LavaLite CMS through 10.1.2 Authorization Bypass via User Update API

    YüksekCVSS 7,1İstismar yokEPSS %0

    lavalite · cms12 Eki 2026

  • CVE-2026-108953
    34İzleyin

    mac-shell-mcp before 2.0.0 OS Command Injection via execute_command Arguments

    YüksekCVSS 8,5İstismar yokEPSS %0

    cfdude · mac-shell-mcp12 Eki 2026

  • CVE-2026-109164
    28İzleyin

    TDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey}

    YüksekCVSS 7,1İstismar yokEPSS %0

    tduckcloud · tduck-survey-form12 Eki 2026

  • CVE-2026-109166
    28İzleyin

    lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById

    YüksekCVSS 7,1İstismar yokEPSS %0

    dromara · lamp-cloud12 Eki 2026

  • CVE-2026-109168
    28İzleyin

    lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId

    YüksekCVSS 7,1İstismar yokEPSS %0

    dromara · lamp-cloud12 Eki 2026

  • CVE-2026-109174
    28İzleyin

    MoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfig

    YüksekCVSS 7,1İstismar yokEPSS %0

    moxi624 · mogublog12 Eki 2026

  • CVE-2026-109185
    34İzleyin

    jshERP through 3.6 Privilege Escalation via PUT /user/updateUser

    YüksekCVSS 8,7İstismar yokEPSS %0

    jishenghua · jsherp12 Eki 2026

  • CVE-2026-109186
    34İzleyin

    jshERP through 3.6 Mass Assignment via PUT /user/update

    YüksekCVSS 8,7İstismar yokEPSS %0

    jishenghua · jsherp12 Eki 2026

  • CVE-2026-109187
    28İzleyin

    jshERP through 3.6 Information Disclosure via /platformConfig/getInfoByKey

    YüksekCVSS 7,1İstismar yokEPSS %0

    jishenghua · jsherp12 Eki 2026

  • CVE-2026-52903
    35İzleyin

    YAML safe_load production fallback to unsafe_load enables RCE via deserialization

    YüksekCVSS 8,8İstismar yokEPSS %0

    manageiq · manageiq12 Eki 2026

  • CVE-2026-93695
    29İzleyin

    Arbitrary file write through remote file identifiers in Progress ShareFile Storage Zones Controller FileCopyService

    YüksekCVSS 7,4İstismar yokEPSS %0

    progress · sharefile storage zones controller12 Eki 2026

  • CVE-2026-108892
    37İzleyin

    Linksys E1700 Mac Filter ssid1MACFilter stack-based overflow

    KritikCVSS 9,3İstismar yokEPSS %0

    linksys · e170012 Eki 2026

  • CVE-2026-108893
    34İzleyin

    Linksys E1700 setVlan stack-based overflow

    YüksekCVSS 8,6İstismar yokEPSS %0

    linksys · e170012 Eki 2026

  • CVE-2026-108894
    35İzleyin

    Linksys E1700 Static Route addStaticRoute os command injection

    YüksekCVSS 8,6İstismar yokEPSS %2

    linksys · e170012 Eki 2026

  • CVE-2026-109169
    28İzleyin

    LogicalDOC Community Edition through 9.3 SQL Injection via tags.xml firstLetter

    YüksekCVSS 7,1İstismar yokEPSS %0

    logicaldoc · logicaldoc community edition12 Eki 2026

  • CVE-2026-109170
    28İzleyin

    LogicalDOC Community Edition through 9.3 HQL Injection via documents.xml indexed Parameter

    YüksekCVSS 7,1İstismar yokEPSS %0

    logicaldoc · logicaldoc community edition12 Eki 2026

  • CVE-2026-109199
    34İzleyin

    LogicalDOC Community Edition through 9.3 Code Injection via Velocity sendAsEmail Template

    YüksekCVSS 8,7İstismar yokEPSS %0

    logicaldoc · logicaldoc community edition12 Eki 2026

  • CVE-2026-109201
    34İzleyin

    LogicalDOC Community Edition through 9.3 Missing Authorization in DocumentService

    YüksekCVSS 8,7İstismar yokEPSS %0

    logicaldoc · logicaldoc community edition12 Eki 2026

  • CVE-2026-109202
    28İzleyin

    LogicalDOC Community Edition through 9.3 Missing Authorization via zip-export Servlet

    YüksekCVSS 7,1İstismar yokEPSS %0

    logicaldoc · logicaldoc community edition12 Eki 2026

  • CVE-2026-109203
    28İzleyin

    LogicalDOC Community Edition through 9.3 Missing Authorization via ConvertPdf Servlet

    YüksekCVSS 7,1İstismar yokEPSS %0

    logicaldoc · logicaldoc community edition12 Eki 2026

  • CVE-2026-109205
    34İzleyin

    LogicalDOC Community Edition through 9.3 Unauthenticated Upload Disk Exhaustion via UploadServlet

