Yayın tarihine göre
Ekim 2026: sömürülen ve yeni ciddi CVE kayıtları
8.747 kayıt · 22 KEV. Yayın sırasıyla.
Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.
Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.
Sayfa 50 / 88
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
34İzleyin | CVE-2026-111612İstismar yok | netdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuthqaiu · netdisk-fast-download · CWE-321 | Yüksek8,7 | — | %0,4 | 16 Eki 2026 |
34İzleyin | CVE-2026-111613İstismar yok | AllData through 0.7.1 Unauthenticated JDBC Injection via /jobJdbcDatasource/testalldatacenter · alldata · CWE-306 | Yüksek8,7 | — | %0,5 | 16 Eki 2026 |
28İzleyin | CVE-2026-111614İstismar yok | DataCap through 2025.1.1 IDOR via BaseController.getInfoForPath Exposes Credentialsdevlive-community · datacap · CWE-639 | Yüksek7,1 | — | %0,3 | 16 Eki 2026 |
28İzleyin | CVE-2026-111615İstismar yok | Mall4cloud through 4.0 IDOR Exposing Buyer Addresses via order_addr Endpointgz-yami · mall4cloud · CWE-639 | Yüksek7,1 | — | %0,3 | 16 Eki 2026 |
28İzleyin | CVE-2026-111619İstismar yok | FilePress through 3.0.1 SQL Injection via asc Parameter in filelist.phpzyx0814 · filepress · CWE-89 | Yüksek7,1 | — | %0,4 | 16 Eki 2026 |
30İzleyin | CVE-2026-111622İstismar yok | smart-sso through 2.1.1 OAuth2 Authorization Code Theft via Unvalidated redirectUria466350665 · smart-sso · CWE-601 | Yüksek7,6 | — | %0,4 | 16 Eki 2026 |
37İzleyin | CVE-2026-111626İstismar yok | Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllerswebreaper · damselfly · CWE-306 | Kritik9,3 | — | %0,4 | 16 Eki 2026 |
34İzleyin | CVE-2026-111627İstismar yok | HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creationhestiacp · hestiacp · CWE-863 | Yüksek8,6 | — | %0,5 | 16 Eki 2026 |
35İzleyin | CVE-2026-111633İstismar yok | ZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing Keyseriawei · zkeacms · CWE-321 | Yüksek8,8 | — | %0,4 | 16 Eki 2026 |
34İzleyin | CVE-2026-111634İstismar yok | Helical Insight through 7.0.0 SQL Injection via /executeDatasourcehelicalinsight · helicalinsight · CWE-89 | Yüksek8,6 | — | %0,3 | 16 Eki 2026 |
36İzleyin | CVE-2026-111636İstismar yok | OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secretopenbmb · staffdeck · CWE-321 | Kritik9,2 | — | %0,4 | 16 Eki 2026 |
33İzleyin | CVE-2026-111638İstismar yok | sshportal through 1.19.5 Missing Authorization in 'key show' Command Exposes Private Keysmoul · sshportal · CWE-862 | Yüksek8,3 | — | %0,3 | 16 Eki 2026 |
34İzleyin | CVE-2026-111639İstismar yok | bbs-go through 4.4.6 Account Takeover via Google One Tap Loginmlogclub · bbs-go · CWE-287 | Yüksek8,6 | — | %0,4 | 16 Eki 2026 |
37İzleyin | CVE-2026-111641İstismar yok | FastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpointsfastapiadmin · fastapiadmin · CWE-306 | Kritik9,3 | — | %0,4 | 16 Eki 2026 |
34İzleyin | CVE-2026-111642İstismar yok | FastapiAdmin through 3.0 Hard-Coded JWT Secret Privilege Escalationfastapiadmin · fastapiadmin · CWE-321 | Yüksek8,7 | — | %0,3 | 16 Eki 2026 |
37İzleyin | CVE-2026-111643İstismar yok | Misaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Rollbackl429609201 · misaka_danmu_server · CWE-306 | Kritik9,3 | — | %0,5 | 16 Eki 2026 |
32İzleyin | CVE-2026-111646İstismar yok | SurveyKing before 1.13.0 Unauthenticated File Download via /api/public/previewjavahuang · surveyking · CWE-862 | Yüksek8,2 | — | %0,3 | 16 Eki 2026 |
28İzleyin | CVE-2026-111649İstismar yok | Rocboss paopao-ce through 0.6.0-alpha.3 IDOR via DownloadAttachment Endpointrocboss · paopao-ce · CWE-639 | Yüksek7,1 | — | %0,3 | 16 Eki 2026 |
35İzleyin | CVE-2026-111650İstismar yok | ChronoFrame through 1.0.0 Missing Authentication via Setup Wizard APIhoshinosuzumi · chronoframe · CWE-306 | Yüksek8,8 | — | %0,4 | 16 Eki 2026 |
28İzleyin | CVE-2026-111651İstismar yok | Risesoft Digital-Infrastructure through 9.6.11 Cross-Tenant Data Exposure via DownloadControllerrisesoft-y9 · digital-infrastructure · CWE-639 | Yüksek7,1 | — | %0,3 | 16 Eki 2026 |
