İçeriğe atla
Noroxi

Yayın tarihine göre

Ekim 2026: sömürülen ve yeni ciddi CVE kayıtları

5.812 kayıt · 12 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 48 / 59

  • CVE-2026-111313
    28İzleyin

    JobOps through 0.13.1 SSRF via POST /api/manual-jobs/fetch

    YüksekCVSS 7,1İstismar yokEPSS %0

    dakheera47 · jobops5 gün önce

  • CVE-2026-111322
    37İzleyin

    Archon 0.2.13 through 0.11.1 Missing Authentication via /api/* Control API

    KritikCVSS 9,3İstismar yokEPSS %0

    coleam00 · archon5 gün önce

  • CVE-2026-111329
    37İzleyin

    JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console

    KritikCVSS 9,3İstismar yokEPSS %0

    juggleim · juggleim5 gün önce

  • CVE-2026-111330
    32İzleyin

    JuggleIM im-server through 1.8.16 Weak Password Hashing via Unsalted SHA-1

    YüksekCVSS 8,2İstismar yokEPSS %0

    juggleim · juggleim5 gün önce

  • CVE-2026-111347
    32İzleyin

    go-ldap-admin through 0.6.2 Hard-Coded RSA Private Key via /base/decryptpwd

    YüksekCVSS 8,2İstismar yokEPSS %0

    opsre · go-ldap-admin5 gün önce

  • CVE-2026-111352
    34İzleyin

    ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API

    YüksekCVSS 8,7İstismar yokEPSS %0

    thinkcmf · thinkcmf5 gün önce

  • CVE-2026-111356
    36İzleyin

    MacCMS v10 through 2026.1000.4056 Account Takeover via Password Recovery Brute-Force

    KritikCVSS 9,1İstismar yokEPSS %0

    magicblack · maccms5 gün önce

  • CVE-2026-111359
    28İzleyin

    CRMEB 5.6.1 through 6.0.0 IDOR via giftDetail and receiveGift

    YüksekCVSS 7,1İstismar yokEPSS %0

    crmeb · crmeb5 gün önce

  • CVE-2026-111363
    28İzleyin

    BISHENG through 3.0.0-beta4 IDOR via /api/v1/knowledge/file_bbox

    YüksekCVSS 7,1İstismar yokEPSS %0

    dataelement · bisheng5 gün önce

  • CVE-2026-111364
    28İzleyin

    MinDoc through 2.2-beta.2 IDOR via /api/:key/content/:id GET Branch

    YüksekCVSS 7,1İstismar yokEPSS %0

    mindoc-org · mindoc5 gün önce

  • CVE-2026-111365
    28İzleyin

    cool-admin-midway through 8.0.0 Missing Authorization via System Role Endpoints

    YüksekCVSS 7,0İstismar yokEPSS %0

    cool-team-official · cool-admin-midway5 gün önce

  • CVE-2026-111366
    34İzleyin

    cool-admin-midway through 8.0.0 Authorization Bypass via /admin/sys/user Endpoints

    YüksekCVSS 8,6İstismar yokEPSS %0

    cool-team-official · cool-admin-midway5 gün önce

  • CVE-2026-111369
    28İzleyin

    ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes

    YüksekCVSS 7,1İstismar yokEPSS %0

    classroomio · classroomio5 gün önce

  • CVE-2026-94134
    36İzleyin

    Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default

    KritikCVSS 9,1Kavram kanıtıEPSS %0

    apache software foundation · apache airflow ssh provider5 gün önce

  • CVE-2026-75941
    34İzleyin

    A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese market, that could allo

    YüksekCVSS 8,6İstismar yokEPSS %0

    lenovo · legion zone application4 gün önce

  • CVE-2026-84823
    28İzleyin

    Org.wildfly.core: wildfly: path traversal in take-snapshot discloses the server configuration to the monitor role

    YüksekCVSS 7,1İstismar yokEPSS %0

    red hat · red hat enterprise linux 84 gün önce

  • CVE-2026-89057
    28İzleyin

    A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with physical access to gain una

