İçeriğe atla
Noroxi

Yayın tarihine göre

Ekim 2026: sömürülen ve yeni ciddi CVE kayıtları

6.169 kayıt · 12 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 3 / 62

  • CVE-2026-104051
    35İzleyin

    PictShare < 3.7.1 Sensitive Information Disclosure via info API

    YüksekCVSS 8,8Kavram kanıtıEPSS %0

    hascheksolutions · pictshare1 Eki 2026

  • CVE-2026-104356
    32İzleyin

    PictShare < 3.7.1 Predictable Delete Code via rand()

    YüksekCVSS 8,2Kavram kanıtıEPSS %0

    hascheksolutions · pictshare1 Eki 2026

  • CVE-2026-18397
    37İzleyin

    SConnect: Native Host Unauthenticated Remote Code Execution Vulnerability

    KritikCVSS 9,4İstismar yokEPSS %0

    thales · sconnect1 Eki 2026

  • CVE-2026-34493
    28İzleyin

    - On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations.

    YüksekCVSS 7,2İstismar yokEPSS %0

    johnson controls · easyio fs321 Eki 2026

  • CVE-2026-34494
    28İzleyin

    - On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations.

    YüksekCVSS 7,2İstismar yokEPSS %0

    johnson controls · neo series mvp21 Eki 2026

  • CVE-2026-51873
    35İzleyin

    Devika v1.0 is vulnerable to Directory Traversal in the Coder.save_code_to_project function, which allows attackers to write files outside t

    YüksekCVSS 8,8İstismar yokEPSS %0

    1 Eki 2026

  • CVE-2026-51874
    30İzleyin

    In Devika v1.0, the Patcher Agent save_code_to_project function contains a path traversal vulnerability that allows attackers to write files

    YüksekCVSS 7,5İstismar yokEPSS %0

    1 Eki 2026

  • CVE-2026-51875
    36İzleyin

    In Devika v1.0, the Feature Agent save_code_to_project function contains a path traversal vulnerability that allows attackers to write files

    KritikCVSS 9,1İstismar yokEPSS %0

    1 Eki 2026

  • CVE-2026-51876
    36İzleyin

    DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow.

    KritikCVSS 9,1İstismar yokEPSS %0

    1 Eki 2026

  • CVE-2026-51879
    36İzleyin

    deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.write_bot_file.

    KritikCVSS 9,1İstismar yokEPSS %0

    1 Eki 2026

  • CVE-2026-51880
    39İzleyin

    deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute.

    KritikCVSS 9,8İstismar yokEPSS %0

    1 Eki 2026

  • CVE-2026-51881
    39İzleyin

    deeptutor 1.4.0 contains code injection in ExecTool.execute.

    KritikCVSS 9,8İstismar yokEPSS %0

    1 Eki 2026

  • CVE-2026-51882
    36İzleyin

    The OpenAI-compatible file upload endpoint `/v1/files` in Langchain-Chatchat 0.3.0 is vulnerable to path traversal.

    KritikCVSS 9,1İstismar yokEPSS %0

    1 Eki 2026

  • CVE-2026-51883
    36İzleyin

    The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal.

    KritikCVSS 9,1İstismar yokEPSS %0

    1 Eki 2026

  • CVE-2026-51884
    39İzleyin

    The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal.

    KritikCVSS 9,8İstismar yokEPSS %0

    1 Eki 2026

  • CVE-2026-51886
    39İzleyin

    langflow-ai langflow v1.9.3 is affected by: Code Injection.

    KritikCVSS 9,8İstismar yokEPSS %0

    1 Eki 2026

  • CVE-2026-51888
    30İzleyin

    langflow-ai langflow v1.8.4 is affected by: Directory Traversal.

    YüksekCVSS 7,5İstismar yokEPSS %0

    1 Eki 2026

  • CVE-2026-51893
    39İzleyin

    infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap.

    KritikCVSS 9,8İstismar yokEPSS %0

    1 Eki 2026

  • CVE-2026-51897
    39İzleyin

    RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app).