36İzleyin | CVE-2026-111663İstismar yok | Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutationchaskiq · chaskiq · CWE-918 | Kritik9,2 | — | %0,3 | 16 Eki 2026 |
28İzleyin | CVE-2026-111669İstismar yok | ZR.Admin.NET through 3.8.2 SQL Injection via PagerInfo.Sort ORDER BYizhaorui · zr.admin.net · CWE-89 | Yüksek7,1 | — | %0,4 | 16 Eki 2026 |
28İzleyin | CVE-2026-111671İstismar yok | Cube-studio through 2026.09.01 IDOR via Notebook and Serving Lifecycle Endpointsdata-infra · cube-studio · CWE-639 | Yüksek7,1 | — | %0,3 | 16 Eki 2026 |
37İzleyin | CVE-2026-111673İstismar yok | IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpointsthecosy · icecms · CWE-306 | Kritik9,3 | — | %0,5 | 16 Eki 2026 |
36İzleyin | CVE-2026-111675İstismar yok | Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeoverxiaochong0302 · course-tencent-cloud · CWE-307 | Kritik9,1 | — | %0,5 | 16 Eki 2026 |
28İzleyin | CVE-2026-111680İstismar yok | APIPark through 1.9.7-beta Cross-Team Authorization Bypass via Team Query Parameterapiparklab · apipark · CWE-639 | Yüksek7,2 | — | %0,3 | 16 Eki 2026 |
34İzleyin | CVE-2026-111681İstismar yok | EFAK through 5.1.0 Privilege Escalation via /api/users REST APIsmartloli · efak · CWE-862 | Yüksek8,7 | — | %0,2 | 16 Eki 2026 |
28İzleyin | CVE-2026-111682İstismar yok | EFAK 5.0.0 through 5.1.0 Missing Authorization via /api/model-config Exposes API Keyssmartloli · efak · CWE-862 | Yüksek7,1 | — | %0,3 | 16 Eki 2026 |
28İzleyin | CVE-2026-111684İstismar yok | Magistrala through 1.0.0 Cross-Tenant Authorization Bypass in Certs Serviceabsmach · magistrala · CWE-639 | Yüksek7,2 | — | %0,2 | 16 Eki 2026 |
34İzleyin | CVE-2026-111685İstismar yok | IceCMS through 4.1.5 SQL Injection via /WebResource/findresourcebynumthecosy · icecms · CWE-89 | Yüksek8,7 | — | %0,5 | 16 Eki 2026 |
34İzleyin | CVE-2026-111686İstismar yok | IceCMS through 4.1.5 SQL Injection via /WebArticle/findarticlesbynumthecosy · icecms · CWE-89 | Yüksek8,7 | — | %0,4 | 16 Eki 2026 |
37İzleyin | CVE-2026-111687İstismar yok | WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpointrachelos · we-mp-rss · CWE-95 | Kritik9,3 | — | %1,0 | 16 Eki 2026 |
37İzleyin | CVE-2026-111690İstismar yok | Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypasssuyuan32 · simple-admin-core · CWE-321 | Kritik9,3 | — | %0,5 | 16 Eki 2026 |
36İzleyin | CVE-2026-111691İstismar yok | WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Headerwimoor-erp · wimoor · CWE-290 | Kritik9,1 | — | %0,4 | 16 Eki 2026 |
37İzleyin | CVE-2026-111692İstismar yok | DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secretdatabufflabs · databuff · CWE-321 | Kritik9,3 | — | %0,6 | 16 Eki 2026 |
37İzleyin | CVE-2026-111693İstismar yok | DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentialsdatabufflabs · databuff · CWE-1392 | Kritik9,3 | — | %0,4 | 16 Eki 2026 |
28İzleyin | CVE-2026-111695İstismar yok | Shaiwz data-platform-open through commit efeacd3 IDOR in Datasource APIshaiwz · data-platform-open · CWE-639 | Yüksek7,1 | — | %0,3 | 16 Eki 2026 |
28İzleyin | CVE-2026-111696İstismar yok | data-platform-open through commit efeacd3 Hardcoded AES Key for Datasource Passwordsshaiwz · data-platform-open · CWE-321 | Yüksek7,1 | — | %0,3 | 16 Eki 2026 |
28İzleyin | CVE-2026-111697İstismar yok | HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIsroinli · huizhi-chargeos-cloud · CWE-639 | Yüksek7,1 | — | %0,3 | 16 Eki 2026 |
28İzleyin | CVE-2026-111698İstismar yok | HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRechargeroinli · huizhi-chargeos-cloud · CWE-639 | Yüksek7,1 | — | %0,3 | 16 Eki 2026 |
28İzleyin | CVE-2026-111700İstismar yok | WebVella ERP through 1.8.8 SQL Injection via EQL Query APIwebvella · webvella-erp · CWE-89 | Yüksek7,1 | — | %0,2 | 16 Eki 2026 |
