Yayın tarihine göre

Ekim 2026: sömürülen ve yeni ciddi CVE kayıtları

6.164 kayıt · 12 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 5 / 62

CVE kayıtları
Aksiyon	CVE	Zafiyet	Ciddiyet	KEV	EPSS	Yayın
35İzleyin	CVE-2026-103625İstismar yok	Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a crgoogle · chrome · CWE-843 Girişsiz RCE	Yüksek8,8	—	%0,3	2 Eki 2026
38İzleyin	CVE-2026-103626İstismar yok	Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engigoogle · chrome · CWE-863 Girişsiz RCE Erişim denetimi (IDOR)	Kritik9,6	—	%0,3	2 Eki 2026
26İzleyin	CVE-2026-103627İstismar yok	Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTMLgoogle · chrome · CWE-200 Kimlik doğrulamasız Bilgi sızıntısı	Orta6,5	—	%0,2	2 Eki 2026
38İzleyin	CVE-2026-103628İstismar yok	Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandboxgoogle · chrome · CWE-787 Girişsiz RCE Bellek hatası	Kritik9,6	—	%0,3	2 Eki 2026
38İzleyin	CVE-2026-103630İstismar yok	Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via google · chrome · CWE-416 Girişsiz RCE Bellek hatası	Kritik9,6	—	%0,3	2 Eki 2026
35İzleyin	CVE-2026-103631İstismar yok	Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox viagoogle · chrome · CWE-122 Girişsiz RCE Bellek hatası	Yüksek8,8	—	%0,4	2 Eki 2026
36İzleyin	CVE-2026-103648Kavram kanıtı	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloaderdemsking · image-downloader · CWE-22 Kimlik doğrulamasız Yol geçişi	Kritik9,1	—	%0,4	2 Eki 2026
30İzleyin	CVE-2026-104845İstismar yok	Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserializationlxsmnsyc · seroval · CWE-770 Kimlik doğrulamasız Deserializasyon Hizmet dışı bırakma	Yüksek7,5	—	%0,4	2 Eki 2026
39İzleyin	CVE-2026-104846İstismar yok	Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)lxsmnsyc · seroval · CWE-843 Kimlik doğrulamasız Deserializasyon	Kritik9,8	—	%0,3	2 Eki 2026
34İzleyin	CVE-2026-104847İstismar yok	ProseMirror: XSS vulnerability in prosemirror-view's paste handlingprosemirror · prosemirror-view · CWE-79 Kimlik doğrulamasız XSS	Yüksek8,5	—	%0,3	2 Eki 2026
28İzleyin	CVE-2026-104908İstismar yok	MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flaggingmisp · misp · CWE-285 Erişim denetimi (IDOR)	Yüksek7,1	—	%0,2	2 Eki 2026
28İzleyin	CVE-2026-104912İstismar yok	MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Datamisp · misp · CWE-284 Erişim denetimi (IDOR)	Yüksek7,1	—	%0,2	2 Eki 2026
39İzleyin	CVE-2026-51898İstismar yok	sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute.CWE-94 Girişsiz RCE	Kritik9,8	—	%0,3	2 Eki 2026
32İzleyin	CVE-2026-51901İstismar yok	SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control.CWE-284 Erişim denetimi (IDOR)	Yüksek8,1	—	%0,2	2 Eki 2026
39İzleyin	CVE-2026-51904İstismar yok	SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller.CWE-284 Kimlik doğrulamasız Erişim denetimi (IDOR)	Kritik9,8	—	%0,4	2 Eki 2026
36İzleyin	CVE-2026-51906İstismar yok	In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability allows attackers to write CWE-22 Kimlik doğrulamasız Yol geçişi	Kritik9,1	—	%0,3	2 Eki 2026
32İzleyin	CVE-2026-51907İstismar yok	In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows attackers to write imaCWE-22 Yol geçişi	Yüksek8,1	—	%0,3	2 Eki 2026
39İzleyin	CVE-2026-51911İstismar yok	vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py).CWE-94 Girişsiz RCE	Kritik9,8	—	%0,9	2 Eki 2026
35İzleyin	CVE-2026-51914İstismar yok	TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller.CWE-284 Erişim denetimi (IDOR)	Yüksek8,8	—	%0,5	2 Eki 2026
39İzleyin	CVE-2026-51915İstismar yok	TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller.CWE-284 Kimlik doğrulamasız Erişim denetimi (IDOR)	Kritik9,8	—	%0,5	2 Eki 2026
30İzleyin	CVE-2026-51916İstismar yok	TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in superagi/controllers/knowCWE-284 Kimlik doğrulamasız Erişim denetimi (IDOR)	Yüksek7,5	—	%0,4	2 Eki 2026
29İzleyin	CVE-2026-51917İstismar yok	FinRobot v1.0.0 is vulnerable to Code Injection in CodingUtils.modify_code.CWE-94 Girişsiz RCE	Yüksek7,3	—	%0,3	2 Eki 2026
39İzleyin	CVE-2026-51918İstismar yok	FinRobot 1.0.0 contains code injection in CodingUtils.create_file_with_code ().CWE-94 Girişsiz RCE	Kritik9,8	—	%0,5	2 Eki 2026
39İzleyin	CVE-2026-51922İstismar yok	agentscope v1.0.20 contains code injection in execute_shell_command (src/agentscope/tool/_coding/_shell.py).CWE-94 Girişsiz RCE	Kritik9,8	—	%0,9	2 Eki 2026
30İzleyin	CVE-2026-67989İstismar yok	crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition CWE-1333 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek7,5	—	%0,3	2 Eki 2026
33İzleyin	CVE-2026-94483İstismar yok	Next.js: Server-Side Request Forgery in Image Optimizationvercel · next.js · CWE-918 Kimlik doğrulamasız SSRF	Yüksek8,3	—	%0,2	2 Eki 2026
25İzleyin	CVE-2026-94484İstismar yok	Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of servicevercel · next.js · CWE-524 Kimlik doğrulamasız	Orta6,3	—	%0,2	2 Eki 2026