    YüksekCVSS 7,0İstismar yokEPSS %0

    lenovo · idea tab pro (tb373fu)4 gün önce

  • CVE-2026-92629
    28İzleyin

    A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, th

    YüksekCVSS 7,0İstismar yokEPSS %0

    lenovo · baiying pc client4 gün önce

  • CVE-2026-105227
    28İzleyin

    ISPSoft Out-of-Bounds Read Vulnerability

    YüksekCVSS 7,0İstismar yokEPSS %0

    deltaww · ispsoft4 gün önce

  • CVE-2026-105228
    28İzleyin

    ISPSoft Out-of-Bounds Read Vulnerability

    YüksekCVSS 7,0İstismar yokEPSS %0

    deltaww · ispsoft4 gün önce

  • CVE-2026-109813
    34İzleyin

    Shared Hard-coded Root CA Private Key

    YüksekCVSS 8,6İstismar yokEPSS %0

    moxa · aig-302 series4 gün önce

  • CVE-2026-111377
    28İzleyin

    FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via Static Channel Reassembly

    YüksekCVSS 7,1İstismar yokEPSS %0

    freerdp · freerdp4 gün önce

  • CVE-2026-111378
    34İzleyin

    FreeRDP 3.0.0 before 3.32.0 Unauthenticated Memory Exhaustion via NLA Frame Parser

    YüksekCVSS 8,7İstismar yokEPSS %0

    freerdp · freerdp4 gün önce

  • CVE-2026-111379
    28İzleyin

    FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3

    YüksekCVSS 7,0İstismar yokEPSS %0

    freerdp · freerdp4 gün önce

  • CVE-2026-111380
    34İzleyin

    FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple Backends

    YüksekCVSS 8,7İstismar yokEPSS %0

    freerdp · freerdp4 gün önce

  • CVE-2026-111381
    28İzleyin

    FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 Parser

    YüksekCVSS 7,0İstismar yokEPSS %0

    freerdp · freerdp4 gün önce

  • CVE-2026-111382
    34İzleyin

    FreeRDP before 3.32.0 Heap Out-of-Bounds Write in AVC444 YUV444 Combine

    YüksekCVSS 8,7İstismar yokEPSS %0

    freerdp · freerdp4 gün önce

  • CVE-2026-111383
    28İzleyin

    Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket

    YüksekCVSS 7,1İstismar yokEPSS %0

    nezhahq · nezha4 gün önce

  • CVE-2026-111384
    28İzleyin

    Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket

    YüksekCVSS 7,1İstismar yokEPSS %0

    nezhahq · nezha4 gün önce

  • CVE-2026-111387
    28İzleyin

    Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint

    YüksekCVSS 7,1İstismar yokEPSS %0

    nezhahq · nezha4 gün önce

  • CVE-2026-111389
    33İzleyin

    Frappe HRMS 14.0.0 before 14.38.2 SQL Injection via Missing Validation

    YüksekCVSS 8,3Kavram kanıtıEPSS %0

    frappe · hrms4 gün önce

  • CVE-2026-104745
    32İzleyin

    Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter

    YüksekCVSS 8,1Kavram kanıtıEPSS %0

    wpcodefactory · customer email verification for woocommerce4 gün önce

  • CVE-2026-107758
    28İzleyin

    Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments

    YüksekCVSS 7,2İstismar yokEPSS %0

    extendthemes · colibri page builder4 gün önce

  • CVE-2026-109207
    28İzleyin

    RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL

    YüksekCVSS 7,2İstismar yokEPSS %0

    themeisle · rss aggregator by feedzy – feed to post, autoblogging, news & youtube video feeds aggregator4 gün önce

  • CVE-2026-109990
    28İzleyin

    Flying Scripts: Delay JavaScript to Improve Site Speed & Performance <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content

    YüksekCVSS 7,2İstismar yokEPSS %0

    gijo · flying scripts: delay javascript to improve site speed & performance4 gün önce

  • CVE-2026-111444
    39İzleyin

    Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    wheels · wheels4 gün önce

  • CVE-2026-111445
    32İzleyin

    Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=).

