Yayın tarihine göre

Ekim 2026: sömürülen ve yeni ciddi CVE kayıtları

8.324 kayıt · 20 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 27 / 84

CVE kayıtları
Aksiyon	CVE	Zafiyet	Ciddiyet	KEV	EPSS	Yayın
33İzleyin	CVE-2026-109965İstismar yok	Serena before 2.0.0 Symlink Following in File Tools Allows Access Outside Project Rootoraios · serena · CWE-59	Yüksek8,4	—	%0,2	13 Eki 2026
34İzleyin	CVE-2026-109967İstismar yok	yt-dlp-web-ui through 4.0.0 NULL Pointer Dereference DoS via Service.Formatsmarcopiovanello · yt-dlp-web-ui · CWE-476 Kimlik doğrulamasız Bellek hatası	Yüksek8,7	—	%0,5	13 Eki 2026
28İzleyin	CVE-2026-74031İstismar yok	Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helperswazuh · wazuh-manager · CWE-22 Yol geçişi	Yüksek7,0	—	%0,5	13 Eki 2026
33İzleyin	CVE-2026-74033İstismar yok	Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlerswazuh · wazuh-manager · CWE-22 Yol geçişi	Yüksek8,4	—	%0,3	13 Eki 2026
34İzleyin	CVE-2026-74034Kavram kanıtı	Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Commandwazuh · wazuh-manager · CWE-862 Kimlik doğrulamasız Erişim denetimi (IDOR)	Yüksek8,7	—	%0,4	13 Eki 2026
34İzleyin	CVE-2026-74035İstismar yok	Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_userwazuh · wazuh-manager · CWE-863 Kimlik doğrulama atlatma Erişim denetimi (IDOR)	Yüksek8,6	—	%0,6	13 Eki 2026
34İzleyin	CVE-2026-74036İstismar yok	Wazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policieswazuh · wazuh-agent · CWE-863 RCE Erişim denetimi (IDOR)	Yüksek8,6	—	%0,8	13 Eki 2026
34İzleyin	CVE-2026-74037İstismar yok	Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_tokenwazuh · wazuh-manager · CWE-613	Yüksek8,6	—	%0,4	13 Eki 2026
37İzleyin	CVE-2026-74040İstismar yok	Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_workerwazuh · wazuh-manager · CWE-862 RCE Erişim denetimi (IDOR)	Kritik9,4	—	%0,7	13 Eki 2026
34İzleyin	CVE-2026-74041İstismar yok	Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatchwazuh · wazuh-manager · CWE-178	Yüksek8,6	—	%0,4	13 Eki 2026
34İzleyin	CVE-2026-74043İstismar yok	Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functionswazuh · wazuh-manager · CWE-22 Yol geçişi	Yüksek8,5	—	%0,4	13 Eki 2026
28İzleyin	CVE-2026-74045İstismar yok	Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoderwazuh · wazuh-manager · CWE-122 Bellek hatası	Yüksek7,1	—	%0,3	13 Eki 2026
28İzleyin	CVE-2026-74047İstismar yok	Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpointwazuh · wazuh-manager · CWE-200 Bilgi sızıntısı	Yüksek7,1	—	%0,3	13 Eki 2026
32İzleyin	CVE-2026-93907İstismar yok	IBM WebSphere Application Server is affected by a bypass authentication vulnerabilityibm · websphere application server · CWE-287 Kimlik doğrulamasız Kimlik doğrulama atlatma	Yüksek8,1	—	%0,3	13 Eki 2026
32İzleyin	CVE-2026-95680İstismar yok	IBM WebSphere Application Server is affected by an authorization bypassibm · websphere application server · CWE-287 Kimlik doğrulama atlatma	Yüksek8,0	—	%0,1	13 Eki 2026
34İzleyin	CVE-2026-102250İstismar yok	CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authoschneider electric · sage rtu 1410 · CWE-345	Yüksek8,6	—	%0,1	13 Eki 2026
38İzleyin	CVE-2026-104192İstismar yok	DragonflyDB stream RDB deserialization double-freedragonflydb · dragonfly · CWE-415 Kimlik doğrulamasız Deserializasyon Bellek hatası	Kritik9,6	—	%0,2	13 Eki 2026
36İzleyin	CVE-2026-107460İstismar yok	Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebindingapache software foundation · apache fesod (incubating) · CWE-918 Kimlik doğrulamasız SSRF	Kritik9,1	—	%0,4	13 Eki 2026
29İzleyin	CVE-2026-108184İstismar yok	Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure vzoom communications · zoom clients · CWE-295 Kimlik doğrulamasız Zayıf kripto	Yüksek7,4	—	%0,2	13 Eki 2026
29İzleyin	CVE-2026-108185İstismar yok	Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information zoom communications · zoom clients · CWE-295 Kimlik doğrulamasız Zayıf kripto	Yüksek7,4	—	%0,2	13 Eki 2026
35İzleyin	CVE-2026-12655İstismar yok	1732E ArmorBlock® - Multiple Vulnerabilitiesrockwell automation · 1732e armorblock® i/o · CWE-294 Kimlik doğrulamasız Kimlik doğrulama atlatma	Yüksek8,8	—	%0,2	13 Eki 2026
34İzleyin	CVE-2026-12656İstismar yok	1732E ArmorBlock® - Multiple Vulnerabilitiesrockwell automation · 1732e armorblock® i/o · CWE-770 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek8,7	—	%0,2	13 Eki 2026
28İzleyin	CVE-2026-18228İstismar yok	Hyperscale Path Traversalcommvault · commvault cloud · CWE-22 Yol geçişi	Yüksek7,1	—	%0,3	13 Eki 2026