25İzleyin	CVE-2026-94543İstismar yok	Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applicationsvercel · next.js · CWE-524 Kimlik doğrulamasız	Orta6,3	—	%0,2	2 Eki 2026
28İzleyin	CVE-2026-96613İstismar yok	Missing Authorization in Meari IoT Cloud Platform OpenAPI Servicemeari · iot cloud platform openapi service · CWE-862 Erişim denetimi (IDOR)	Yüksek7,1	—	%0,2	2 Eki 2026
38İzleyin	CVE-2026-104848İstismar yok	Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Executiontinylibs · tinypool · CWE-1321 Girişsiz RCE Prototype pollution	Kritik9,5	—	%0,4	2 Eki 2026
38İzleyin	CVE-2026-104849İstismar yok	Tinypool: Prototype Pollution Gadget to RCE in run() optionstinylibs · tinypool · CWE-94 Girişsiz RCE Prototype pollution	Kritik9,5	—	%0,3	2 Eki 2026
35İzleyin	CVE-2026-104851İstismar yok	fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Executionfsspec · filesystem_spec · CWE-94 Girişsiz RCE SSTI	Yüksek8,8	—	%0,3	2 Eki 2026
34İzleyin	CVE-2026-104854İstismar yok	Nx daemon and plugin worker sockets are accessible to other local usersnrwl · nx · CWE-269 Yerel yetki yükseltme	Yüksek8,5	—	%0,1	2 Eki 2026
28İzleyin	CVE-2026-102626İstismar yok	LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attributelimesurvey · limesurvey · CWE-79 XSS	Yüksek7,2	—	%0,2	2 Eki 2026
28İzleyin	CVE-2026-102795İstismar yok	Apache Traffic Server: SNI to Host header matching policy is not properly enforcedapache software foundation · apache traffic server · CWE-284 Kimlik doğrulamasız Erişim denetimi (IDOR)	Yüksek7,0	—	%0,2	2 Eki 2026
29İzleyin	CVE-2026-104859İstismar yok	Nx: OS command injection in the @nx/docker release pipelinenrwl · nx · CWE-78 RCE Yerel yetki yükseltme Komut enjeksiyonu	Yüksek7,3	—	%0,1	2 Eki 2026
30İzleyin	CVE-2026-104861İstismar yok	probe-image-size: Quadratic-time Denial of Service in the SVG Parsernodeca · probe-image-size · CWE-400 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek7,5	—	%0,4	2 Eki 2026
35İzleyin	CVE-2026-59265Kavram kanıtı	Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeoverapache software foundation · apache openoffice · CWE-426 Kimlik doğrulamasız	Yüksek8,8	—	%0,4	2 Eki 2026
34İzleyin	CVE-2014-125130İstismar yok	CodeArt Google MP3 Audio Player 1.0.11 Arbitrary File Read via direct_download.phpdamjan · codeart google mp3 audio player · CWE-22 Kimlik doğrulamasız Kimlik doğrulama atlatma Yol geçişi	Yüksek8,7	—	%0,5	2 Eki 2026
34İzleyin	CVE-2020-37278İstismar yok	Weaver e-Bridge Unauthenticated Arbitrary File Read via saveYZJFileweaver · e-bridge · CWE-918 Kimlik doğrulamasız SSRF	Yüksek8,7	—	%0,3	2 Eki 2026
37İzleyin	CVE-2023-54405İstismar yok	H3C CVM Unauthenticated File Upload via fileUpload/upload Tokenh3c · cvm · CWE-434 Girişsiz RCE Yol geçişi Dosya yükleme	Kritik9,3	—	%0,5	2 Eki 2026
40Planlayın	CVE-2026-103956Kavram kanıtı	Missing authentication for critical function in Loom for AWSaws · loom · CWE-306 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik10,0	—	%0,4	2 Eki 2026
32İzleyin	CVE-2026-103957İstismar yok	Server-side request forgery in the OAuth2 discovery handling in Loom for AWSaws · loom · CWE-201 SSRF	Yüksek8,2	—	%0,3	2 Eki 2026
33İzleyin	CVE-2026-103958İstismar yok	Server-side request forgery in the tool server and remote agent connection handling in Loom for AWSaws · loom · CWE-918 SSRF	Yüksek8,3	—	%0,3	2 Eki 2026
35İzleyin	CVE-2026-96940Kavram kanıtı	Microsoft Exchange Server Elevation of Privilege Vulnerabilitymicrosoft · exchange server · CWE-1390 Kimlik doğrulama atlatma	Yüksek8,8	—	%0,4	2 Eki 2026
37İzleyin	CVE-2026-104019İstismar yok	OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution when running on Amazon SageMaker Unified Studioaws · sagemaker-distribution · CWE-78 RCE Komut enjeksiyonu	Kritik9,3	—	%1,4	2 Eki 2026
30İzleyin	CVE-2026-104873İstismar yok	LangGraph SDK custom auth silently ignores actions= on resource decoratorslangchain-ai · langgraph · CWE-863 Erişim denetimi (IDOR)	Yüksek7,6	—	%0,2	2 Eki 2026
32İzleyin	CVE-2026-104988İstismar yok	Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentication bypass allows certificate mis-issuance with arbitrary subjectred hat · red hat certificate system 10 · CWE-290 Kimlik doğrulama atlatma	Yüksek8,1	—	%0,2	2 Eki 2026
28İzleyin	CVE-2026-104991Kavram kanıtı	Phproject < 1.8.7 Missing Authorization via Issues REST APIalanaktion · phproject · CWE-862 Erişim denetimi (IDOR)	Yüksek7,1	—	%0,2	2 Eki 2026
35İzleyin	CVE-2026-39718İstismar yok	WordPress Wallstreet theme <= 2.8.6 - Cross Site Request Forgery (CSRF) vulnerabilitywebriti · wallstreet · CWE-352 Kimlik doğrulamasız CSRF	Yüksek8,8	—	%0,1	2 Eki 2026
34İzleyin	CVE-2026-82039İstismar yok	UTMStack < 11.2.16 SQL Injection via searchGroupsByFilterutmstack · utmstack · CWE-89 RCE SQL enjeksiyonu	Yüksek8,7	—	%0,3	2 Eki 2026
21İzleyin	CVE-2026-82040İstismar yok	UTMStack < 11.2.16 SSRF via IdentityProviderServiceutmstack · utmstack · CWE-918 SSRF	Orta5,3	—	%0,1	2 Eki 2026