    KritikCVSS 9,8İstismar yokEPSS %0

    1 Eki 2026

  • CVE-2026-64893
    29İzleyin

    - Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack.

    YüksekCVSS 7,3İstismar yokEPSS %0

    johnson controls · easyio neo1 Eki 2026

  • CVE-2026-71449
    37İzleyin

    : Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data.

    KritikCVSS 9,3İstismar yokEPSS %0

    johnson controls · easyio fs321 Eki 2026

  • CVE-2026-71452
    28İzleyin

    - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection.

    YüksekCVSS 7,2İstismar yokEPSS %0

    johnson controls · easyio fs321 Eki 2026

  • CVE-2026-86344
    30İzleyin

    389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue

    YüksekCVSS 7,5İstismar yokEPSS %0

    red hat · red hat directory server 111 Eki 2026

  • CVE-2025-71427
    30İzleyin

    Office-PowerPoint-MCP-Server through 2.0.7 Path Traversal via save_presentation and manage_image

    YüksekCVSS 7,6İstismar yokEPSS %0

    gongrzhe · office-powerpoint-mcp-server1 Eki 2026

  • CVE-2026-103760
    32İzleyin

    Mooncake transfer engine through 0.3.13.post1 Denial of Service via P2P Handshake Daemon Response Write

    YüksekCVSS 8,2İstismar yokEPSS %0

    kvcache-ai · mooncake1 Eki 2026

  • CVE-2026-103761
    34İzleyin

    Mooncake transfer engine through 0.3.13.post1 Memory Exhaustion via Unbounded Notify Queue

    YüksekCVSS 8,7İstismar yokEPSS %0

    kvcache-ai · mooncake1 Eki 2026

  • CVE-2026-103764
    37İzleyin

    Mooncake transfer engine before 0.3.13 Unauthenticated Arbitrary Memory Read/Write via TCP Transport

    KritikCVSS 9,3İstismar yokEPSS %0

    kvcache-ai · mooncake2 Eki 2026

  • CVE-2026-103765
    35İzleyin

    Mooncake through 0.3.13.post1 Missing Authentication in HTTP Metadata Server

    YüksekCVSS 8,8İstismar yokEPSS %0

    kvcache-ai · mooncake2 Eki 2026

  • CVE-2026-103766
    34İzleyin

    ClipBucket v5 through 5.5.3-#197 SQL Injection via ads_manager.php delete Parameter

    YüksekCVSS 8,6İstismar yokEPSS %0

    macwarrior · clipbucket-v52 Eki 2026

  • CVE-2026-86345
    36İzleyin

    389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result

    KritikCVSS 9,0İstismar yokEPSS %0

    red hat · red hat directory server 112 Eki 2026

  • CVE-2026-103096
    30İzleyin

    GV-Eye Hardcoded API Key Vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %0

    geovision inc. · gv-eye2 Eki 2026

  • CVE-2026-103097
    30İzleyin

    GV-Eye Relay Payment API Key Vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %0

    geovision inc. · gv-eye2 Eki 2026

  • CVE-2026-103098
    30İzleyin

    GV-Eye Sensitive information exposure in URL query parameter Vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %0

    geovision inc. · gv-eye2 Eki 2026

  • CVE-2026-104480
    37İzleyin

    Improper MLS Welcome roster validation in Discord libdave allows unauthorized group membership

    KritikCVSS 9,4İstismar yokEPSS %0

    discord · libdave2 Eki 2026

  • CVE-2026-14378
    39İzleyin

    DevKit Pro <= 2.3.0 - Unauthenticated Authentication Bypass to Administrator Account Takeover via 'original_user_id' Cookie in Frontend Revert Switch Flow

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    dplugins · devkit pro2 Eki 2026

  • CVE-2026-93367
    28İzleyin

    Visitors Traffic Real Time Statistics Pro <= 11.22 - Unauthenticated Stored Cross-Site Scripting via ahcpro_track_visitor (page_title)