    YüksekCVSS 8,1İstismar yokEPSS %0

    wheels · wheels4 gün önce

  • CVE-2026-111446
    34İzleyin

    Wheels 4.0.0 through 4.1.2 exposes password-less development tools under /wheels/* to remote clients when enablePublicComponent=true, as it

    YüksekCVSS 8,6İstismar yokEPSS %0

    wheels · wheels4 gün önce

  • CVE-2026-111447
    32İzleyin

    Wheels 1.1 through 4.1.2 resolves nestedProperties() records by posted primary key without checking that they belong to the parent being sav

    YüksekCVSS 8,1İstismar yokEPSS %0

    wheels · wheels4 gün önce

  • CVE-2026-111451
    31İzleyin

    Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents.

    YüksekCVSS 7,8İstismar yokEPSS %0

    wheels · wheels cli4 gün önce

  • CVE-2026-93953
    32İzleyin

    Backuply <= 1.5.8 - Authenticated (Subscriber+) Second-Order SQL Injection via Restore to Privilege Escalation

    YüksekCVSS 8,0İstismar yokEPSS %0

    softaculous · backuply – backup, restore, migrate and clone4 gün önce

  • CVE-2026-97339
    28İzleyin

    Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter

    YüksekCVSS 7,2İstismar yokEPSS %0

    complianz · complianz gdpr/ccpa cookie consent banner4 gün önce

  • CVE-2026-103525
    30İzleyin

    FluentCart A New Era of eCommerce <= 1.7.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_ad

    YüksekCVSS 7,5İstismar yokEPSS %0

    wpmanageninja · fluentcart a new era of ecommerce – faster, lighter, and simpler4 gün önce

  • CVE-2026-103895
    32İzleyin

    miniOrange OTP Login, Verification and SMS Notifications <= 5.5.8 - Unauthenticated Authentication Bypass via Delay OTP Grace State

    YüksekCVSS 8,1İstismar yokEPSS %0

    cyberlord92 · miniorange otp login, verification and sms notifications4 gün önce

  • CVE-2026-104798
    39İzleyin

    My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'above' Attribute

    KritikCVSS 9,8İstismar yokEPSS %0

    joedolson · my calendar – accessible event manager4 gün önce

  • CVE-2026-107659
    30İzleyin

    Modula Image Gallery <= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-g

    YüksekCVSS 7,5İstismar yokEPSS %0

    wpchill · modula image gallery – photo grid & video gallery4 gün önce

  • CVE-2026-107746
    30İzleyin

    FunnelKit <= 3.16.0.6 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter

    YüksekCVSS 7,5İstismar yokEPSS %0

    teamfunnelkit · funnelkit – funnel builder plugin for woocommerce checkout4 gün önce

  • CVE-2026-109219
    39İzleyin

    Mang Board <= 2.4.4 - Unauthenticated Arbitrary File Upload via 'image_path' Parameter

    KritikCVSS 9,8İstismar yokEPSS %0

    kitae-park · mang board4 gün önce

  • CVE-2026-109221
    32İzleyin

    Groundhogg <= 4.9.3 - Authenticated (Sales Representative+) Arbitrary File Deletion via CSV Import 'copy_file' Field Mapping

    YüksekCVSS 8,1İstismar yokEPSS %0

    trainingbusinesspros · groundhogg — crm, newsletters, and marketing automation4 gün önce

  • CVE-2026-109400
    30İzleyin

    InstaWP Connect <= 0.1.4.1 - Authenticated (Subscriber+) Privilege Escalation via Role-as-Capability Admin Page and API Key Disclosure via 'instawp_sync_tab_rol

    YüksekCVSS 7,5İstismar yokEPSS %0

    instawp · instawp connect – 1-click wp staging & migration4 gün önce

  • CVE-2026-109515
    39İzleyin

    MailOptin <= 1.2.78.6 - Unauthenticated Privilege Escalation to 'form_custom_field_mappings' Parameter

    KritikCVSS 9,8İstismar yokEPSS %0

    properfraction · mailoptin – popup, optin forms & email newsletters for mailchimp, hubspot, aweber etc.4 gün önce

  • CVE-2026-109998
    28İzleyin

    Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter via content_reply AJAX

    YüksekCVSS 7,2İstismar yokEPSS %0

    kitae-park · mang board4 gün önce

  • CVE-2026-110590
    30İzleyin

    Klarna for WooCommerce <= 4.13.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order-pay' Endpoint