32İzleyin	CVE-2026-53418İstismar yok	Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated userzoom communications · zoom workplace · CWE-939	Yüksek8,1	—	%0,3	13 Eki 2026
32İzleyin	CVE-2026-53420İstismar yok	Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege viazoom communications · zoom workplace · CWE-120 Bellek hatası	Yüksek8,0	—	%0,3	13 Eki 2026
39İzleyin	CVE-2026-53709İstismar yok	MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgeryibm · mcp-context-forge · CWE-287 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,8	—	%0,6	13 Eki 2026
34İzleyin	CVE-2026-65198İstismar yok	Huawei Default SNMPv3 USM keyhuawei · openubmc · CWE-321 Kimlik doğrulamasız Gömülü kimlik bilgisi	Yüksek8,6	—	%0,1	13 Eki 2026
34İzleyin	CVE-2026-77090İstismar yok	CVFS Information Disclosurecommvault · commvault cloud · CWE-611 Kimlik doğrulamasız XXE	Yüksek8,7	—	%0,3	13 Eki 2026
28İzleyin	CVE-2026-77093İstismar yok	CvFWD Denial of Servicecommvault · commvault cloud · CWE-190 Bellek hatası	Yüksek7,1	—	%0,2	13 Eki 2026
28İzleyin	CVE-2026-77094İstismar yok	CvFWD Out-of-Bounds Writecommvault · commvault cloud · CWE-787 Bellek hatası	Yüksek7,1	—	%0,2	13 Eki 2026
28İzleyin	CVE-2026-77095İstismar yok	CvFWD Null Pointer Dereferencecommvault · commvault cloud · CWE-476 Bellek hatası	Yüksek7,1	—	%0,2	13 Eki 2026
30İzleyin	CVE-2026-77096İstismar yok	CVFS Missing Authenticationcommvault · commvault cloud · CWE-306 Girişsiz RCE Kimlik doğrulama atlatma	Yüksek7,7	—	%0,2	13 Eki 2026
37İzleyin	CVE-2026-77099İstismar yok	CVFS Command Executioncommvault · commvault cloud · CWE-78 Girişsiz RCE Komut enjeksiyonu	Kritik9,3	—	%0,3	13 Eki 2026
34İzleyin	CVE-2026-77100İstismar yok	MediaAgent Denial of Servicecommvault · commvault cloud · CWE-122 Kimlik doğrulamasız Bellek hatası	Yüksek8,7	—	%0,3	13 Eki 2026
30İzleyin	CVE-2026-95114İstismar yok	libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c.CWE-125 Kimlik doğrulamasız Bellek hatası Hizmet dışı bırakma	Yüksek7,5	—	%0,5	13 Eki 2026
30İzleyin	CVE-2026-95115İstismar yok	Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parserCWE-787 Kimlik doğrulamasız Bellek hatası Hizmet dışı bırakma	Yüksek7,5	—	%0,5	13 Eki 2026
31İzleyin	CVE-2026-95121İstismar yok	An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4RtpAtom::ReadHntiType() in src/atom_rtp.cpp.CWE-190 RCE Bellek hatası	Yüksek7,8	—	%0,2	13 Eki 2026
30İzleyin	CVE-2026-95122İstismar yok	mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp.CWE-476 Kimlik doğrulamasız Bellek hatası Hizmet dışı bırakma	Yüksek7,5	—	%0,5	13 Eki 2026
30İzleyin	CVE-2026-95124İstismar yok	Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size CWE-120 Kimlik doğrulamasız Bellek hatası Hizmet dışı bırakma	Yüksek7,5	—	%0,5	13 Eki 2026
30İzleyin	CVE-2026-95127İstismar yok	An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.cCWE-400 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek7,5	—	%0,4	13 Eki 2026
28İzleyin	CVE-2026-97333İstismar yok	QAPI stack-based buffer overflowcommvault · commvault cloud · CWE-121 Bellek hatası	Yüksek7,1	—	%0,2	13 Eki 2026
34İzleyin	CVE-2026-97334İstismar yok	Network messaging layer decompression resource exhaustioncommvault · commvault cloud · CWE-409 Kimlik doğrulamasız	Yüksek8,7	—	%0,3	13 Eki 2026
39İzleyin	CVE-2024-34320İstismar yok	ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.CWE-284 Kimlik doğrulamasız Erişim denetimi (IDOR)	Kritik9,8	—	%0,3	13 Eki 2026
40Planlayın	CVE-2024-34323İstismar yok	ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter.CWE-639 Kimlik doğrulamasız Erişim denetimi (IDOR)	Kritik10,0	—	%0,3	13 Eki 2026
36İzleyin	CVE-2024-34324İstismar yok	An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character CWE-384 Kimlik doğrulamasız	Kritik9,1	—	%0,2	13 Eki 2026
30İzleyin	CVE-2026-102699İstismar yok	Arm: multiple issues with GNTTABOP_cache_flushxen · xen · CWE-191 Kimlik doğrulamasız Bellek hatası Hizmet dışı bırakma	Yüksek7,5	—	%0,2	13 Eki 2026
30İzleyin	CVE-2026-102702İstismar yok	Arm: multiple issues with GNTTABOP_cache_flushxen · xen · CWE-191 Kimlik doğrulamasız Bellek hatası Hizmet dışı bırakma	Yüksek7,5	—	%0,2	13 Eki 2026
34İzleyin	CVE-2026-102982İstismar yok	Plane: XSS in work item commentsmakeplane · plane · CWE-79 XSS	Yüksek8,5	—	%0,3	13 Eki 2026
37İzleyin	CVE-2026-103928İstismar yok	Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functionsmetabase · metabase · CWE-73 Kimlik doğrulamasız Yol geçişi	Kritik9,3	—	%0,4	13 Eki 2026
28İzleyin	CVE-2026-104004İstismar yok	Collection validators using collation-accepting expressions can crash MongoDB Server on insertmongodb · mongodb server · CWE-476 Bellek hatası	Yüksek7,1	—	%0,2	13 Eki 2026