    YüksekCVSS 7,2İstismar yokEPSS %0

    wp-buy · visitor traffic real time statistics pro2 Eki 2026

  • CVE-2026-10026
    28İzleyin

    CTX Feed Pro <= 7.6.12 - Authenticated (Administrator+) Remote Code Execution

    YüksekCVSS 7,2İstismar yokEPSS %0

    ctx · ctx feed pro2 Eki 2026

  • CVE-2026-19660
    39İzleyin

    Divi Membership <= 2.3.0 - Unauthenticated Authentication Bypass via 'paypal_param' Parameter

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    diviengine · divi membership2 Eki 2026

  • CVE-2026-15896
    36İzleyin

    Super Forms <= 6.3.316 - Unauthenticated Path Traversal to Arbitrary File Read via 'sfgtfi' URL Path Parameter

    KritikCVSS 9,1İstismar yokEPSS %0

    webrehab · super forms – drag & drop form builder2 Eki 2026

  • CVE-2026-15897
    35İzleyin

    Super Forms – Drag & Drop Form Builder <= 6.3.316 - Authenticated (Subscriber+) Privilege Escalation via 'user_id' Parameter in Register & Login

    YüksekCVSS 8,8İstismar yokEPSS %0

    webrehab · super forms – drag & drop form builder2 Eki 2026

  • CVE-2026-90438
    28İzleyin

    Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission

    YüksekCVSS 7,2İstismar yokEPSS %0

    kstover · ninja forms – contact form builder with calculators, quizzes, signatures & ai form builder2 Eki 2026

  • CVE-2026-91828
    30İzleyin

    OMGF < 6.3.11 - Unauthenticated DoS via do_optimize

    YüksekCVSS 7,5İstismar yokEPSS %0

    unknown · omgf | gdpr/dsgvo compliant, faster google fonts. easy.2 Eki 2026

  • CVE-2026-92174
    30İzleyin

    SiteOrigin Widgets Bundle <= 1.73.2 - Authenticated (Contributor+) Local File Inclusion via 'theme' Parameter

    YüksekCVSS 7,5İstismar yokEPSS %0

    gpriday · siteorigin widgets bundle2 Eki 2026

  • CVE-2026-92820
    32İzleyin

    Ninja Forms - File Uploads <= 3.3.34 - Unauthenticated Arbitrary File Upload

    YüksekCVSS 8,1İstismar yokEPSS %0

    saturdaydrive · ninja forms - file uploads2 Eki 2026

  • CVE-2026-102565
    28İzleyin

    BA Book Everything <= 1.8.28 - Unauthenticated Stored Cross-Site Scripting via 'booking_service_qty' Parameter

    YüksekCVSS 7,2İstismar yokEPSS %0

    bookingalgorithms · ba book everything2 Eki 2026

  • CVE-2026-15999
    32İzleyin

    AES-CCM decryption accepts zero or out-of-range tag length, bypassing authentication

    YüksekCVSS 8,2İstismar yokEPSS %0

    legion of the bouncy castle inc. · bc-csharp2 Eki 2026

  • CVE-2026-16000
    34İzleyin

    KCcmBlockCipher (DSTU 7624 CCM) tag not bound to nonce when no associated data is used

    YüksekCVSS 8,7İstismar yokEPSS %0

    legion of the bouncy castle inc. · bc-csharp2 Eki 2026

  • CVE-2026-16001
    32İzleyin

    IesEngine stream-mode MAC forgery via length-dependent KDF split

    YüksekCVSS 8,2İstismar yokEPSS %0

    legion of the bouncy castle inc. · bc-csharp2 Eki 2026

  • CVE-2026-63566
    34İzleyin

    DTLS handshake reassembler allocates buffer from unchecked 24-bit length

    YüksekCVSS 8,7İstismar yokEPSS %0

    legion of the bouncy castle inc. · bc-csharp2 Eki 2026

  • CVE-2026-63567
    32İzleyin

    IesEngine block-cipher mode checks padding before MAC (CBC padding oracle)

    YüksekCVSS 8,2İstismar yokEPSS %0

    legion of the bouncy castle inc. · bc-csharp2 Eki 2026

  • CVE-2026-63568
    34İzleyin

    Unbounded CMP/CRMF password-based MAC iteration count allows CPU exhaustion

    YüksekCVSS 8,7İstismar yokEPSS %0

    legion of the bouncy castle inc. · bc-csharp2 Eki 2026

  • CVE-2026-63569
    36İzleyin

    MTI/A0 DHAgreement does not validate the peer's ephemeral value

    KritikCVSS 9,1İstismar yokEPSS %0

    legion of the bouncy castle inc. · bc-csharp2 Eki 2026

  • CVE-2026-93029
    36İzleyin

    There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.