33İzleyin | CVE-2026-111701İstismar yok | OtterMind Nubase through 0.1.4 Missing Authentication in Storage Object APIottermind · nubase · CWE-306 | Yüksek8,3 | — | %0,3 | 16 Eki 2026 |
34İzleyin | CVE-2026-111702İstismar yok | ChatOllama through commit 96c3ce5 IDOR Exposes Private Knowledge Basessugarforever · chat-ollama · CWE-639 | Yüksek8,7 | — | %0,4 | 16 Eki 2026 |
37İzleyin | CVE-2026-111704İstismar yok | LangChat through commit 2a6285a Missing Authentication on REST API Controllerslangchat · langchat · CWE-306 | Kritik9,3 | — | %0,6 | 16 Eki 2026 |
34İzleyin | CVE-2026-111706İstismar yok | 99AI through 4.3.0 Unauthenticated Information Disclosure via chatLog exportExcelvastxie · 99ai · CWE-306 | Yüksek8,7 | — | %0,3 | 16 Eki 2026 |
37İzleyin | CVE-2026-111708İstismar yok | WhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signupcanove · whaticket-community · CWE-269 | Kritik9,3 | — | %0,5 | 16 Eki 2026 |
34İzleyin | CVE-2026-111710İstismar yok | Netcore NR256CN through 1.5.140116 Boa Web Server NULL Pointer Dereference DoSnetcore · nr256cn · CWE-476 | Yüksek8,7 | — | %0,2 | 16 Eki 2026 |
37İzleyin | CVE-2026-111711İstismar yok | Netcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok()netcore · nr256cn · CWE-121 | Kritik9,3 | — | %0,4 | 16 Eki 2026 |
28İzleyin | CVE-2026-111718İstismar yok | AipexBase through commit 690adb9 SQL Injection via /api/data/invokekuafuai · aipexbase · CWE-89 | Yüksek7,1 | — | %0,3 | 16 Eki 2026 |
32İzleyin | CVE-2026-111719İstismar yok | Roncoo-pay through commit 9428382 Information Disclosure via /f2fPay/order/queryroncoo · roncoo-pay · CWE-306 | Yüksek8,2 | — | %0,3 | 16 Eki 2026 |
34İzleyin | CVE-2026-111722İstismar yok | LingGuo-Drama through commit 8a6924a IDOR via /admin/v1/projects/:id APIlingguoai · lingguo-drama · CWE-639 | Yüksek8,6 | — | %0,3 | 16 Eki 2026 |
34İzleyin | CVE-2026-111723İstismar yok | LingGuo-Drama through commit 8a6924a Broken Access Control via /admin/v1/admins APIlingguoai · lingguo-drama · CWE-862 | Yüksek8,7 | — | %0,3 | 16 Eki 2026 |
28İzleyin | CVE-2026-81452İstismar yok | Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability.dell · alienware command center (awcc) · CWE-272 | Yüksek7,0 | — | %0,0 | 16 Eki 2026 |
30İzleyin | CVE-2025-66969İstismar yok | Integer overflow in OpenModSim (<=1.11.0), leading to denial of serviceCWE-190 | Yüksek7,5 | — | %0,3 | 16 Eki 2026 |
31İzleyin | CVE-2026-102917İstismar yok | IBM i is Affected By An Improper Privilege Management Vulnerabilityibm · i · CWE-269 | Yüksek7,8 | — | %0,1 | 16 Eki 2026 |
47Planlayın | CVE-2026-111793Silahlaştırılmış | Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted.openwave · webtop media transcoder · CWE-669 | Orta4,3 | KEV | %0,2 | 16 Eki 2026 |
30İzleyin | GHSA-6fj4-rcr3-r7rrİstismar yok | lopdf has a stack overflow via deeply nested PDF objectsCWE-1124 | Yüksek7,5 | — | — | 16 Eki 2026 |
35İzleyin | CVE-2026-102607Kavram kanıtı | ZoneMinder: Authenticated OS Command Injection (RCE) via Export Featurezoneminder · zoneminder · CWE-78 | Yüksek8,8 | — | %0,4 | 16 Eki 2026 |
36İzleyin | CVE-2026-102608İstismar yok | ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)zoneminder · zoneminder · CWE-78 | Kritik9,0 | — | %0,2 | 16 Eki 2026 |
30İzleyin | CVE-2026-102834İstismar yok | JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoSbytedeco · javacv · CWE-190 | Yüksek7,5 | — | %0,5 | 16 Eki 2026 |
39İzleyin | CVE-2026-108709İstismar yok | Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)apache software foundation · apache kylin · CWE-287 | Kritik9,8 | — | %0,4 | 16 Eki 2026 |
35İzleyin | CVE-2026-108743İstismar yok | Apache Kylin: spark job OS command injectionapache software foundation · apache kylin · CWE-78 | Yüksek8,8 | — | %1,3 | 16 Eki 2026 |
35İzleyin | CVE-2026-30971İstismar yok | ZoneMinder: Authenticated RCE via command injection in monitor Device Pathzoneminder · zoneminder · CWE-78 | Yüksek8,8 | — | %1,0 | 16 Eki 2026 |