    YüksekCVSS 7,5İstismar yokEPSS %0

    klarnaplugin · klarna for woocommerce4 gün önce

  • CVE-2026-111114
    30İzleyin

    Nexter Extension <= 4.7.11 - Authenticated (Subscriber+) Privilege Escalation to 'reset-view' Parameter

    YüksekCVSS 7,5İstismar yokEPSS %0

    posimyththemes · nexter extension – security, performance, code snippets & site toolkit4 gün önce

  • CVE-2026-100186
    28İzleyin

    User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field

    YüksekCVSS 7,2İstismar yokEPSS %0

    cozmoslabs · user profile builder – beautiful user registration forms, user profiles & user role editor4 gün önce

  • CVE-2026-103768
    39İzleyin

    ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.7 - Unauthenticated Arbitrary File Upload via IMAP Email Attachment

    KritikCVSS 9,8İstismar yokEPSS %0

    elextensions · elex wordpress helpdesk & customer ticketing system4 gün önce

  • CVE-2026-103896
    30İzleyin

    10Web Booster <= 2.34.5 - Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path

    YüksekCVSS 7,5İstismar yokEPSS %0

    10web · 10web booster – website speed optimization, cache & page speed optimizer4 gün önce

  • CVE-2026-103999
    28İzleyin

    Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload

    YüksekCVSS 7,2İstismar yokEPSS %0

    themefic · ultra addons for contact form 74 gün önce

  • CVE-2026-104000
    28İzleyin

    Simply Schedule Appointments <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting via 'status' Parameter via /wp-json/ssa/v1/appointments/{id}

    YüksekCVSS 7,2İstismar yokEPSS %0

    croixhaug · simply schedule appointments4 gün önce

  • CVE-2026-104932
    32İzleyin

    Search Regex 3.5 - Authenticated (Subscriber+) Remote Code Execution via User Meta Serialized String Corruption

    YüksekCVSS 8,0İstismar yokEPSS %0

    johnny5 · search regex4 gün önce

  • CVE-2026-107764
    28İzleyin

    SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector href Sink

    YüksekCVSS 7,2İstismar yokEPSS %0

    gpriday · siteorigin css4 gün önce

  • CVE-2026-109232
    28İzleyin

    Salon Booking System <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX

    YüksekCVSS 7,2İstismar yokEPSS %0

    wordpresschef · salon booking system – appointment booking for salons, barbershops & spas4 gün önce

  • CVE-2026-109447
    32İzleyin

    User Profile Builder <= 4.0.3 - Unauthenticated Privilege Escalation to 'role' Parameter via Legacy Meta-Name Collision on [wppb-register]

    YüksekCVSS 8,1İstismar yokEPSS %0

    cozmoslabs · user profile builder – beautiful user registration forms, user profiles & user role editor4 gün önce

  • CVE-2026-109513
    28İzleyin

    NotificationX <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via 'name' Parameter via popup-submit REST Route

    YüksekCVSS 7,2İstismar yokEPSS %0

    wpdevteam · notificationx – fomo, live sales notification, woocommerce sales popup, gdpr, social proof, announcement banner & floating notification bar4 gün önce

  • CVE-2026-111122
    28İzleyin

    SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspector

    YüksekCVSS 7,2İstismar yokEPSS %0

    gpriday · siteorigin css4 gün önce

  • CVE-2026-85659
    35İzleyin

    PilotPress <= 2.0.43 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover via 'username' Parameter

    YüksekCVSS 8,8İstismar yokEPSS %0

    ontraport · pilotpress4 gün önce

  • CVE-2026-89051
    28İzleyin

    Hide My WP Ghost <= 7.0.12 - Unauthenticated Stored Cross-Site Scripting via Comment Content

    YüksekCVSS 7,2İstismar yokEPSS %0

    johndarrel · hide my wp ghost – security & firewall4 gün önce

  • CVE-2026-89079
    39İzleyin

    Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    jfarthing84 · theme my login4 gün önce