28İzleyin	CVE-2026-104005İstismar yok	Incorrect authorization in MongoDB Server router for bulk writes to system namespacesmongodb · mongodb server · CWE-617	Yüksek7,1	—	%0,2	13 Eki 2026
90Hemen	CVE-2026-104935Silahlaştırılmış	Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.ivanti · connect secure · CWE-290 Girişsiz RCE Kimlik doğrulama atlatma	Yüksek8,6	KEV	%86,7	13 Eki 2026
27İzleyin	CVE-2026-110025Kavram kanıtı	slackero phpwcms Extension Check cnt23.article.inc.php unrestricted uploadslackero · phpwcms · CWE-284 Kimlik doğrulamasız Dosya yükleme Erişim denetimi (IDOR)	Orta6,9	—	%0,3	13 Eki 2026
35İzleyin	CVE-2026-55376İstismar yok	heym Python Tool Sandbox Escapeheymrun · heym · CWE-78 RCE Komut enjeksiyonu	Yüksek8,8	—	%0,4	13 Eki 2026
40Planlayın	CVE-2026-55675İstismar yok	Salty documentation workflow executes fork-controlled Python build hooks with deployment secretssaltyorg · docs · CWE-94 Girişsiz RCE	Kritik10,0	—	%0,4	13 Eki 2026
36İzleyin	CVE-2026-55695İstismar yok	FearlessCMS: Remote Code Execution via Unvalidated Update Repository URL in System Updaterfearlessgeekmedia · fearlesscms · CWE-94 RCE	Kritik9,1	—	%0,4	13 Eki 2026
39İzleyin	CVE-2026-78802İstismar yok	An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrarCWE-94 Girişsiz RCE	Kritik9,8	—	%0,5	13 Eki 2026
39İzleyin	CVE-2026-79608İstismar yok	x86/AMD: ineffectual Zenbleed workaroundxen · xen · CWE-670 Kimlik doğrulamasız	Kritik9,8	—	%0,3	13 Eki 2026
35İzleyin	CVE-2026-79609İstismar yok	x86: XPTI may break on huge-memory systemsxen · xen · CWE-284 Erişim denetimi (IDOR)	Yüksek8,8	—	%0,1	13 Eki 2026
35İzleyin	CVE-2026-79610İstismar yok	grant-table: double version change racexen · xen · CWE-362 Yarış durumu	Yüksek8,8	—	%0,1	13 Eki 2026
28İzleyin	CVE-2026-96299İstismar yok	Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Servicemongodb · mongodb server · CWE-617	Yüksek7,1	—	%0,2	13 Eki 2026
37İzleyin	CVE-2026-102989İstismar yok	TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responsestanstack · router · CWE-79 Kimlik doğrulamasız XSS	Kritik9,3	—	%0,5	13 Eki 2026
30İzleyin	CVE-2026-103030İstismar yok	Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`cfug · dio · CWE-200 Kimlik doğrulamasız Bilgi sızıntısı	Yüksek7,5	—	%0,3	13 Eki 2026
39İzleyin	CVE-2026-106042İstismar yok	An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to rivanti · xtraction · CWE-73 Yol geçişi	Kritik9,9	—	%0,7	13 Eki 2026
30İzleyin	CVE-2026-106043İstismar yok	A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attacivanti · xtraction · CWE-306 Kimlik doğrulamasız Kimlik doğrulama atlatma	Yüksek7,5	—	%0,6	13 Eki 2026
30İzleyin	CVE-2026-106047İstismar yok	A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated ivanti · xtraction · CWE-22 Yol geçişi	Yüksek7,7	—	%0,7	13 Eki 2026
39İzleyin	CVE-2026-109412İstismar yok	An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication infivanti · neurons patch for intune · CWE-749	Kritik9,9	—	%0,8	13 Eki 2026
34İzleyin	CVE-2026-110097İstismar yok	Ikaros 1.2.0 through 1.2.5 TOTP Authentication Bypass via Temp Tokenikaros-dev · ikaros · CWE-287 Kimlik doğrulama atlatma	Yüksek8,6	—	%0,5	13 Eki 2026
30İzleyin	CVE-2026-110102İstismar yok	powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installerromkatv · powerlevel10k · CWE-494 Kimlik doğrulamasız	Yüksek7,7	—	%0,1	13 Eki 2026
32İzleyin	CVE-2026-110104İstismar yok	novel through 3.5.0 Unsalted MD5 Password Storagexxyopen · novel · CWE-916 Kimlik doğrulamasız	Yüksek8,2	—	%0,2	13 Eki 2026
34İzleyin	CVE-2026-110108İstismar yok	MateCloud through 5.0.8 Missing Authorization via /api/v1/admin/storage APImateaix · matecloud · CWE-862 Erişim denetimi (IDOR)	Yüksek8,6	—	%0,3	13 Eki 2026
28İzleyin	CVE-2026-110109İstismar yok	JetLinks Community through 2.10.0 Missing Authorization via Product-Level Transparent Codec Savejetlinks · jetlinks community · CWE-862 RCE Erişim denetimi (IDOR)	Yüksek7,1	—	%0,2	13 Eki 2026
34İzleyin	CVE-2026-110115İstismar yok	Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager retrieveFileStreamrisesoft-y9 · digital-infrastructure · CWE-22 Kimlik doğrulamasız Yol geçişi	Yüksek8,7	—	%0,4	13 Eki 2026
35İzleyin	CVE-2026-110116İstismar yok	Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager storeFilerisesoft-y9 · digital-infrastructure · CWE-22 Kimlik doğrulamasız Yol geçişi	Yüksek8,8	—	%0,5	13 Eki 2026
28İzleyin	CVE-2026-110117İstismar yok	SmartAdmin through 3.30.0 Missing Authorization via AdminProtectController1024-lab · smartadmin · CWE-862 Erişim denetimi (IDOR)	Yüksek7,1	—	%0,2	13 Eki 2026
28İzleyin	CVE-2026-110118İstismar yok	WorkFlow-Engine through 9.6.11 Missing Authorization via flowableui buttonOperation Endpointsrisesoft-y9 · workflow-engine · CWE-639 Erişim denetimi (IDOR)	Yüksek7,1	—	%0,2	13 Eki 2026