28İzleyin | CVE-2026-59963İstismar yok | Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpointstandoorrecipes · recipes · CWE-639 | Yüksek7,1 | — | %0,2 | 16 Eki 2026 |
30İzleyin | CVE-2026-59970Kavram kanıtı | Tandoor Recipes: Blind SSRF via AI provider URL (api_base)tandoorrecipes · recipes · CWE-918 | Yüksek7,7 | — | %0,3 | 16 Eki 2026 |
32İzleyin | CVE-2026-61726İstismar yok | Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe contenttandoorrecipes · recipes · CWE-284 | Yüksek8,1 | — | %0,2 | 16 Eki 2026 |
30İzleyin | CVE-2026-68572İstismar yok | Apache Kylin: Unauthorized SQL execution to Spark SQL envapache software foundation · apache kylin · CWE-200 | Yüksek7,5 | — | %0,2 | 16 Eki 2026 |
39İzleyin | CVE-2026-68573İstismar yok | Apache Kylin: Unauthenticated Metastore Cleanupapache software foundation · apache kylin · CWE-287 | Kritik9,8 | — | %0,4 | 16 Eki 2026 |
30İzleyin | CVE-2026-69076İstismar yok | Apache Kylin: Unauthorized cross-project job discardapache software foundation · apache kylin · CWE-200 | Yüksek7,5 | — | %0,3 | 16 Eki 2026 |
30İzleyin | CVE-2026-69077İstismar yok | Apache Kylin: JobController allows unauthorized cross-project manipulationapache software foundation · apache kylin · CWE-200 | Yüksek7,5 | — | %0,3 | 16 Eki 2026 |
30İzleyin | CVE-2026-69080İstismar yok | Apache Kylin: Broken Access Control in QuerySQLBlacklistControllerapache software foundation · apache kylin · CWE-200 | Yüksek7,5 | — | %0,3 | 16 Eki 2026 |
36İzleyin | CVE-2026-96620İstismar yok | Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Executionanthropics · claude-agent-sdk-python · CWE-20 | Kritik9,2 | — | %0,7 | 16 Eki 2026 |
30İzleyin | CVE-2026-108374İstismar yok | ERPNext: Unauthorised status modification due to missing validationfrappe · erpnext · CWE-862 | Yüksek7,7 | — | %0,2 | 16 Eki 2026 |
28İzleyin | CVE-2026-108372İstismar yok | LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown fileshuangruiteng · loopx · CWE-346 | Yüksek7,1 | — | %0,3 | 16 Eki 2026 |
30İzleyin | CVE-2026-111044İstismar yok | Disabled Sunshine clients can bypass revocation with a derived client certificatelizardbyte · sunshine · CWE-863 | Yüksek7,6 | — | %0,1 | 16 Eki 2026 |
32İzleyin | CVE-2026-49410İstismar yok | OpenHuman /auth/telegram CSRF allows attacker-controlled session implantationtinyhumansai · openhuman · CWE-352 | Yüksek8,1 | — | %0,1 | 16 Eki 2026 |
28İzleyin | CVE-2026-62439İstismar yok | Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerabilityred hat · red hat enterprise linux 10 · CWE-190 | Yüksek7,0 | — | %0,2 | 16 Eki 2026 |
30İzleyin | CVE-2026-68498İstismar yok | jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of servicefasterxml · jackson-core · CWE-400 | Yüksek7,5 | — | %0,6 | 16 Eki 2026 |
34İzleyin | CVE-2026-96626İstismar yok | Arcane: Container-registry credential exfiltration via URL repoint + test to attacker hostgetarcaneapp · arcane · CWE-200 | Yüksek8,5 | — | %0,2 | 16 Eki 2026 |
35İzleyin | CVE-2026-96627İstismar yok | Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)getarcaneapp · arcane · CWE-266 | Yüksek8,8 | — | %0,3 | 16 Eki 2026 |
30İzleyin | CVE-2026-110752İstismar yok | Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragmentCWE-770 | Yüksek7,5 | — | %0,4 | 16 Eki 2026 |
39İzleyin | CVE-2026-110753İstismar yok | Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getlineCWE-416 | Kritik9,8 | — | %0,4 | 16 Eki 2026 |
30İzleyin | CVE-2026-110755İstismar yok | Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getlineCWE-407 | Yüksek7,5 | — | %0,4 | 16 Eki 2026 |
39İzleyin | CVE-2026-110756İstismar yok | Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in printCWE-116 | Kritik9,8 | — | %0,4 | 16 Eki 2026 |
39İzleyin | CVE-2026-110757İstismar yok | Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combineCWE-116 | Kritik9,8 | — | %0,4 | 16 Eki 2026 |