  • CVE-2026-95686
    28İzleyin

    Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter

    YüksekCVSS 7,2İstismar yokEPSS %0

    optiuser · opti-behavior – self-hosted heatmaps, funnels, a/b testing & smart insights4 gün önce

  • CVE-2026-95809
    28İzleyin

    Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter

    YüksekCVSS 7,2İstismar yokEPSS %0

    optiuser · opti-behavior – self-hosted heatmaps, funnels, a/b testing & smart insights4 gün önce

  • CVE-2026-96570
    28İzleyin

    Schema & Structured Data for WP & AMP <= 1.67 - Unauthenticated Stored Cross-Site Scripting via 'saswp_review_text' Parameter

    YüksekCVSS 7,2İstismar yokEPSS %0

    magazine3 · schema & structured data for wp & amp4 gün önce

  • CVE-2026-104715
    31İzleyin

    Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass

    YüksekCVSS 7,8Kavram kanıtıEPSS %0

    red hat · red hat enterprise linux 104 gün önce

  • CVE-2026-104730
    39İzleyin

    Sunshine Photo Cart <= 3.7.4 - Unauthenticated PHP Object Injection via 'key' Parameter

    KritikCVSS 9,8İstismar yokEPSS %0

    sunshinephotocart · sunshine photo cart – client photo gallery & photo proofing for photographers4 gün önce

  • CVE-2026-107768
    28İzleyin

    TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers

    YüksekCVSS 7,2İstismar yokEPSS %0

    cozmoslabs · translatepress – translate multilingual sites with ai translation4 gün önce

  • CVE-2026-109193
    28İzleyin

    HivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value

    YüksekCVSS 7,2İstismar yokEPSS %0

    hivepress · hivepress – business directory, listings & classified ads plugin4 gün önce

  • CVE-2026-110015
    35İzleyin

    Salon Booking System < 10.31.9 - Administrator Account Creation via CSRF

    YüksekCVSS 8,8İstismar yokEPSS %0

    unknown · salon booking system4 gün önce

  • CVE-2026-110135
    29İzleyin

    OTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute Force

    YüksekCVSS 7,4İstismar yokEPSS %0

    unknown · otp login & register woocommerce4 gün önce

  • CVE-2026-110701
    28İzleyin

    CP Multi View Events Calendar <= 1.4.42 - Unauthenticated Stored Cross-Site Scripting via 'CalendarTitle' Parameter

    YüksekCVSS 7,2İstismar yokEPSS %0

    codepeople · cp multi view events calendar4 gün önce

  • CVE-2026-92115
    35İzleyin

    WP Photo Album Plus <= 9.3.02.002 - Authenticated (Custom+) Command Injection via 'value' Parameter (crop item) in update-photo AJAX Action

    YüksekCVSS 8,8İstismar yokEPSS %1

    opajaap · wp photo album plus4 gün önce

  • CVE-2026-92553
    35İzleyin

    YaySMTP <= 2.7.7 - Authenticated (Subscriber+) Arbitrary File Upload via Attachment Filename Extension

    YüksekCVSS 8,8İstismar yokEPSS %0

    yaycommerce · yaysmtp – wp mail smtp with email logs, tracking & reports4 gün önce

  • CVE-2026-94169
    40Planlayın

    WordPress The Grid plugin <= 2.8.1 - Remote Code Execution (RCE) vulnerability

    KritikCVSS 10,0Kavram kanıtıEPSS %0

    theme-one · the grid4 gün önce

  • CVE-2026-94388
    37İzleyin

    WordPress Green Popups plugin < 7.6.3 - SQL Injection vulnerability

    KritikCVSS 9,3İstismar yokEPSS %0

    halfdata · green popups4 gün önce

  • CVE-2026-96339
    28İzleyin

    WordPress Houzez theme <= 4.4.0 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    houzez.co · houzez4 gün önce

  • CVE-2026-97296
    32İzleyin

    WordPress Gravity Forms plugin < 3.1.1 - PHP Object Injection vulnerability

    YüksekCVSS 8,1İstismar yokEPSS %0

    rocketgenius, inc · gravity forms4 gün önce

  • CVE-2026-97640
    28İzleyin

    WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS)