    KritikCVSS 9,0İstismar yokEPSS %0

    webpros · cpanel2 Eki 2026

  • CVE-2026-93697
    36İzleyin

    There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.

    KritikCVSS 9,0İstismar yokEPSS %0

    webpros · cpanel2 Eki 2026

  • CVE-2026-93698
    39İzleyin

    Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.

    KritikCVSS 9,9İstismar yokEPSS %0

    webpros · cpanel2 Eki 2026

  • CVE-2026-100107
    28İzleyin

    Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass)

    YüksekCVSS 7,2İstismar yokEPSS %0

    extendthemes · kubio ai page builder2 Eki 2026

  • CVE-2026-100182
    28İzleyin

    Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor

    YüksekCVSS 7,2İstismar yokEPSS %0

    wpchill · download monitor2 Eki 2026

  • CVE-2026-102772
    28İzleyin

    CMB2 <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'textarea_code' Field

    YüksekCVSS 7,2İstismar yokEPSS %0

    jtsternberg · cmb22 Eki 2026

  • CVE-2026-103426
    28İzleyin

    Relevanssi Premium <= 2.31.4 - Unauthenticated Stored Cross-Site Scripting via '_rt' Parameter

    YüksekCVSS 7,2İstismar yokEPSS %0

    relevanssi · relevanssi premium2 Eki 2026

  • CVE-2026-103600
    34İzleyin

    Unbounded ASN.1 nesting depth causes process-terminating stack overflow

    YüksekCVSS 8,7İstismar yokEPSS %0

    legion of the bouncy castle inc. · bc-csharp2 Eki 2026

  • CVE-2026-103601
    32İzleyin

    CcmBlockCipher and KCcmBlockCipher leave unverified plaintext in the output buffer after a failed tag check

    YüksekCVSS 8,2İstismar yokEPSS %0

    legion of the bouncy castle inc. · bc-csharp2 Eki 2026

  • CVE-2026-103602
    32İzleyin

    Name constraints bypass via trailing dot in rfc822Name, dNSName and URI hosts

    YüksekCVSS 8,2İstismar yokEPSS %0

    legion of the bouncy castle inc. · bc-csharp2 Eki 2026

  • CVE-2026-103603
    34İzleyin

    Unbounded HSS public key level count allows huge array allocation during signature verification

    YüksekCVSS 8,7İstismar yokEPSS %0

    legion of the bouncy castle inc. · bc-csharp2 Eki 2026

  • CVE-2026-103604
    34İzleyin

    Quadratic-time escaping when converting X.509 distinguished names to strings

    YüksekCVSS 8,7İstismar yokEPSS %0

    legion of the bouncy castle inc. · bc-csharp2 Eki 2026

  • CVE-2026-17507
    34İzleyin

    MLS membership checks compare a uint32 leaf_index as signed, admitting an out-of-range sender

    YüksekCVSS 8,7İstismar yokEPSS %0

    bouncycastle · bc-java2 Eki 2026

  • CVE-2026-18036
    32İzleyin

    NTRU leaks private key information by reducing secret values with a non-constant-time integer division

    YüksekCVSS 8,2İstismar yokEPSS %0

    legion of the bouncy castle inc. · bc-java2 Eki 2026

  • CVE-2026-63570
    28İzleyin

    Pkcs12Store.GetCertificateChain loops forever on cyclic issuer links

    YüksekCVSS 7,1İstismar yokEPSS %0

    legion of the bouncy castle inc. · bc-csharp2 Eki 2026

  • CVE-2026-63571
    34İzleyin

    Attribute certificate path validation does not verify the attribute certificate's signature