30İzleyin | CVE-2026-110758İstismar yok | Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespaceCWE-127 | Yüksek7,5 | — | %0,3 | 16 Eki 2026 |
39İzleyin | CVE-2026-110759İstismar yok | Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parseCWE-1286 | Kritik9,8 | — | %0,4 | 16 Eki 2026 |
39İzleyin | CVE-2026-111823Kavram kanıtı | Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.mage · mage-ai · CWE-390 | Kritik9,8 | — | %0,5 | 17 Eki 2026 |
35İzleyin | CVE-2026-111853İstismar yok | An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1.tektronix · 3 series mdo · CWE-78 | Yüksek8,8 | — | %1,0 | 17 Eki 2026 |
32İzleyin | CVE-2026-111854İstismar yok | An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1.tektronix · 3 series mdo · CWE-22 | Yüksek8,1 | — | %0,4 | 17 Eki 2026 |
30İzleyin | CVE-2026-111855İstismar yok | An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1.tektronix · 3 series mdo · CWE-22 | Yüksek7,5 | — | %0,6 | 17 Eki 2026 |
28İzleyin | CVE-2026-104734İstismar yok | Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Importthemeum · kirki – freeform page builder, website builder & customizer · CWE-502 | Yüksek7,2 | — | %0,4 | 17 Eki 2026 |
30İzleyin | CVE-2026-107762İstismar yok | Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameterthemeum · kirki – freeform page builder, website builder & customizer · CWE-639 | Yüksek7,5 | — | %0,3 | 17 Eki 2026 |
28İzleyin | CVE-2026-109208İstismar yok | LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parametersthimpress · learnpress – wordpress lms plugin for create and sell online courses · CWE-79 | Yüksek7,2 | — | %0,2 | 17 Eki 2026 |
36İzleyin | CVE-2026-110653İstismar yok | Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counterlatepoint · appointment booking plugin – latepoint | calendar & scheduling for wordpress · CWE-287 | Kritik9,1 | — | %0,4 | 17 Eki 2026 |
28İzleyin | CVE-2026-103899İstismar yok | EU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat_number' Parameterdaigo75 · eu vat assistant for woocommerce · CWE-79 | Yüksek7,2 | — | %0,2 | 17 Eki 2026 |
40Planlayın | CVE-2026-104736Kavram kanıtı | LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameterthimpress · learnpress – wordpress lms plugin for create and sell online courses · CWE-502 | Kritik9,8 | — | %2,5 | 17 Eki 2026 |
30İzleyin | CVE-2026-108123Kavram kanıtı | WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Actionmurgroland · wp booking system – booking calendar · CWE-862 | Yüksek7,5 | — | %1,0 | 17 Eki 2026 |
32İzleyin | CVE-2026-92798İstismar yok | User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tagwpeverest · user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builder · CWE-94 | Yüksek8,1 | — | %0,3 | 17 Eki 2026 |
28İzleyin | CVE-2026-96660İstismar yok | User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Valuewpeverest · user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builder · CWE-79 | Yüksek7,2 | — | %0,2 | 17 Eki 2026 |
- CVE-2026-11161234İzleyin
netdisk-fast-download through 0.4.8 Credential Disclosure via /v2/randomAuth
YüksekCVSS 8,7İstismar yokEPSS %0qaiu · netdisk-fast-download16 Eki 2026
- CVE-2026-11161334İzleyin
AllData through 0.7.1 Unauthenticated JDBC Injection via /jobJdbcDatasource/test
YüksekCVSS 8,7İstismar yokEPSS %0alldatacenter · alldata16 Eki 2026
- CVE-2026-11161428İzleyin
DataCap through 2025.1.1 IDOR via BaseController.getInfoForPath Exposes Credentials
YüksekCVSS 7,1İstismar yokEPSS %0devlive-community · datacap16 Eki 2026
- CVE-2026-11161528İzleyin
Mall4cloud through 4.0 IDOR Exposing Buyer Addresses via order_addr Endpoint
YüksekCVSS 7,1İstismar yokEPSS %0gz-yami · mall4cloud16 Eki 2026
- CVE-2026-11161928İzleyin
FilePress through 3.0.1 SQL Injection via asc Parameter in filelist.php
YüksekCVSS 7,1İstismar yokEPSS %0zyx0814 · filepress16 Eki 2026
- CVE-2026-11162230İzleyin
smart-sso through 2.1.1 OAuth2 Authorization Code Theft via Unvalidated redirectUri
YüksekCVSS 7,6İstismar yokEPSS %0a466350665 · smart-sso16 Eki 2026