    YüksekCVSS 7,2İstismar yokEPSS %0

    smub · wpconsent – cookie banner & cookie consent for privacy compliance (gdpr / ccpa / eu compliance cookie notice)4 gün önce

  • CVE-2026-16453
    28İzleyin

    Mattermost SAML RelayState forgery allows unauthorized team membership

    YüksekCVSS 7,1İstismar yokEPSS %0

    mattermost · mattermost4 gün önce

  • CVE-2026-75903
    32İzleyin

    Vulnity Security <= 1.4.3 - Unauthenticated Authentication Bypass to Administrator via Exposed Pairing Credentials

    YüksekCVSS 8,1İstismar yokEPSS %0

    manuelgalan · vulnity security4 gün önce

  • CVE-2026-87111
    28İzleyin

    User Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header

    YüksekCVSS 7,2İstismar yokEPSS %0

    wpeverest · user registration pro – custom registration form, login form, and user profile wordpress plugin4 gün önce

  • CVE-2026-101300
    28İzleyin

    Server-Side Request Forgery in Wegow PDF export

    YüksekCVSS 7,1İstismar yokEPSS %0

    wegow technologies · wegow4 gün önce

  • CVE-2026-109224
    28İzleyin

    SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in Comment

    YüksekCVSS 7,2İstismar yokEPSS %0

    surecart · surecart – ecommerce made easy for selling physical products, digital downloads, subscriptions, donations, & payments4 gün önce

  • CVE-2026-111311
    35İzleyin

    DoubleScale | All-in-One CRM <= 1.5.1 - Authenticated (Subscriber+) Arbitrary File Upload via Portal 'ticketless' Attachment Endpoint

    YüksekCVSS 8,8İstismar yokEPSS %0

    samuelgallegos · doublescale crm | all-in-one crm – sales, multi-channel marketing, newsletter, booking, helpdesk, automation, mcp & more4 gün önce

  • CVE-2026-111472
    37İzleyin

    SQL injection in TSG Profleet

    KritikCVSS 9,3İstismar yokEPSS %0

    tsg · profleet4 gün önce

  • CVE-2026-14177
    30İzleyin

    User Enumeration via Password Reset in IKAS Technology Inc.'s ikas E-Commerce Infrastructure

    YüksekCVSS 7,5İstismar yokEPSS %0

    ikas technology inc. · ikas e-commerce infrastructure4 gün önce

  • CVE-2026-92766
    30İzleyin

    Vitepos <= 3.5.1 - Unauthenticated SQL Injection via 'src_by' Parameter

    YüksekCVSS 7,5İstismar yokEPSS %0

    appsbd · vitepos – point of sale (pos) for woocommerce4 gün önce

  • CVE-2026-14452
    34İzleyin

    Open redirect and XSS via reset_url parameter

    YüksekCVSS 8,6İstismar yokEPSS %0

    checkmk gmbh · checkmk4 gün önce

  • CVE-2026-96768
    28İzleyin

    GoSMTP Pro <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Email Log Body

    YüksekCVSS 7,2İstismar yokEPSS %0

    softaculous · gosmtp pro4 gün önce

  • CVE-2026-109119
    35İzleyin

    Missing Authorization in rdiffweb

    YüksekCVSS 8,8İstismar yokEPSS %0

    ikus-soft · rdiffweb4 gün önce

  • CVE-2026-105959
    30İzleyin

    Spice-server: spice: heap buffer overflow via glz dictionary max_encoders integer truncation

    YüksekCVSS 7,5İstismar yokEPSS %0

    red hat · red hat enterprise linux 64 gün önce

  • CVE-2026-107648
    28İzleyin

    WP Sessions Time Monitoring Full Automatic <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting via 'action' GET Parameter

    YüksekCVSS 7,2İstismar yokEPSS %0

    switcorp · wp sessions time monitoring full automatic4 gün önce

  • CVE-2026-111391
    36İzleyin

    SGLang 0.5.10 through 0.5.22 Code Injection via Debug Dumper Filter

    KritikCVSS 9,2İstismar yokEPSS %0

    sgl-project · sglang4 gün önce