37İzleyin	CVE-2026-75937İstismar yok	OS Command Injection in Digi Accelerated Linux (DAL OS)digi international · ix family · CWE-78 Girişsiz RCE Komut enjeksiyonu	Kritik9,4	—	%0,5	2 Eki 2026
26İzleyin	CVE-2026-82041İstismar yok	UTMStack < 11.2.16 Missing Authorization via Command WebSocketutmstack · utmstack · CWE-862 RCE Erişim denetimi (IDOR)	Orta6,5	—	%0,4	2 Eki 2026
37İzleyin	CVE-2026-82042İstismar yok	UTMStack < 11.2.16 Authentication Bypass via InternalApiKeyFilterutmstack · utmstack · CWE-306 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,3	—	%0,5	2 Eki 2026
28İzleyin	CVE-2026-82045İstismar yok	UTMStack < 11.2.16 JPQL Injection via searchPropertyValuesutmstack · utmstack · CWE-89 SQL enjeksiyonu	Yüksek7,1	—	%0,2	2 Eki 2026
34İzleyin	CVE-2026-94591İstismar yok	Armatura LLC Armatura One Use of Hard-coded Cryptographic Keyarmatura llc · armatura one · CWE-321 Gömülü kimlik bilgisi	Yüksek8,6	—	%0,0	2 Eki 2026
34İzleyin	CVE-2026-94592İstismar yok	Armatura LLC Armatura One Use of Hard-coded Credentialsarmatura llc · armatura one · CWE-798 Gömülü kimlik bilgisi	Yüksek8,6	—	%0,1	2 Eki 2026
34İzleyin	CVE-2026-94593İstismar yok	Armatura LLC Armatura One Insertion of Sensitive Information into Log Filearmatura llc · armatura one · CWE-532 Bilgi sızıntısı	Yüksek8,5	—	%0,1	2 Eki 2026
37İzleyin	CVE-2026-95102İstismar yok	Monta monta.app Missing Authentication for Critical Functionmonta · monta.app · CWE-306 Kimlik doğrulamasız Kimlik doğrulama atlatma	Kritik9,3	—	%0,3	2 Eki 2026
34İzleyin	CVE-2026-97363İstismar yok	Monta monta.app Improper Restriction of Excessive Authentication Attemptsmonta · monta.app · CWE-307 Kimlik doğrulamasız	Yüksek8,7	—	%0,3	2 Eki 2026
28İzleyin	CVE-2026-105050İstismar yok	PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation peazip · peazip · CWE-180 RCE Komut enjeksiyonu	Yüksek7,1	—	%0,5	2 Eki 2026
37İzleyin	CVE-2026-84411Kavram kanıtı	MikroTik RouterOS Integer Underflowmikrotik · routeros · CWE-191 Girişsiz RCE Bellek hatası	Kritik9,3	—	%0,9	2 Eki 2026
34İzleyin	CVE-2026-104433İstismar yok	Mooncake before 0.3.12 Out-of-Bounds Read via P2P Handshake readStringkvcache-ai · mooncake · CWE-125 Kimlik doğrulamasız Bellek hatası	Yüksek8,7	—	%0,3	3 Eki 2026
32İzleyin	CVE-2026-104476İstismar yok	Backdrop CMS before 1.35.1 Information Disclosure via Configuration Export Archivebackdrop · backdrop · CWE-200 Kimlik doğrulamasız Bilgi sızıntısı	Yüksek8,2	—	%0,2	3 Eki 2026
28İzleyin	CVE-2026-104478İstismar yok	Formwork before 2.3.13 Path Traversal via BackupController Download and Deletegetformwork · formwork · CWE-22 Yol geçişi	Yüksek7,1	—	%0,3	3 Eki 2026
27İzleyin	CVE-2026-105030Kavram kanıtı	Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard APIrajnandan1 · kener · CWE-200 Kimlik doğrulamasız Bilgi sızıntısı	Orta6,9	—	%0,3	3 Eki 2026
37İzleyin	CVE-2026-105080Kavram kanıtı	In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calic4illin · convertx · CWE-829	Kritik9,4	—	%0,3	3 Eki 2026
30İzleyin	CVE-2026-93428İstismar yok	Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypassultimatemember · ultimate member – user profile, registration, login, member directory, content restriction & membership plugin · CWE-862 Kimlik doğrulamasız Erişim denetimi (IDOR)	Yüksek7,5	—	%0,5	3 Eki 2026
28İzleyin	CVE-2026-96270İstismar yok	Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameterultimatemember · ultimate member – user profile, registration, login, member directory, content restriction & membership plugin · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,2	—	%0,2	3 Eki 2026
35İzleyin	CVE-2026-92536İstismar yok	Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Informaproperfraction · paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress · CWE-94 RCE	Yüksek8,8	—	%0,6	3 Eki 2026
28İzleyin	CVE-2026-92977İstismar yok	Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via Commentdevowl · real cookie banner: gdpr & eprivacy cookie consent · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,2	—	%0,2	3 Eki 2026
35İzleyin	CVE-2026-97644İstismar yok	Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Partrainingbusinesspros · groundhogg — crm, newsletters, and marketing automation · CWE-269	Yüksek8,8	—	%0,4	3 Eki 2026
30İzleyin	CVE-2026-101159İstismar yok	WP Ultimate Review < 2.4.4 - Unauthenticated Stored XSS via Review Submissionunknown · wp ultimate review · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,5	—	%0,2	3 Eki 2026
30İzleyin	CVE-2026-101160Kavram kanıtı	WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Non-Numeric Review Ratingunknown · wp ultimate review · CWE-400 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek7,5	—	%0,3	3 Eki 2026
30İzleyin	CVE-2026-101161Kavram kanıtı	WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Unset Display Settings in wp-reviews Shortcodeunknown · wp ultimate review · CWE-400 Kimlik doğrulamasız Hizmet dışı bırakma	Yüksek7,5	—	%0,3	3 Eki 2026