- CVE-2026-11162637İzleyin
Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers
KritikCVSS 9,3İstismar yokEPSS %0webreaper · damselfly16 Eki 2026
- CVE-2026-11162734İzleyin
HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation
YüksekCVSS 8,6İstismar yokEPSS %0hestiacp · hestiacp16 Eki 2026
- CVE-2026-11163335İzleyin
ZKEACMS through 4.4 Authentication Bypass via Hard-Coded JWT Signing Key
YüksekCVSS 8,8İstismar yokEPSS %0seriawei · zkeacms16 Eki 2026
- CVE-2026-11163434İzleyin
Helical Insight through 7.0.0 SQL Injection via /executeDatasource
YüksekCVSS 8,6İstismar yokEPSS %0helicalinsight · helicalinsight16 Eki 2026
- CVE-2026-11163636İzleyin
OpenBMB StaffDeck through 0.5.6 Authentication Bypass via Hard-Coded Session Secret
KritikCVSS 9,2İstismar yokEPSS %0openbmb · staffdeck16 Eki 2026
- CVE-2026-11163833İzleyin
sshportal through 1.19.5 Missing Authorization in 'key show' Command Exposes Private Keys
YüksekCVSS 8,3İstismar yokEPSS %0moul · sshportal16 Eki 2026
- CVE-2026-11163934İzleyin
bbs-go through 4.4.6 Account Takeover via Google One Tap Login
YüksekCVSS 8,6İstismar yokEPSS %0mlogclub · bbs-go16 Eki 2026
- CVE-2026-11164137İzleyin
FastapiAdmin through 3.0 Authentication Bypass via Auto-Login Endpoints
KritikCVSS 9,3İstismar yokEPSS %0fastapiadmin · fastapiadmin16 Eki 2026
- CVE-2026-11164234İzleyin
FastapiAdmin through 3.0 Hard-Coded JWT Secret Privilege Escalation
YüksekCVSS 8,7İstismar yokEPSS %0fastapiadmin · fastapiadmin16 Eki 2026
- CVE-2026-11164337İzleyin
Misaka Danmu Server through 2.8.9 Authentication Bypass via Config-History Rollback
KritikCVSS 9,3İstismar yokEPSS %0l429609201 · misaka_danmu_server16 Eki 2026
- CVE-2026-11164632İzleyin
SurveyKing before 1.13.0 Unauthenticated File Download via /api/public/preview
YüksekCVSS 8,2İstismar yokEPSS %0javahuang · surveyking16 Eki 2026
- CVE-2026-11164928İzleyin
Rocboss paopao-ce through 0.6.0-alpha.3 IDOR via DownloadAttachment Endpoint
YüksekCVSS 7,1İstismar yokEPSS %0rocboss · paopao-ce16 Eki 2026
- CVE-2026-11165035İzleyin
ChronoFrame through 1.0.0 Missing Authentication via Setup Wizard API
YüksekCVSS 8,8İstismar yokEPSS %0hoshinosuzumi · chronoframe16 Eki 2026
- CVE-2026-11165128İzleyin
Risesoft Digital-Infrastructure through 9.6.11 Cross-Tenant Data Exposure via DownloadController
YüksekCVSS 7,1İstismar yokEPSS %0risesoft-y9 · digital-infrastructure16 Eki 2026
- CVE-2026-11166336İzleyin
Chaskiq through 2.0.3 SSRF via createUrlUpload GraphQL Mutation
KritikCVSS 9,2İstismar yokEPSS %0chaskiq · chaskiq16 Eki 2026
- CVE-2026-11166928İzleyin
ZR.Admin.NET through 3.8.2 SQL Injection via PagerInfo.Sort ORDER BY
YüksekCVSS 7,1İstismar yokEPSS %0izhaorui · zr.admin.net16 Eki 2026
- CVE-2026-11167128İzleyin
Cube-studio through 2026.09.01 IDOR via Notebook and Serving Lifecycle Endpoints
YüksekCVSS 7,1İstismar yokEPSS %0data-infra · cube-studio16 Eki 2026
- CVE-2026-11167337İzleyin
IceCMS through 4.1.5 Missing Authentication via /User Administrative Endpoints
KritikCVSS 9,3İstismar yokEPSS %0thecosy · icecms16 Eki 2026
- CVE-2026-11167536İzleyin
Course-tencent-cloud through 2.0.1 Verification Code Brute Force Account Takeover
KritikCVSS 9,1İstismar yokEPSS %0xiaochong0302 · course-tencent-cloud16 Eki 2026
- CVE-2026-11168028İzleyin
APIPark through 1.9.7-beta Cross-Team Authorization Bypass via Team Query Parameter
YüksekCVSS 7,2İstismar yokEPSS %0apiparklab · apipark16 Eki 2026
- CVE-2026-11168134İzleyin
EFAK through 5.1.0 Privilege Escalation via /api/users REST API
YüksekCVSS 8,7İstismar yokEPSS %0smartloli · efak16 Eki 2026
- CVE-2026-11168228İzleyin
EFAK 5.0.0 through 5.1.0 Missing Authorization via /api/model-config Exposes API Keys
YüksekCVSS 7,1İstismar yokEPSS %0smartloli · efak16 Eki 2026
- CVE-2026-11168428İzleyin
Magistrala through 1.0.0 Cross-Tenant Authorization Bypass in Certs Service
YüksekCVSS 7,2İstismar yokEPSS %0absmach · magistrala16 Eki 2026