28İzleyin	CVE-2026-110119İstismar yok	yshopmall through 2.0.0 IDOR via Member Address API in UserAddressControllerguchengwuyue · yshopmall · CWE-639 Erişim denetimi (IDOR)	Yüksek7,1	—	%0,3	13 Eki 2026
28İzleyin	CVE-2026-110121İstismar yok	PickMall lilishop through 4.4 IDOR via Goods Edit Endpointpickmall · lilishop · CWE-639 Erişim denetimi (IDOR)	Yüksek7,1	—	%0,2	13 Eki 2026
28İzleyin	CVE-2026-110123İstismar yok	Makunet maku-boot 4.3.0 through 5.0.0 Missing Authorization via Mail and SMS Config Endpointsmakunet · maku-boot · CWE-862 Erişim denetimi (IDOR)	Yüksek7,1	—	%0,2	13 Eki 2026
34İzleyin	CVE-2026-110124İstismar yok	FastBee through 2.1.0 IDOR via DeviceController /iot/device Endpointskerwincui · fastbee · CWE-639 Erişim denetimi (IDOR)	Yüksek8,6	—	%0,3	13 Eki 2026
34İzleyin	CVE-2026-110128İstismar yok	fuint through commit 4c4bc8a Missing Authentication via /clientApi/order/detailfushengqian · fuint · CWE-306 Kimlik doğrulamasız Kimlik doğrulama atlatma	Yüksek8,7	—	%0,4	13 Eki 2026
28İzleyin	CVE-2026-110129İstismar yok	fuintCatering through commit 122c9e6 IDOR via /clientApi/refund/detailfushengqian · fuintcatering · CWE-639 Erişim denetimi (IDOR)	Yüksek7,1	—	%0,3	13 Eki 2026
34İzleyin	CVE-2026-53562İstismar yok	Local Privilege Escalationcitrix · uniconos · CWE-59 Yerel yetki yükseltme	Yüksek8,5	—	%0,2	13 Eki 2026
36İzleyin	CVE-2026-54454İstismar yok	OpenCATS: Authenticated RCE in the Import moduleopencats · opencats · CWE-434 RCE Dosya yükleme	Kritik9,1	—	%0,4	13 Eki 2026
30İzleyin	CVE-2026-54640İstismar yok	OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactoryopenremote · openremote · CWE-611 XXE	Yüksek7,6	—	%0,2	13 Eki 2026
30İzleyin	CVE-2026-54641İstismar yok	OpenRemote: Cross-Realm User Information Disclosure in UserResourceImplopenremote · openremote · CWE-639 Erişim denetimi (IDOR)	Yüksek7,7	—	%0,2	13 Eki 2026
38İzleyin	CVE-2026-55183İstismar yok	RClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malicious Web Pagezarestia-dev · rclone-manager · CWE-306 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,6	—	%0,4	13 Eki 2026
36İzleyin	CVE-2026-55562İstismar yok	Cronicle: Stored XSS in admin Activity Log via account full_name fieldjhuckaby · cronicle · CWE-79 XSS	Kritik9,0	—	%0,4	13 Eki 2026
34İzleyin	CVE-2026-55823İstismar yok	Frappe: Possibility of SQL injection in reportviewfrappe · frappe · CWE-89 SQL enjeksiyonu	Yüksek8,7	—	%0,3	13 Eki 2026
31İzleyin	CVE-2026-61642İstismar yok	Squid Request Smuggling in HTTP Transfer-Encodingsquid-cache · squid · CWE-444	Yüksek7,7	—	%2,0	13 Eki 2026
39İzleyin	CVE-2026-69227İstismar yok	BUG-000187331 Portal for ArcGIS has a security vulnerabilityesri · portal for arcgis · CWE-306 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,8	—	%0,3	13 Eki 2026
39İzleyin	CVE-2026-77459İstismar yok	Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooksargoproj · argo-cd · CWE-863 Erişim denetimi (IDOR)	Kritik9,9	—	%0,4	13 Eki 2026
39İzleyin	CVE-2026-78799İstismar yok	Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router ECWE-22 Girişsiz RCE Yol geçişi	Kritik9,8	—	%1,3	13 Eki 2026
30İzleyin	CVE-2026-82416İstismar yok	FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared modulephp · frankenphp · CWE-362 Kimlik doğrulamasız Yarış durumu	Yüksek7,7	—	%0,2	13 Eki 2026
35İzleyin	CVE-2026-85990İstismar yok	Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methodsleantime · leantime · CWE-269	Yüksek8,8	—	%0,4	13 Eki 2026
40Planlayın	CVE-2026-94603İstismar yok	Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotationpodman-container-tools · podman · CWE-693 Kimlik doğrulamasız	Kritik10,0	—	%0,5	13 Eki 2026
35İzleyin	CVE-2025-46773İstismar yok	An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet Forfortinet · fortianalyzer cloud · CWE-89 RCE SQL enjeksiyonu	Yüksek8,8	—	%0,3	13 Eki 2026
35İzleyin	CVE-2025-57739İstismar yok	An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet Forfortinet · fortimail · CWE-89 SQL enjeksiyonu	Yüksek8,8	—	%0,3	13 Eki 2026
35İzleyin	CVE-2026-104085İstismar yok	odt2spip < 4.4.0 OS Command Injection via Document Filenameodt2spip · odt2spip · CWE-78 RCE Komut enjeksiyonu	Yüksek8,7	—	%1,9	13 Eki 2026
37İzleyin	CVE-2026-105445Kavram kanıtı	Docker Hub account conversion could reassign an active personal access token to another userdocker · docker hub · CWE-266	Kritik9,4	—	%0,4	13 Eki 2026

CVE-2026-109965
33İzleyin
Serena before 2.0.0 Symlink Following in File Tools Allows Access Outside Project Root
YüksekCVSS 8,4İstismar yokEPSS %0
oraios · serena13 Eki 2026
CVE-2026-109967
34İzleyin