25İzleyin	CVE-2026-101162Kavram kanıtı	WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settingsunknown · wp ultimate review · CWE-79 XSS	Orta6,4	—	%0,2	3 Eki 2026
32İzleyin	CVE-2026-101923İstismar yok	Photo Reviews for WooCommerce <= 1.2.30 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'wcpr_image_upload_id' Parametervillatheme · photo reviews for woocommerce · CWE-862 Kimlik doğrulamasız Erişim denetimi (IDOR)	Yüksek8,1	—	%0,3	3 Eki 2026
28İzleyin	CVE-2026-101928İstismar yok	Magic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override via Comment Authormagicplugins · magic tooltips for contact form 7 · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,2	—	%0,3	3 Eki 2026
30İzleyin	CVE-2026-103514İstismar yok	WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via TOTP Code Replayunknown · wp 2fa · CWE-287 Kimlik doğrulama atlatma	Yüksek7,5	—	%0,3	3 Eki 2026
30İzleyin	CVE-2026-103913İstismar yok	GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listingpaoltaia · geodirectory – wp business directory plugin and classified listings directory · CWE-89 Kimlik doğrulamasız SQL enjeksiyonu	Yüksek7,5	—	%0,3	3 Eki 2026
28İzleyin	CVE-2026-87091İstismar yok	Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parametersuscnanbu · welcart e-commerce · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,2	—	%0,3	3 Eki 2026
35İzleyin	CVE-2026-88783İstismar yok	Kubio AI Page Builder < 2.9.3 - Unauthenticated Stored XSS via Comment Contentunknown · kubio ai page builder · CWE-79 Kimlik doğrulamasız XSS	Yüksek8,8	—	%0,2	3 Eki 2026
34İzleyin	CVE-2026-89236İstismar yok	SaveTo Wishlist Lite < 1.1.5 - Unauthenticated SQLi via 'sort_column' and 'sort_order' Parametersunknown · saveto wishlist lite · CWE-89 Kimlik doğrulamasız SQL enjeksiyonu	Yüksek8,6	—	%0,2	3 Eki 2026
32İzleyin	CVE-2026-91078İstismar yok	TillKit < 1.0.5 - Unauthenticated POS Takeover via Hard-Coded Default Manager PINunknown · tillkit · CWE-287 Kimlik doğrulamasız Kimlik doğrulama atlatma	Yüksek8,2	—	%0,1	3 Eki 2026
28İzleyin	CVE-2026-93430İstismar yok	GD Rating System <= 3.7.1 - Unauthenticated Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrts_live_handler AJAXgdragon · gd rating system · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,2	—	%0,2	3 Eki 2026
28İzleyin	CVE-2026-96564İstismar yok	SEOPress <= 10.2 - Unauthenticated Stored Cross-Site Scripting via Author Display Namerainbowgeek · seopress – ai seo plugin & on-site seo · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,2	—	%0,2	3 Eki 2026
28İzleyin	CVE-2026-96575İstismar yok	Transliterator <= 2.5.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable {rstr_keep} Placeholderivijanstefan · transliterator – multilingual and multi-script text conversion · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,2	—	%0,2	3 Eki 2026
28İzleyin	CVE-2026-96650İstismar yok	Strong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Fieldwpchill · strong testimonials · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,2	—	%0,2	3 Eki 2026
30İzleyin	CVE-2026-97337İstismar yok	Simple Membership <= 4.8.3 - Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation wpinsider-1 · simple membership · CWE-862 Kimlik doğrulamasız Erişim denetimi (IDOR)	Yüksek7,5	—	%0,3	3 Eki 2026
28İzleyin	CVE-2026-97341İstismar yok	Visitor Traffic Real Time Statistics <= 8.16 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Headerwp-buy · visitor traffic real time statistics · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,2	—	%0,2	3 Eki 2026
35İzleyin	CVE-2026-18443İstismar yok	Smart Manager <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation via 'access_privileges' Parameterstoreapps · smart manager – woocommerce bulk edit: products, orders, users & more (spreadsheet) · CWE-89 SQL enjeksiyonu	Yüksek8,8	—	%0,3	3 Eki 2026
30İzleyin	CVE-2026-75028İstismar yok	WPCafe <= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget Settingarraytics · wpcafe – restaurant menu, online food ordering & table booking system · CWE-98 RCE	Yüksek7,5	—	%0,7	3 Eki 2026
36İzleyin	CVE-2026-87115İstismar yok	VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parametere4jvikwp · vikappointments services booking calendar · CWE-22 Girişsiz RCE Yol geçişi	Kritik9,1	—	%0,8	3 Eki 2026
28İzleyin	CVE-2026-93889İstismar yok	Mail logging <= 2.1.12 - Unauthenticated Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Messagewardee · mail logging & catcher · CWE-79 Kimlik doğrulamasız XSS	Yüksek7,2	—	%0,2	3 Eki 2026
32İzleyin	CVE-2026-94505İstismar yok	Nelio Content <= 4.5.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Reusable Message Deletion via 'id' Parameternelio · nelio content – editorial calendar & social media auto-posting · CWE-862 Erişim denetimi (IDOR)	Yüksek8,1	—	%0,2	3 Eki 2026
30İzleyin	CVE-2026-96267İstismar yok	WP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated SQL Injection via 'fullRef' Parameterosamaesh · wp visitor statistics (real time traffic) · CWE-89 Kimlik doğrulamasız SQL enjeksiyonu	Yüksek7,5	—	%0,3	3 Eki 2026