    YüksekCVSS 8,7İstismar yokEPSS %0

    logicaldoc · logicaldoc community edition12 Eki 2026

  • CVE-2026-109225
    34İzleyin

    SGLang through 0.5.21 Memory Exhaustion DoS via /v1/audio/transcriptions Upload

    YüksekCVSS 8,7İstismar yokEPSS %0

    sgl-project · sglang12 Eki 2026

  • CVE-2026-109226
    34İzleyin

    SGLang through 0.5.21 Audio Decompression Amplification via load_audio

    YüksekCVSS 8,7İstismar yokEPSS %0

    sgl-project · sglang12 Eki 2026

  • CVE-2026-109227
    34İzleyin

    SGLang through 0.5.21 Memory Exhaustion DoS via Qwen-VL Video Preprocessing

    YüksekCVSS 8,7İstismar yokEPSS %0

    sgl-project · sglang12 Eki 2026

  • CVE-2026-109228
    34İzleyin

    SGLang through 0.5.21 Resource Budget Bypass via GLM-V Video Parameters

    YüksekCVSS 8,7İstismar yokEPSS %0

    sgl-project · sglang12 Eki 2026

  • CVE-2026-109229
    34İzleyin

    SGLang through 0.5.21 Decompression Bomb DoS via NanoNemotronVLImageProcessor

    YüksekCVSS 8,7İstismar yokEPSS %0

    sgl-project · sglang12 Eki 2026

  • CVE-2026-12613
    35İzleyin

    Insecure Deserialization Leading to Remote Code Execution in Ministry of Justice's UYAP Document Editor

    YüksekCVSS 8,8İstismar yokEPSS %0

    ministry of justice general directorate of information technology · uyap document editor12 Eki 2026

  • CVE-2026-18390
    31İzleyin

    Command Injection in Ministry of Justice's UYAP Document Editor

    YüksekCVSS 7,8İstismar yokEPSS %0

    ministry of justice general directorate of information technology · uyap document editor12 Eki 2026

  • CVE-2026-103521
    28İzleyin

    In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does no

    YüksekCVSS 7,2İstismar yokEPSS %0

    thelia · thelia12 Eki 2026

  • CVE-2026-103522
    28İzleyin

    In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME

    YüksekCVSS 7,2İstismar yokEPSS %0

    thelia · thelia12 Eki 2026

  • CVE-2026-103535
    35İzleyin

    Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote

    YüksekCVSS 8,8İstismar yokEPSS %1

    thelia · thelia12 Eki 2026

  • CVE-2026-108094
    31İzleyin

    Mutter: mutter: client-triggered use-after-free in wayland color-management icc image description path

    YüksekCVSS 7,8İstismar yokEPSS %0

    red hat · red hat enterprise linux 1012 Eki 2026

  • CVE-2026-108895
    35İzleyin

    Linksys E1700 setDMZ os command injection

    YüksekCVSS 8,6İstismar yokEPSS %2

    linksys · e170012 Eki 2026

  • CVE-2026-108896
    35İzleyin

    Linksys E1700 setLinksysIpv6 os command injection

    YüksekCVSS 8,6İstismar yokEPSS %2

    linksys · e170012 Eki 2026

  • CVE-2026-109390
    39İzleyin

    AnyDesk before 8.0.3 allows unauthenticated remote attackers to execute arbitrary code via a heap-based buffer overflow, as demonstrated on

    KritikCVSS 9,8İstismar yokEPSS %1

    anydesk · anydesk12 Eki 2026

  • CVE-2026-92877
    33İzleyin

    The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution.

    YüksekCVSS 8,3İstismar yokEPSS %0

    eclipse foundation · jaxb-ri (core)12 Eki 2026

  • CVE-2026-103060
    30İzleyin

    Path traversal in rebar3 via unvalidated dependency app names

    YüksekCVSS 7,5İstismar yokEPSS %0

    erlang · rebar312 Eki 2026

  • CVE-2026-105668
    28İzleyin

    Hex release-age cooldown is lifted package-wide when the locked release is retired

    YüksekCVSS 7,1İstismar yokEPSS %0

    hexpm · hex12 Eki 2026

  • CVE-2026-107248
    35İzleyin

    Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection (SSTI) flaw that allows any authenticated user w

    YüksekCVSS 8,8İstismar yokEPSS %0

    thelia · thelia12 Eki 2026

  • CVE-2026-108906
    29İzleyin

    Netcore NR268 filter_arp_put_file.cgi filter_arp_put_file_cgi out-of-bounds

    YüksekCVSS 7,3İstismar yokEPSS %0

    netcore · nr26812 Eki 2026

Ekim 2026: sömürülen ve yeni ciddi CVE kayıtları · sayfa 22 — Noroxi