yt-dlp-web-ui through 4.0.0 NULL Pointer Dereference DoS via Service.Formats
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
marcopiovanello · yt-dlp-web-ui13 Eki 2026
CVE-2026-74031
28İzleyin
Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers
YüksekCVSS 7,0İstismar yokEPSS %0
- Yol geçişi
wazuh · wazuh-manager13 Eki 2026
CVE-2026-74033
33İzleyin
Wazuh from 4.1.1 before 4.14.8 Path Traversal in CDB List Cluster Handlers
YüksekCVSS 8,4İstismar yokEPSS %0
- Yol geçişi
wazuh · wazuh-manager13 Eki 2026
CVE-2026-74034
34İzleyin
Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command
YüksekCVSS 8,7Kavram kanıtıEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
wazuh · wazuh-manager13 Eki 2026
CVE-2026-74035
34İzleyin
Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user
YüksekCVSS 8,6İstismar yokEPSS %0
- Kimlik doğrulama atlatma
- Erişim denetimi (IDOR)
wazuh · wazuh-manager13 Eki 2026
CVE-2026-74036
34İzleyin
Wazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policies
YüksekCVSS 8,6İstismar yokEPSS %0
- RCE
- Erişim denetimi (IDOR)
wazuh · wazuh-agent13 Eki 2026
CVE-2026-74037
34İzleyin
Wazuh 4.0.0 before 4.14.8 Session Invalidation Bypass in check_token
YüksekCVSS 8,6İstismar yokEPSS %0
wazuh · wazuh-manager13 Eki 2026
CVE-2026-74040
37İzleyin
Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker
KritikCVSS 9,4İstismar yokEPSS %0
- RCE
- Erişim denetimi (IDOR)
wazuh · wazuh-manager13 Eki 2026
CVE-2026-74041
34İzleyin
Wazuh 4.14.3 < 4.14.8 / 4.10.4 Remote Command Validation Bypass via Case Mismatch
YüksekCVSS 8,6İstismar yokEPSS %0
wazuh · wazuh-manager13 Eki 2026
CVE-2026-74043
34İzleyin
Wazuh 4.1.1 before 4.14.8 Path Traversal via Cluster Upload Functions
YüksekCVSS 8,5İstismar yokEPSS %0
- Yol geçişi
wazuh · wazuh-manager13 Eki 2026
CVE-2026-74045
28İzleyin
Wazuh 3.12.0 before 4.14.8 Heap Buffer Overflow in wazuh-analysisd FIM Decoder
YüksekCVSS 7,1İstismar yokEPSS %0
- Bellek hatası
wazuh · wazuh-manager13 Eki 2026
CVE-2026-74047
28İzleyin
Wazuh 4.0.0 before 4.14.8 authd.pass Disclosure via Agent 000 Config Endpoint
YüksekCVSS 7,1İstismar yokEPSS %0
- Bilgi sızıntısı
wazuh · wazuh-manager13 Eki 2026
CVE-2026-93907
32İzleyin
IBM WebSphere Application Server is affected by a bypass authentication vulnerability
YüksekCVSS 8,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
ibm · websphere application server13 Eki 2026
CVE-2026-95680
32İzleyin
IBM WebSphere Application Server is affected by an authorization bypass
YüksekCVSS 8,0İstismar yokEPSS %0
- Kimlik doğrulama atlatma
ibm · websphere application server13 Eki 2026
CVE-2026-102250
34İzleyin
CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an autho
YüksekCVSS 8,6İstismar yokEPSS %0
schneider electric · sage rtu 141013 Eki 2026
CVE-2026-104192
38İzleyin
DragonflyDB stream RDB deserialization double-free
KritikCVSS 9,6İstismar yokEPSS %0
- Kimlik doğrulamasız
- Deserializasyon
- Bellek hatası
dragonflydb · dragonfly13 Eki 2026
CVE-2026-107460
36İzleyin
Apache Fesod (Incubating): UrlImageConverter SSRF protection bypass via DNS rebinding
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- SSRF
apache software foundation · apache fesod (incubating)13 Eki 2026
CVE-2026-108184
29İzleyin
Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure v
YüksekCVSS 7,4İstismar yokEPSS %0
- Kimlik doğrulamasız
- Zayıf kripto
zoom communications · zoom clients13 Eki 2026
CVE-2026-108185
29İzleyin
Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information
YüksekCVSS 7,4İstismar yokEPSS %0
- Kimlik doğrulamasız
- Zayıf kripto
zoom communications · zoom clients13 Eki 2026
CVE-2026-12655
35İzleyin
1732E ArmorBlock® - Multiple Vulnerabilities
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
rockwell automation · 1732e armorblock® i/o13 Eki 2026
CVE-2026-12656
34İzleyin
1732E ArmorBlock® - Multiple Vulnerabilities
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
rockwell automation · 1732e armorblock® i/o13 Eki 2026
CVE-2026-18228
28İzleyin
Hyperscale Path Traversal
YüksekCVSS 7,1İstismar yokEPSS %0
- Yol geçişi
commvault · commvault cloud13 Eki 2026
CVE-2026-53418
32İzleyin
Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace for Android before version 7.2.1 may allow an unauthenticated user
YüksekCVSS 8,1İstismar yokEPSS %0
zoom communications · zoom workplace13 Eki 2026
CVE-2026-53420
32İzleyin
Buffer overflow in a Zoom Phone feature of Zoom Workplace Clients may allow an unauthenticated user to conduct a escalation of privilege via
YüksekCVSS 8,0İstismar yokEPSS %0
- Bellek hatası
zoom communications · zoom workplace13 Eki 2026
CVE-2026-53709
39İzleyin