- CVE-2026-11168534İzleyin
IceCMS through 4.1.5 SQL Injection via /WebResource/findresourcebynum
YüksekCVSS 8,7İstismar yokEPSS %0thecosy · icecms16 Eki 2026
- CVE-2026-11168634İzleyin
IceCMS through 4.1.5 SQL Injection via /WebArticle/findarticlesbynum
YüksekCVSS 8,7İstismar yokEPSS %0thecosy · icecms16 Eki 2026
- CVE-2026-11168737İzleyin
WeRSS (we-mp-rss) through 1.5.3 RCE via template Parameter in /rss Endpoint
KritikCVSS 9,3İstismar yokEPSS %1rachelos · we-mp-rss16 Eki 2026
- CVE-2026-11169037İzleyin
Simple Admin Core through 1.8.7 Hard-Coded JWT Secret Authentication Bypass
KritikCVSS 9,3İstismar yokEPSS %0suyuan32 · simple-admin-core16 Eki 2026
- CVE-2026-11169136İzleyin
WIMOOR through commit ec86736 Authentication Bypass via Forged X-USERINFO Header
KritikCVSS 9,1İstismar yokEPSS %0wimoor-erp · wimoor16 Eki 2026
- CVE-2026-11169237İzleyin
DataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret
KritikCVSS 9,3İstismar yokEPSS %0databufflabs · databuff16 Eki 2026
- CVE-2026-11169337İzleyin
DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials
KritikCVSS 9,3İstismar yokEPSS %0databufflabs · databuff16 Eki 2026
- CVE-2026-11169528İzleyin
Shaiwz data-platform-open through commit efeacd3 IDOR in Datasource API
YüksekCVSS 7,1İstismar yokEPSS %0shaiwz · data-platform-open16 Eki 2026
- CVE-2026-11169628İzleyin
data-platform-open through commit efeacd3 Hardcoded AES Key for Datasource Passwords
YüksekCVSS 7,1İstismar yokEPSS %0shaiwz · data-platform-open16 Eki 2026
- CVE-2026-11169728İzleyin
HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs
YüksekCVSS 7,1İstismar yokEPSS %0roinli · huizhi-chargeos-cloud16 Eki 2026
- CVE-2026-11169828İzleyin
HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge
YüksekCVSS 7,1İstismar yokEPSS %0roinli · huizhi-chargeos-cloud16 Eki 2026
- CVE-2026-11170028İzleyin
WebVella ERP through 1.8.8 SQL Injection via EQL Query API
YüksekCVSS 7,1İstismar yokEPSS %0webvella · webvella-erp16 Eki 2026
- CVE-2026-11170133İzleyin
OtterMind Nubase through 0.1.4 Missing Authentication in Storage Object API
YüksekCVSS 8,3İstismar yokEPSS %0ottermind · nubase16 Eki 2026
- CVE-2026-11170234İzleyin
ChatOllama through commit 96c3ce5 IDOR Exposes Private Knowledge Bases
YüksekCVSS 8,7İstismar yokEPSS %0sugarforever · chat-ollama16 Eki 2026
- CVE-2026-11170437İzleyin
LangChat through commit 2a6285a Missing Authentication on REST API Controllers
KritikCVSS 9,3İstismar yokEPSS %0langchat · langchat16 Eki 2026
- CVE-2026-11170634İzleyin
99AI through 4.3.0 Unauthenticated Information Disclosure via chatLog exportExcel
YüksekCVSS 8,7İstismar yokEPSS %0vastxie · 99ai16 Eki 2026
- CVE-2026-11170837İzleyin
WhaTicket Community through commit cf04795 Admin Self-Registration via /auth/signup
KritikCVSS 9,3İstismar yokEPSS %0canove · whaticket-community16 Eki 2026
- CVE-2026-11171034İzleyin
Netcore NR256CN through 1.5.140116 Boa Web Server NULL Pointer Dereference DoS
YüksekCVSS 8,7İstismar yokEPSS %0netcore · nr256cn16 Eki 2026
- CVE-2026-11171137İzleyin
Netcore NR256CN through 1.5.140116 Pre-Auth Stack Overflow via Boa user_ok()
KritikCVSS 9,3İstismar yokEPSS %0netcore · nr256cn16 Eki 2026
- CVE-2026-11171828İzleyin
AipexBase through commit 690adb9 SQL Injection via /api/data/invoke
YüksekCVSS 7,1İstismar yokEPSS %0kuafuai · aipexbase16 Eki 2026
- CVE-2026-11171932İzleyin
Roncoo-pay through commit 9428382 Information Disclosure via /f2fPay/order/query
YüksekCVSS 8,2İstismar yokEPSS %0roncoo · roncoo-pay16 Eki 2026
- CVE-2026-11172234İzleyin
LingGuo-Drama through commit 8a6924a IDOR via /admin/v1/projects/:id API
YüksekCVSS 8,6İstismar yokEPSS %0lingguoai · lingguo-drama16 Eki 2026
- CVE-2026-11172334İzleyin
LingGuo-Drama through commit 8a6924a Broken Access Control via /admin/v1/admins API
YüksekCVSS 8,7İstismar yokEPSS %0lingguoai · lingguo-drama16 Eki 2026
- CVE-2026-8145228İzleyin
Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability.