    YüksekCVSS 8,7İstismar yokEPSS %0

    legion of the bouncy castle inc. · bc-csharp2 Eki 2026

  • CVE-2026-63572
    28İzleyin

    Unbounded MAC and bag-decryption iteration counts when loading PKCS#12 files

    YüksekCVSS 7,1İstismar yokEPSS %0

    legion of the bouncy castle inc. · bc-csharp2 Eki 2026

  • CVE-2026-63573
    32İzleyin

    Bleichenbacher padding oracle in CMS RSA PKCS#1 v1.5 key-transport unwrap

    YüksekCVSS 8,2İstismar yokEPSS %0

    legion of the bouncy castle inc. · bc-csharp2 Eki 2026

  • CVE-2026-63574
    34İzleyin

    Unbounded allocation from OpenPGP signature and user attribute subpacket lengths

    YüksekCVSS 8,7İstismar yokEPSS %0

    legion of the bouncy castle inc. · bc-csharp2 Eki 2026

  • CVE-2026-63575
    28İzleyin

    PKCS#12 key derivation loops about 2^32 times on a zero or negative iteration count

    YüksekCVSS 7,1İstismar yokEPSS %0

    legion of the bouncy castle inc. · bc-csharp2 Eki 2026

  • CVE-2026-63576
    32İzleyin

    URI name constraints checked against a mis-parsed host

    YüksekCVSS 8,2İstismar yokEPSS %0

    legion of the bouncy castle inc. · bc-csharp2 Eki 2026

  • CVE-2026-63577
    32İzleyin

    Name Constraints bypass: directoryName constraint matched at any position in the DN instead of as a prefix

    YüksekCVSS 8,2İstismar yokEPSS %0

    legion of the bouncy castle inc. · bc-csharp2 Eki 2026

  • CVE-2026-63578
    28İzleyin

    Unbounded PBE iteration count when decrypting PKCS#8 private keys

    YüksekCVSS 7,1İstismar yokEPSS %0

    legion of the bouncy castle inc. · bc-csharp2 Eki 2026

  • CVE-2026-93756
    28İzleyin

    Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview

    YüksekCVSS 7,2İstismar yokEPSS %0

    smub · smash balloon social post feed – simple social feeds for wordpress2 Eki 2026

  • CVE-2026-95670
    28İzleyin

    No External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect

    YüksekCVSS 7,2İstismar yokEPSS %0

    mihdan · no external links2 Eki 2026

  • CVE-2026-95817
    28İzleyin

    DoFollow Case by Case <= 3.6.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content

    YüksekCVSS 7,2İstismar yokEPSS %0

    apasionados · dofollow case by case2 Eki 2026

  • CVE-2026-96566
    28İzleyin

    Newsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter

    YüksekCVSS 7,2İstismar yokEPSS %0

    satollo · newsletter – send awesome emails from wordpress2 Eki 2026

  • CVE-2026-96567
    28İzleyin

    MW WP Form <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'post_id' Parameter (via stored form-submitted post meta)

    YüksekCVSS 7,2İstismar yokEPSS %0

    websoudan · mw wp form2 Eki 2026

  • CVE-2026-96578
    28İzleyin

    GSpeech TTS <= 3.22.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content

    YüksekCVSS 7,2İstismar yokEPSS %0

    creative-solutions-1 · gspeech tts – wordpress text to speech plugin2 Eki 2026

  • CVE-2026-96871
    28İzleyin

    Mang Board <= 2.4.2 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter

    YüksekCVSS 7,2İstismar yokEPSS %0

    kitae-park · mang board2 Eki 2026

  • CVE-2026-97336
    28İzleyin

    CMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type

    YüksekCVSS 7,2İstismar yokEPSS %0

    jtsternberg · cmb22 Eki 2026

  • CVE-2026-97342
    28İzleyin

    JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action

    YüksekCVSS 7,2İstismar yokEPSS %0

    jetmonsters · jetformbuilder — dynamic blocks form builder2 Eki 2026

  • CVE-2026-97637
    39İzleyin

    JSON API Auth <= 3.1.2 - Unauthenticated Authentication Bypass via Cached 'generate_auth_cookie' Response