28İzleyin	CVE-2026-97660İstismar yok	WPC Product Options for WooCommerce <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Namewpclever · wpc product options for woocommerce · CWE-79 Kimlik doğrulamasız Kimlik doğrulama atlatma XSS	Yüksek7,2	—	%0,2	3 Eki 2026
36İzleyin	CVE-2026-92084Kavram kanıtı	Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Outputbeaverbuilder · beaver builder page builder – drag and drop website builder · CWE-94 Girişsiz RCE	Kritik9,1	—	%0,5	3 Eki 2026
32İzleyin	CVE-2026-71883İstismar yok	Native AES packet cipher returns the raw AES key on an aliaslegion of the bouncy castle inc. · bc-lts-java · CWE-200 Kimlik doğrulamasız Bilgi sızıntısı	Yüksek8,2	—	%0,2	3 Eki 2026

CVE-2026-103625
35İzleyin
Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr
YüksekCVSS 8,8İstismar yokEPSS %0
- Girişsiz RCE
google · chrome2 Eki 2026
CVE-2026-103626
38İzleyin
Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engi
KritikCVSS 9,6İstismar yokEPSS %0
- Girişsiz RCE
- Erişim denetimi (IDOR)
google · chrome2 Eki 2026
CVE-2026-103627
26İzleyin
Information leak in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to obtain sensitive information via a crafted HTML
OrtaCVSS 6,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bilgi sızıntısı
google · chrome2 Eki 2026
CVE-2026-103628
38İzleyin
Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox
KritikCVSS 9,6İstismar yokEPSS %0
- Girişsiz RCE
- Bellek hatası
google · chrome2 Eki 2026
CVE-2026-103630
38İzleyin
Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via
KritikCVSS 9,6İstismar yokEPSS %0
- Girişsiz RCE
- Bellek hatası
google · chrome2 Eki 2026
CVE-2026-103631
35İzleyin
Buffer overflow in WebRTC in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via
YüksekCVSS 8,8İstismar yokEPSS %0
- Girişsiz RCE
- Bellek hatası
google · chrome2 Eki 2026
CVE-2026-103648
36İzleyin
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in image-downloader
KritikCVSS 9,1Kavram kanıtıEPSS %0
- Kimlik doğrulamasız
- Yol geçişi
demsking · image-downloader2 Eki 2026
CVE-2026-104845
30İzleyin
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Deserializasyon
- Hizmet dışı bırakma
lxsmnsyc · seroval2 Eki 2026
CVE-2026-104846
39İzleyin
Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Deserializasyon
lxsmnsyc · seroval2 Eki 2026
CVE-2026-104847
34İzleyin
ProseMirror: XSS vulnerability in prosemirror-view's paste handling
YüksekCVSS 8,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
prosemirror · prosemirror-view2 Eki 2026
CVE-2026-104908
28İzleyin
MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging
YüksekCVSS 7,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
misp · misp2 Eki 2026
CVE-2026-104912
28İzleyin
MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data
YüksekCVSS 7,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
misp · misp2 Eki 2026
CVE-2026-51898
39İzleyin
sinaptik-ai pandas-ai 3.0.0 is vulnerable to Code Injection in CodeExecutor.execute.
KritikCVSS 9,8İstismar yokEPSS %0
- Girişsiz RCE
2 Eki 2026
CVE-2026-51901
32İzleyin
SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control.
YüksekCVSS 8,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
2 Eki 2026
CVE-2026-51904
39İzleyin
SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller.
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
2 Eki 2026
CVE-2026-51906
36İzleyin
In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability allows attackers to write
KritikCVSS 9,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- Yol geçişi
2 Eki 2026
CVE-2026-51907
32İzleyin
In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows attackers to write ima
YüksekCVSS 8,1İstismar yokEPSS %0
- Yol geçişi
2 Eki 2026
CVE-2026-51911
39İzleyin
vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py).
KritikCVSS 9,8İstismar yokEPSS %0
- Girişsiz RCE
2 Eki 2026
CVE-2026-51914
35İzleyin
TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller.
YüksekCVSS 8,8İstismar yokEPSS %0
- Erişim denetimi (IDOR)
2 Eki 2026
CVE-2026-51915
39İzleyin
TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller.
KritikCVSS 9,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
2 Eki 2026
CVE-2026-51916
30İzleyin
TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in superagi/controllers/know
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
2 Eki 2026
CVE-2026-51917
29İzleyin
FinRobot v1.0.0 is vulnerable to Code Injection in CodingUtils.modify_code.
YüksekCVSS 7,3İstismar yokEPSS %0
- Girişsiz RCE
2 Eki 2026
CVE-2026-51918
39İzleyin
FinRobot 1.0.0 contains code injection in CodingUtils.create_file_with_code ().
KritikCVSS 9,8İstismar yokEPSS %0
- Girişsiz RCE
2 Eki 2026
CVE-2026-51922
39İzleyin
agentscope v1.0.20 contains code injection in execute_shell_command (src/agentscope/tool/_coding/_shell.py).