MCP Context Forge: Hardcoded default JWT_SECRET_KEY shipped in source and .env.example enables pre-authentication platform admin token forgery
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
ibm · mcp-context-forge13 Eki 2026
CVE-2026-65198
34İzleyin
Huawei Default SNMPv3 USM key
YüksekCVSS 8,6İstismar yokEPSS %0
- Kimlik doğrulamasız
- Gömülü kimlik bilgisi
huawei · openubmc13 Eki 2026
CVE-2026-77090
34İzleyin
CVFS Information Disclosure
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- XXE
commvault · commvault cloud13 Eki 2026
CVE-2026-77093
28İzleyin
CvFWD Denial of Service
YüksekCVSS 7,1İstismar yokEPSS %0
- Bellek hatası
commvault · commvault cloud13 Eki 2026
CVE-2026-77094
28İzleyin
CvFWD Out-of-Bounds Write
YüksekCVSS 7,1İstismar yokEPSS %0
- Bellek hatası
commvault · commvault cloud13 Eki 2026
CVE-2026-77095
28İzleyin
CvFWD Null Pointer Dereference
YüksekCVSS 7,1İstismar yokEPSS %0
- Bellek hatası
commvault · commvault cloud13 Eki 2026
CVE-2026-77096
30İzleyin
CVFS Missing Authentication
YüksekCVSS 7,7İstismar yokEPSS %0
- Girişsiz RCE
- Kimlik doğrulama atlatma
commvault · commvault cloud13 Eki 2026
CVE-2026-77099
37İzleyin
CVFS Command Execution
KritikCVSS 9,3İstismar yokEPSS %0
- Girişsiz RCE
- Komut enjeksiyonu
commvault · commvault cloud13 Eki 2026
CVE-2026-77100
34İzleyin
MediaAgent Denial of Service
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
commvault · commvault cloud13 Eki 2026
CVE-2026-95114
30İzleyin
libwebsockets contains an out-of-bounds read vulnerability in the LEJP incremental parser in lib/misc/lejp.c.
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
- Hizmet dışı bırakma
13 Eki 2026
CVE-2026-95115
30İzleyin
Buffer Overflow vulnerability in libwebsockets main 106d542c allows a remote attacker to cause a denial of service via the LEJP JSON parser
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
- Hizmet dışı bırakma
13 Eki 2026
CVE-2026-95121
31İzleyin
An issue in mp4v2 2.0.0 allows an attacker to execute arbitrary code via the MP4RtpAtom::ReadHntiType() in src/atom_rtp.cpp.
YüksekCVSS 7,8İstismar yokEPSS %0
- RCE
- Bellek hatası
13 Eki 2026
CVE-2026-95122
30İzleyin
mp4v2 2.0.0 contains a NULL pointer dereference vulnerability in MP4File::GenerateTracks() in src/mp4file.cpp.
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
- Hizmet dışı bırakma
13 Eki 2026
CVE-2026-95124
30İzleyin
Buffer Overflow vulnerability in madmurphy libconfini v.1.16.4 allows a remote attacker to cause a denial of service via an allocation-size
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
- Hizmet dışı bırakma
13 Eki 2026
CVE-2026-95127
30İzleyin
An issue in libass v.0.17.5 allows a remote attacker to cause a denial of service via the ass_outline_construct() in libass/ass_render.c
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
13 Eki 2026
CVE-2026-97333
28İzleyin
QAPI stack-based buffer overflow
YüksekCVSS 7,1İstismar yokEPSS %0
- Bellek hatası
commvault · commvault cloud13 Eki 2026
CVE-2026-97334
34İzleyin
Network messaging layer decompression resource exhaustion
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
commvault · commvault cloud13 Eki 2026
CVE-2024-34320
39İzleyin
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
13 Eki 2026
CVE-2024-34323
40Planlayın
ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter.
KritikCVSS 10,0İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
13 Eki 2026
CVE-2024-34324
36İzleyin
An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
13 Eki 2026
CVE-2026-102699
30İzleyin
Arm: multiple issues with GNTTABOP_cache_flush
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
- Hizmet dışı bırakma
xen · xen13 Eki 2026
CVE-2026-102702
30İzleyin
Arm: multiple issues with GNTTABOP_cache_flush
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
- Hizmet dışı bırakma
xen · xen13 Eki 2026
CVE-2026-102982
34İzleyin
Plane: XSS in work item comments
YüksekCVSS 8,5İstismar yokEPSS %0
- XSS
makeplane · plane13 Eki 2026
CVE-2026-103928
37İzleyin
Metabase: Arbitrary File Read/Write via Unsafe H2 Built-in Functions
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Yol geçişi
metabase · metabase13 Eki 2026
CVE-2026-104004
28İzleyin
Collection validators using collation-accepting expressions can crash MongoDB Server on insert
YüksekCVSS 7,1İstismar yokEPSS %0
- Bellek hatası
mongodb · mongodb server13 Eki 2026
CVE-2026-104005
28İzleyin
Incorrect authorization in MongoDB Server router for bulk writes to system namespaces
YüksekCVSS 7,1İstismar yokEPSS %0
mongodb · mongodb server13 Eki 2026
CVE-2026-104935
90Hemen
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.