    KritikCVSS 9,8İstismar yokEPSS %0

    parorrey · json api auth2 Eki 2026

  • CVE-2026-97641
    28İzleyin

    Relevanssi <= 4.28.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content

    YüksekCVSS 7,2İstismar yokEPSS %0

    comesio · relevanssi – a better search2 Eki 2026

  • CVE-2026-97663
    28İzleyin

    Customer Reviews for WooCommerce <= 5.122.0 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

    YüksekCVSS 7,2İstismar yokEPSS %0

    ivole · customer reviews for woocommerce2 Eki 2026

  • CVE-2026-80443
    29İzleyin

    Insecure TLS Certificate Validation in API Tool Runner in HAVELSAN's Sef - AI Chatbot Platform

    YüksekCVSS 7,4İstismar yokEPSS %0

    havelsan inc. · sef - ai chatbot platform2 Eki 2026

  • CVE-2026-102731
    30İzleyin

    Apache Directory LDAP API: Denial of service via excessive memory allocation in BER decode

    YüksekCVSS 7,5İstismar yokEPSS %0

    apache software foundation · apache directory ldap api2 Eki 2026

  • CVE-2026-103552
    29İzleyin

    Apache Directory LDAP API: A unbound client can send a deeply nested search filter that overflows the stack in the server's decoder

    YüksekCVSS 7,3İstismar yokEPSS %0

    apache software foundation · apache directory ldap api2 Eki 2026

  • CVE-2026-103877
    39İzleyin

    Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements

    KritikCVSS 9,8İstismar yokEPSS %0

    apache software foundation · apache directory ldap api2 Eki 2026

  • CVE-2026-103878
    30İzleyin

    Apache Directory LDAP API: Injection of plaintext responses during StartTLS

    YüksekCVSS 7,5İstismar yokEPSS %0

    apache software foundation · apache directory ldap api2 Eki 2026

  • CVE-2026-103880
    30İzleyin

    Apache Directory LDAP API: Denial of service via excessive bcrypt cost factor in stored passwords

    YüksekCVSS 7,5İstismar yokEPSS %0

    apache software foundation · apache directory ldap api2 Eki 2026

  • CVE-2026-103885
    30İzleyin

    Apache Directory LDAP API: Denial of service via crafted telephone number values

    YüksekCVSS 7,5İstismar yokEPSS %0

    apache software foundation · apache directory ldap api2 Eki 2026

  • CVE-2026-80298
    35İzleyin

    SQL Injection in HAVELSAN's Sef - AI Chatbot Platform

    YüksekCVSS 8,8İstismar yokEPSS %0

    havelsan inc. · sef - ai chatbot platform2 Eki 2026

  • CVE-2026-87920
    28İzleyin

    W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content

    YüksekCVSS 7,2İstismar yokEPSS %0

    boldgrid · w3 total cache2 Eki 2026

  • CVE-2026-94541
    39İzleyin

    WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    amauric · wpmobile.app – android and ios app builder2 Eki 2026

  • CVE-2026-94634
    32İzleyin

    Apache Thrift: Python `TJSONProtocol` has a string length limit that is off by default

    YüksekCVSS 8,2İstismar yokEPSS %0

    apache software foundation · apache thrift2 Eki 2026

  • CVE-2026-94635
    34İzleyin

    Apache Thrift: Lua `TBinaryProtocol:readMessageBegin` bypasses `checkStringSize` on the pre-versioned name

    YüksekCVSS 8,7İstismar yokEPSS %0

    apache software foundation · apache thrift2 Eki 2026

  • CVE-2026-94639
    32İzleyin

    Apache Thrift: Java `TSaslNonblockingServer`: residual of CVE-2026-61373 (thread-death black hole + no cross-connection budget)

    YüksekCVSS 8,2İstismar yokEPSS %0

    apache software foundation · apache thrift2 Eki 2026