KritikCVSS 9,8İstismar yokEPSS %0
- Girişsiz RCE
2 Eki 2026
CVE-2026-67989
30İzleyin
crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
2 Eki 2026
CVE-2026-94483
33İzleyin
Next.js: Server-Side Request Forgery in Image Optimization
YüksekCVSS 8,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- SSRF
vercel · next.js2 Eki 2026
CVE-2026-94484
25İzleyin
Next.js: Cache poisoning in Next.js SSG/ISR rendering leads to cross-user content substitution and persistent denial of service
OrtaCVSS 6,3İstismar yokEPSS %0
- Kimlik doğrulamasız
vercel · next.js2 Eki 2026
CVE-2026-94543
25İzleyin
Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications
OrtaCVSS 6,3İstismar yokEPSS %0
- Kimlik doğrulamasız
vercel · next.js2 Eki 2026
CVE-2026-96613
28İzleyin
Missing Authorization in Meari IoT Cloud Platform OpenAPI Service
YüksekCVSS 7,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
meari · iot cloud platform openapi service2 Eki 2026
CVE-2026-104848
38İzleyin
Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution
KritikCVSS 9,5İstismar yokEPSS %0
- Girişsiz RCE
- Prototype pollution
tinylibs · tinypool2 Eki 2026
CVE-2026-104849
38İzleyin
Tinypool: Prototype Pollution Gadget to RCE in run() options
KritikCVSS 9,5İstismar yokEPSS %0
- Girişsiz RCE
- Prototype pollution
tinylibs · tinypool2 Eki 2026
CVE-2026-104851
35İzleyin
fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code Execution
YüksekCVSS 8,8İstismar yokEPSS %0
- Girişsiz RCE
- SSTI
fsspec · filesystem_spec2 Eki 2026
CVE-2026-104854
34İzleyin
Nx daemon and plugin worker sockets are accessible to other local users
YüksekCVSS 8,5İstismar yokEPSS %0
- Yerel yetki yükseltme
nrwl · nx2 Eki 2026
CVE-2026-102626
28İzleyin
LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute
YüksekCVSS 7,2İstismar yokEPSS %0
- XSS
limesurvey · limesurvey2 Eki 2026
CVE-2026-102795
28İzleyin
Apache Traffic Server: SNI to Host header matching policy is not properly enforced
YüksekCVSS 7,0İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
apache software foundation · apache traffic server2 Eki 2026
CVE-2026-104859
29İzleyin
Nx: OS command injection in the @nx/docker release pipeline
YüksekCVSS 7,3İstismar yokEPSS %0
- RCE
- Yerel yetki yükseltme
- Komut enjeksiyonu
nrwl · nx2 Eki 2026
CVE-2026-104861
30İzleyin
probe-image-size: Quadratic-time Denial of Service in the SVG Parser
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
nodeca · probe-image-size2 Eki 2026
CVE-2026-59265
35İzleyin
Apache OpenOffice, Apache OpenOffice: Opening a malicious document can lead to system takeover
YüksekCVSS 8,8Kavram kanıtıEPSS %0
- Kimlik doğrulamasız
apache software foundation · apache openoffice2 Eki 2026
CVE-2014-125130
34İzleyin
CodeArt Google MP3 Audio Player 1.0.11 Arbitrary File Read via direct_download.php
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
- Yol geçişi
damjan · codeart google mp3 audio player2 Eki 2026
CVE-2020-37278
34İzleyin
Weaver e-Bridge Unauthenticated Arbitrary File Read via saveYZJFile
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- SSRF
weaver · e-bridge2 Eki 2026
CVE-2023-54405
37İzleyin
H3C CVM Unauthenticated File Upload via fileUpload/upload Token
KritikCVSS 9,3İstismar yokEPSS %0
- Girişsiz RCE
- Yol geçişi
- Dosya yükleme
h3c · cvm2 Eki 2026
CVE-2026-103956
40Planlayın
Missing authentication for critical function in Loom for AWS
KritikCVSS 10,0Kavram kanıtıEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
aws · loom2 Eki 2026
CVE-2026-103957
32İzleyin
Server-side request forgery in the OAuth2 discovery handling in Loom for AWS
YüksekCVSS 8,2İstismar yokEPSS %0
- SSRF
aws · loom2 Eki 2026
CVE-2026-103958
33İzleyin
Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS
YüksekCVSS 8,3İstismar yokEPSS %0
- SSRF
aws · loom2 Eki 2026
CVE-2026-96940
35İzleyin
Microsoft Exchange Server Elevation of Privilege Vulnerability
YüksekCVSS 8,8Kavram kanıtıEPSS %0
- Kimlik doğrulama atlatma
microsoft · exchange server2 Eki 2026
CVE-2026-104019
37İzleyin
OS command injection in the Studio Space startup validation script in Amazon SageMaker Distribution when running on Amazon SageMaker Unified Studio
KritikCVSS 9,3İstismar yokEPSS %1
- RCE
- Komut enjeksiyonu
aws · sagemaker-distribution2 Eki 2026
CVE-2026-104873
30İzleyin
LangGraph SDK custom auth silently ignores actions= on resource decorators
YüksekCVSS 7,6İstismar yokEPSS %0
- Erişim denetimi (IDOR)
langchain-ai · langgraph2 Eki 2026
CVE-2026-104988
32İzleyin
Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject
YüksekCVSS 8,1İstismar yokEPSS %0
- Kimlik doğrulama atlatma
red hat · red hat certificate system 102 Eki 2026
CVE-2026-104991
28İzleyin
Phproject < 1.8.7 Missing Authorization via Issues REST API
YüksekCVSS 7,1Kavram kanıtıEPSS %0
- Erişim denetimi (IDOR)
alanaktion · phproject2 Eki 2026
CVE-2026-39718
35İzleyin
WordPress Wallstreet theme <= 2.8.6 - Cross Site Request Forgery (CSRF) vulnerability
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- CSRF
webriti · wallstreet2 Eki 2026
CVE-2026-82039
34İzleyin
UTMStack < 11.2.16 SQL Injection via searchGroupsByFilter
YüksekCVSS 8,7İstismar yokEPSS %0
- RCE
- SQL enjeksiyonu
utmstack · utmstack2 Eki 2026
CVE-2026-82040
21İzleyin
UTMStack < 11.2.16 SSRF via IdentityProviderService
OrtaCVSS 5,3İstismar yokEPSS %0
- SSRF
utmstack · utmstack2 Eki 2026
CVE-2026-75937
37İzleyin