YüksekCVSS 8,6KEVSilahlaştırılmışEPSS %86
- Girişsiz RCE
- Kimlik doğrulama atlatma
ivanti · connect secure13 Eki 2026
CVE-2026-110025
27İzleyin
slackero phpwcms Extension Check cnt23.article.inc.php unrestricted upload
OrtaCVSS 6,9Kavram kanıtıEPSS %0
- Kimlik doğrulamasız
- Dosya yükleme
- Erişim denetimi (IDOR)
slackero · phpwcms13 Eki 2026
CVE-2026-55376
35İzleyin
heym Python Tool Sandbox Escape
YüksekCVSS 8,8İstismar yokEPSS %0
- RCE
- Komut enjeksiyonu
heymrun · heym13 Eki 2026
CVE-2026-55675
40Planlayın
Salty documentation workflow executes fork-controlled Python build hooks with deployment secrets
KritikCVSS 10,0İstismar yokEPSS %0
- Girişsiz RCE
saltyorg · docs13 Eki 2026
CVE-2026-55695
36İzleyin
FearlessCMS: Remote Code Execution via Unvalidated Update Repository URL in System Updater
KritikCVSS 9,1İstismar yokEPSS %0
- RCE
fearlessgeekmedia · fearlesscms13 Eki 2026
CVE-2026-78802
39İzleyin
An issue in SKYWORTH DIGITAL CO.,LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote attacker to execute arbitrar
KritikCVSS 9,8İstismar yokEPSS %0
- Girişsiz RCE
13 Eki 2026
CVE-2026-79608
39İzleyin
x86/AMD: ineffectual Zenbleed workaround
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
xen · xen13 Eki 2026
CVE-2026-79609
35İzleyin
x86: XPTI may break on huge-memory systems
YüksekCVSS 8,8İstismar yokEPSS %0
- Erişim denetimi (IDOR)
xen · xen13 Eki 2026
CVE-2026-79610
35İzleyin
grant-table: double version change race
YüksekCVSS 8,8İstismar yokEPSS %0
- Yarış durumu
xen · xen13 Eki 2026
CVE-2026-96299
28İzleyin
Missing Authorization Check on Internal Aggregation Stage in MongoDB Server mongos Leads to Denial of Service
YüksekCVSS 7,1İstismar yokEPSS %0
mongodb · mongodb server13 Eki 2026
CVE-2026-102989
37İzleyin
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
tanstack · router13 Eki 2026
CVE-2026-103030
30İzleyin
Dio: Cross-origin redirect leaks sensitive request headers in `dio_http2_adapter`
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bilgi sızıntısı
cfug · dio13 Eki 2026
CVE-2026-106042
39İzleyin
An External Control of File Name or Path vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to r
KritikCVSS 9,9İstismar yokEPSS %0
- Yol geçişi
ivanti · xtraction13 Eki 2026
CVE-2026-106043
30İzleyin
A Missing Authentication for Critical Function vulnerability in Ivanti Xtraction before version 2026.4 allows a remote unauthenticated attac
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
ivanti · xtraction13 Eki 2026
CVE-2026-106047
30İzleyin
A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated
YüksekCVSS 7,7İstismar yokEPSS %0
- Yol geçişi
ivanti · xtraction13 Eki 2026
CVE-2026-109412
39İzleyin
An exposed dangerous endpoint in Ivanti Neurons Patch for Intune allows a remote authenticated attacker to leak sensitive authentication inf
KritikCVSS 9,9İstismar yokEPSS %0
ivanti · neurons patch for intune13 Eki 2026
CVE-2026-110097
34İzleyin
Ikaros 1.2.0 through 1.2.5 TOTP Authentication Bypass via Temp Token
YüksekCVSS 8,6İstismar yokEPSS %0
- Kimlik doğrulama atlatma
ikaros-dev · ikaros13 Eki 2026
CVE-2026-110102
30İzleyin
powerlevel10k through 1.20.0 Download of Code Without Integrity Check in gitstatus Installer
YüksekCVSS 7,7İstismar yokEPSS %0
- Kimlik doğrulamasız
romkatv · powerlevel10k13 Eki 2026
CVE-2026-110104
32İzleyin
novel through 3.5.0 Unsalted MD5 Password Storage
YüksekCVSS 8,2İstismar yokEPSS %0
- Kimlik doğrulamasız
xxyopen · novel13 Eki 2026
CVE-2026-110108
34İzleyin
MateCloud through 5.0.8 Missing Authorization via /api/v1/admin/storage API
YüksekCVSS 8,6İstismar yokEPSS %0
- Erişim denetimi (IDOR)
mateaix · matecloud13 Eki 2026
CVE-2026-110109
28İzleyin
JetLinks Community through 2.10.0 Missing Authorization via Product-Level Transparent Codec Save
YüksekCVSS 7,1İstismar yokEPSS %0
- RCE
- Erişim denetimi (IDOR)
jetlinks · jetlinks community13 Eki 2026
CVE-2026-110115
34İzleyin
Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager retrieveFileStream
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Yol geçişi
risesoft-y9 · digital-infrastructure13 Eki 2026
CVE-2026-110116
35İzleyin
Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager storeFile
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Yol geçişi
risesoft-y9 · digital-infrastructure13 Eki 2026
CVE-2026-110117
28İzleyin
SmartAdmin through 3.30.0 Missing Authorization via AdminProtectController
YüksekCVSS 7,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
1024-lab · smartadmin13 Eki 2026
CVE-2026-110118
28İzleyin