OS Command Injection in Digi Accelerated Linux (DAL OS)
KritikCVSS 9,4İstismar yokEPSS %0
- Girişsiz RCE
- Komut enjeksiyonu
digi international · ix family2 Eki 2026
CVE-2026-82041
26İzleyin
UTMStack < 11.2.16 Missing Authorization via Command WebSocket
OrtaCVSS 6,5İstismar yokEPSS %0
- RCE
- Erişim denetimi (IDOR)
utmstack · utmstack2 Eki 2026
CVE-2026-82042
37İzleyin
UTMStack < 11.2.16 Authentication Bypass via InternalApiKeyFilter
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
utmstack · utmstack2 Eki 2026
CVE-2026-82045
28İzleyin
UTMStack < 11.2.16 JPQL Injection via searchPropertyValues
YüksekCVSS 7,1İstismar yokEPSS %0
- SQL enjeksiyonu
utmstack · utmstack2 Eki 2026
CVE-2026-94591
34İzleyin
Armatura LLC Armatura One Use of Hard-coded Cryptographic Key
YüksekCVSS 8,6İstismar yokEPSS %0
- Gömülü kimlik bilgisi
armatura llc · armatura one2 Eki 2026
CVE-2026-94592
34İzleyin
Armatura LLC Armatura One Use of Hard-coded Credentials
YüksekCVSS 8,6İstismar yokEPSS %0
- Gömülü kimlik bilgisi
armatura llc · armatura one2 Eki 2026
CVE-2026-94593
34İzleyin
Armatura LLC Armatura One Insertion of Sensitive Information into Log File
YüksekCVSS 8,5İstismar yokEPSS %0
- Bilgi sızıntısı
armatura llc · armatura one2 Eki 2026
CVE-2026-95102
37İzleyin
Monta monta.app Missing Authentication for Critical Function
KritikCVSS 9,3İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
monta · monta.app2 Eki 2026
CVE-2026-97363
34İzleyin
Monta monta.app Improper Restriction of Excessive Authentication Attempts
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
monta · monta.app2 Eki 2026
CVE-2026-105050
28İzleyin
PeaZip before 11.3.0, in a non-default configuration, is vulnerable to OS command injection via a filename in an archive because "quotation
YüksekCVSS 7,1İstismar yokEPSS %0
- RCE
- Komut enjeksiyonu
peazip · peazip2 Eki 2026
CVE-2026-84411
37İzleyin
MikroTik RouterOS Integer Underflow
KritikCVSS 9,3Kavram kanıtıEPSS %0
- Girişsiz RCE
- Bellek hatası
mikrotik · routeros2 Eki 2026
CVE-2026-104433
34İzleyin
Mooncake before 0.3.12 Out-of-Bounds Read via P2P Handshake readString
YüksekCVSS 8,7İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bellek hatası
kvcache-ai · mooncake3 Eki 2026
CVE-2026-104476
32İzleyin
Backdrop CMS before 1.35.1 Information Disclosure via Configuration Export Archive
YüksekCVSS 8,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bilgi sızıntısı
backdrop · backdrop3 Eki 2026
CVE-2026-104478
28İzleyin
Formwork before 2.3.13 Path Traversal via BackupController Download and Delete
YüksekCVSS 7,1İstismar yokEPSS %0
- Yol geçişi
getformwork · formwork3 Eki 2026
CVE-2026-105030
27İzleyin
Kener 4.0.0 before 4.1.6 Hidden Monitor Data Disclosure via Dashboard API
OrtaCVSS 6,9Kavram kanıtıEPSS %0
- Kimlik doğrulamasız
- Bilgi sızıntısı
rajnandan1 · kener3 Eki 2026
CVE-2026-105080
37İzleyin
In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Cali
KritikCVSS 9,4Kavram kanıtıEPSS %0
c4illin · convertx3 Eki 2026
CVE-2026-93428
30İzleyin
Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
ultimatemember · ultimate member – user profile, registration, login, member directory, content restriction & membership plugin3 Eki 2026
CVE-2026-96270
28İzleyin
Ultimate Member <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'form_id' Parameter
YüksekCVSS 7,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
ultimatemember · ultimate member – user profile, registration, login, member directory, content restriction & membership plugin3 Eki 2026
CVE-2026-92536
35İzleyin
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.17.4 - Authenticated (Subscriber+) Sensitive Informa
YüksekCVSS 8,8İstismar yokEPSS %0
- RCE
properfraction · paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepress3 Eki 2026
CVE-2026-92977
28İzleyin
Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via Comment
YüksekCVSS 7,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
devowl · real cookie banner: gdpr & eprivacy cookie consent3 Eki 2026
CVE-2026-97644
35İzleyin
Groundhogg <= 4.9 - Authenticated (Sales Person+) Privilege Escalation via Contact Identity Rebinding leading to Administrator Account Takeover to 'user_id' Par
YüksekCVSS 8,8İstismar yokEPSS %0
trainingbusinesspros · groundhogg — crm, newsletters, and marketing automation3 Eki 2026
CVE-2026-101159
30İzleyin
WP Ultimate Review < 2.4.4 - Unauthenticated Stored XSS via Review Submission
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
unknown · wp ultimate review3 Eki 2026
CVE-2026-101160
30İzleyin
WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Non-Numeric Review Rating
YüksekCVSS 7,5Kavram kanıtıEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
unknown · wp ultimate review3 Eki 2026
CVE-2026-101161
30İzleyin
WP Ultimate Review < 2.4.4 - Unauthenticated DoS via Unset Display Settings in wp-reviews Shortcode
YüksekCVSS 7,5Kavram kanıtıEPSS %0
- Kimlik doğrulamasız
- Hizmet dışı bırakma
unknown · wp ultimate review3 Eki 2026
CVE-2026-101162
25İzleyin
WP Ultimate Review < 2.4.4 - Author+ Stored XSS via Review Overview Settings
OrtaCVSS 6,4Kavram kanıtıEPSS %0
- XSS
unknown · wp ultimate review3 Eki 2026
CVE-2026-101923
32İzleyin
Photo Reviews for WooCommerce <= 1.2.30 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'wcpr_image_upload_id' Parameter
YüksekCVSS 8,1İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
villatheme · photo reviews for woocommerce3 Eki 2026
CVE-2026-101928
28İzleyin
Magic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override via Comment Author
YüksekCVSS 7,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
magicplugins · magic tooltips for contact form 73 Eki 2026
CVE-2026-103514
30İzleyin
WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via TOTP Code Replay
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulama atlatma
unknown · wp 2fa3 Eki 2026
CVE-2026-103913
30İzleyin
GeoDirectory <= 2.8.186 - Unauthenticated SQL Injection via 'latitude' Parameter via Stored Pending Listing
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- SQL enjeksiyonu
paoltaia · geodirectory – wp business directory plugin and classified listings directory3 Eki 2026
CVE-2026-87091
28İzleyin
Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters
YüksekCVSS 7,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
uscnanbu · welcart e-commerce3 Eki 2026
CVE-2026-88783
35İzleyin
Kubio AI Page Builder < 2.9.3 - Unauthenticated Stored XSS via Comment Content
YüksekCVSS 8,8İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
unknown · kubio ai page builder3 Eki 2026
CVE-2026-89236
34İzleyin
SaveTo Wishlist Lite < 1.1.5 - Unauthenticated SQLi via 'sort_column' and 'sort_order' Parameters
YüksekCVSS 8,6İstismar yokEPSS %0
- Kimlik doğrulamasız
- SQL enjeksiyonu
unknown · saveto wishlist lite3 Eki 2026
CVE-2026-91078
32İzleyin
TillKit < 1.0.5 - Unauthenticated POS Takeover via Hard-Coded Default Manager PIN
YüksekCVSS 8,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
unknown · tillkit3 Eki 2026
CVE-2026-93430
28İzleyin
GD Rating System <= 3.7.1 - Unauthenticated Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrts_live_handler AJAX
YüksekCVSS 7,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
gdragon · gd rating system3 Eki 2026
CVE-2026-96564
28İzleyin
SEOPress <= 10.2 - Unauthenticated Stored Cross-Site Scripting via Author Display Name
YüksekCVSS 7,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
rainbowgeek · seopress – ai seo plugin & on-site seo3 Eki 2026
CVE-2026-96575
28İzleyin
Transliterator <= 2.5.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable {rstr_keep} Placeholder
YüksekCVSS 7,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
ivijanstefan · transliterator – multilingual and multi-script text conversion3 Eki 2026
CVE-2026-96650
28İzleyin
Strong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Field
YüksekCVSS 7,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
wpchill · strong testimonials3 Eki 2026
CVE-2026-97337
30İzleyin
Simple Membership <= 4.8.3 - Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- Erişim denetimi (IDOR)
wpinsider-1 · simple membership3 Eki 2026
CVE-2026-97341
28İzleyin
Visitor Traffic Real Time Statistics <= 8.16 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header
YüksekCVSS 7,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
wp-buy · visitor traffic real time statistics3 Eki 2026
CVE-2026-18443
35İzleyin
Smart Manager <= 8.97.0 - Authenticated (Subscriber+) SQL Injection to Privilege Escalation via 'access_privileges' Parameter
YüksekCVSS 8,8İstismar yokEPSS %0
- SQL enjeksiyonu
storeapps · smart manager – woocommerce bulk edit: products, orders, users & more (spreadsheet)3 Eki 2026
CVE-2026-75028
30İzleyin
WPCafe <= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget Setting
YüksekCVSS 7,5İstismar yokEPSS %0
- RCE
arraytics · wpcafe – restaurant menu, online food ordering & table booking system3 Eki 2026
CVE-2026-87115
36İzleyin
VikAppointments Services Booking Calendar <= 1.2.21 - Unauthenticated Arbitrary File Deletion via 'old_vapcfN' Parameter
KritikCVSS 9,1İstismar yokEPSS %0
- Girişsiz RCE
- Yol geçişi
e4jvikwp · vikappointments services booking calendar3 Eki 2026
CVE-2026-93889
28İzleyin
Mail logging <= 2.1.12 - Unauthenticated Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message
YüksekCVSS 7,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- XSS
wardee · mail logging & catcher3 Eki 2026
CVE-2026-94505
32İzleyin
Nelio Content <= 4.5.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Reusable Message Deletion via 'id' Parameter
YüksekCVSS 8,1İstismar yokEPSS %0
- Erişim denetimi (IDOR)
nelio · nelio content – editorial calendar & social media auto-posting3 Eki 2026
CVE-2026-96267
30İzleyin
WP Visitor Statistics (Real Time Traffic) <= 8.7 - Unauthenticated SQL Injection via 'fullRef' Parameter
YüksekCVSS 7,5İstismar yokEPSS %0
- Kimlik doğrulamasız
- SQL enjeksiyonu
osamaesh · wp visitor statistics (real time traffic)3 Eki 2026
CVE-2026-97660
28İzleyin
WPC Product Options for WooCommerce <= 4.0.5 - Unauthenticated Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name
YüksekCVSS 7,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- Kimlik doğrulama atlatma
- XSS
wpclever · wpc product options for woocommerce3 Eki 2026
CVE-2026-92084
36İzleyin
Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output
KritikCVSS 9,1Kavram kanıtıEPSS %0
- Girişsiz RCE
beaverbuilder · beaver builder page builder – drag and drop website builder3 Eki 2026
CVE-2026-71883
32İzleyin
Native AES packet cipher returns the raw AES key on an alias
YüksekCVSS 8,2İstismar yokEPSS %0
- Kimlik doğrulamasız
- Bilgi sızıntısı
legion of the bouncy castle inc. · bc-lts-java3 Eki 2026