WorkFlow-Engine through 9.6.11 Missing Authorization via flowableui buttonOperation Endpoints
YüksekCVSS 7,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
risesoft-y9 · workflow-engine13 Eki 2026
CVE-2026-110119
28İzleyin
yshopmall through 2.0.0 IDOR via Member Address API in UserAddressController
YüksekCVSS 7,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
guchengwuyue · yshopmall13 Eki 2026
CVE-2026-110121
28İzleyin
PickMall lilishop through 4.4 IDOR via Goods Edit Endpoint
YüksekCVSS 7,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
pickmall · lilishop13 Eki 2026
CVE-2026-110123
28İzleyin
Makunet maku-boot 4.3.0 through 5.0.0 Missing Authorization via Mail and SMS Config Endpoints
YüksekCVSS 7,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
makunet · maku-boot13 Eki 2026
CVE-2026-110124
34İzleyin
FastBee through 2.1.0 IDOR via DeviceController /iot/device Endpoints
YüksekCVSS 8,6İstismar yokEPSS %0
- Erişim denetimi (IDOR)
kerwincui · fastbee13 Eki 2026
CVE-2026-110128
34İzleyin
fuint through commit 4c4bc8a Missing Authentication via /clientApi/order/detail
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
fushengqian · fuint13 Eki 2026
CVE-2026-110129
28İzleyin
fuintCatering through commit 122c9e6 IDOR via /clientApi/refund/detail
YüksekCVSS 7,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
fushengqian · fuintcatering13 Eki 2026
CVE-2026-53562
34İzleyin
Local Privilege Escalation
YüksekCVSS 8,5İstismar yokEPSS %0
- Yerel yetki yükseltme
citrix · uniconos13 Eki 2026
CVE-2026-54454
36İzleyin
OpenCATS: Authenticated RCE in the Import module
KritikCVSS 9,1İstismar yokEPSS %0
- RCE
- Dosya yükleme
opencats · opencats13 Eki 2026
CVE-2026-54640
30İzleyin
OpenRemote: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory
YüksekCVSS 7,6İstismar yokEPSS %0
- XXE
openremote · openremote13 Eki 2026
CVE-2026-54641
30İzleyin
OpenRemote: Cross-Realm User Information Disclosure in UserResourceImpl
YüksekCVSS 7,7İstismar yokEPSS %0
- Erişim denetimi (IDOR)
openremote · openremote13 Eki 2026
CVE-2026-55183
38İzleyin
RClone Manager: Unauthenticated RClone Daemon Enables Remote Attack via Malicious Web Page
KritikCVSS 9,6İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
zarestia-dev · rclone-manager13 Eki 2026
CVE-2026-55562
36İzleyin
Cronicle: Stored XSS in admin Activity Log via account full_name field
KritikCVSS 9,0İstismar yokEPSS %0
- XSS
jhuckaby · cronicle13 Eki 2026
CVE-2026-55823
34İzleyin
Frappe: Possibility of SQL injection in reportview
YüksekCVSS 8,7İstismar yokEPSS %0
- SQL enjeksiyonu
frappe · frappe13 Eki 2026
CVE-2026-61642
31İzleyin
Squid Request Smuggling in HTTP Transfer-Encoding
YüksekCVSS 7,7İstismar yokEPSS %2
squid-cache · squid13 Eki 2026
CVE-2026-69227
39İzleyin
BUG-000187331 Portal for ArcGIS has a security vulnerability
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
esri · portal for arcgis13 Eki 2026
CVE-2026-77459
39İzleyin
Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks
KritikCVSS 9,9İstismar yokEPSS %0
- Erişim denetimi (IDOR)
argoproj · argo-cd13 Eki 2026
CVE-2026-78799
39İzleyin
Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router E
KritikCVSS 9,8İstismar yokEPSS %1
- Girişsiz RCE
- Yol geçişi
13 Eki 2026
CVE-2026-82416
30İzleyin
FrankenPHP: Cross-request PHP session ID leak in worker mode when the session extension is a shared module
YüksekCVSS 7,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Yarış durumu
php · frankenphp13 Eki 2026
CVE-2026-85990
35İzleyin
Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods
YüksekCVSS 8,8İstismar yokEPSS %0
leantime · leantime13 Eki 2026
CVE-2026-94603
40Planlayın
Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
KritikCVSS 10,0İstismar yokEPSS %0
- Kimlik doğrulamasız
podman-container-tools · podman13 Eki 2026
CVE-2025-46773
35İzleyin
An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet For
YüksekCVSS 8,8İstismar yokEPSS %0
- RCE
- SQL enjeksiyonu
fortinet · fortianalyzer cloud13 Eki 2026
CVE-2025-57739
35İzleyin
An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet For
YüksekCVSS 8,8İstismar yokEPSS %0
- SQL enjeksiyonu
fortinet · fortimail13 Eki 2026
CVE-2026-104085
35İzleyin
odt2spip < 4.4.0 OS Command Injection via Document Filename
YüksekCVSS 8,7İstismar yokEPSS %1
- RCE
- Komut enjeksiyonu
odt2spip · odt2spip13 Eki 2026
CVE-2026-105445
37İzleyin
Docker Hub account conversion could reassign an active personal access token to another user
KritikCVSS 9,4Kavram kanıtıEPSS %0
docker · docker hub13 Eki 2026