YüksekCVSS 7,0İstismar yokEPSS %0dell · alienware command center (awcc)16 Eki 2026
- CVE-2025-6696930İzleyin
Integer overflow in OpenModSim (<=1.11.0), leading to denial of service
YüksekCVSS 7,5İstismar yokEPSS %016 Eki 2026
- CVE-2026-10291731İzleyin
IBM i is Affected By An Improper Privilege Management Vulnerability
YüksekCVSS 7,8İstismar yokEPSS %0ibm · i16 Eki 2026
- CVE-2026-11179347Planlayın
Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted.
OrtaCVSS 4,3KEVSilahlaştırılmışEPSS %0openwave · webtop media transcoder16 Eki 2026
- GHSA-6fj4-rcr3-r7rr30İzleyin
lopdf has a stack overflow via deeply nested PDF objects
YüksekCVSS 7,5İstismar yok16 Eki 2026
- CVE-2026-10260735İzleyin
ZoneMinder: Authenticated OS Command Injection (RCE) via Export Feature
YüksekCVSS 8,8Kavram kanıtıEPSS %0zoneminder · zoneminder16 Eki 2026
- CVE-2026-10260836İzleyin
ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php)
KritikCVSS 9,0İstismar yokEPSS %0zoneminder · zoneminder16 Eki 2026
- CVE-2026-10283430İzleyin
JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS
YüksekCVSS 7,5İstismar yokEPSS %0bytedeco · javacv16 Eki 2026
- CVE-2026-10870939İzleyin
Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)
KritikCVSS 9,8İstismar yokEPSS %0apache software foundation · apache kylin16 Eki 2026
- CVE-2026-10874335İzleyin
Apache Kylin: spark job OS command injection
YüksekCVSS 8,8İstismar yokEPSS %1apache software foundation · apache kylin16 Eki 2026
- CVE-2026-3097135İzleyin
ZoneMinder: Authenticated RCE via command injection in monitor Device Path
YüksekCVSS 8,8İstismar yokEPSS %1zoneminder · zoneminder16 Eki 2026
- CVE-2026-5996328İzleyin
Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints
YüksekCVSS 7,1İstismar yokEPSS %0tandoorrecipes · recipes16 Eki 2026
- CVE-2026-5997030İzleyin
Tandoor Recipes: Blind SSRF via AI provider URL (api_base)
YüksekCVSS 7,7Kavram kanıtıEPSS %0tandoorrecipes · recipes16 Eki 2026
- CVE-2026-6172632İzleyin
Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content
YüksekCVSS 8,1İstismar yokEPSS %0tandoorrecipes · recipes16 Eki 2026
- CVE-2026-6857230İzleyin
Apache Kylin: Unauthorized SQL execution to Spark SQL env
YüksekCVSS 7,5İstismar yokEPSS %0apache software foundation · apache kylin16 Eki 2026
- CVE-2026-6857339İzleyin
Apache Kylin: Unauthenticated Metastore Cleanup
KritikCVSS 9,8İstismar yokEPSS %0apache software foundation · apache kylin16 Eki 2026
- CVE-2026-6907630İzleyin
Apache Kylin: Unauthorized cross-project job discard
YüksekCVSS 7,5İstismar yokEPSS %0apache software foundation · apache kylin16 Eki 2026
- CVE-2026-6907730İzleyin
Apache Kylin: JobController allows unauthorized cross-project manipulation
YüksekCVSS 7,5İstismar yokEPSS %0apache software foundation · apache kylin16 Eki 2026
- CVE-2026-6908030İzleyin
Apache Kylin: Broken Access Control in QuerySQLBlacklistController
YüksekCVSS 7,5İstismar yokEPSS %0apache software foundation · apache kylin16 Eki 2026
- CVE-2026-9662036İzleyin
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
KritikCVSS 9,2İstismar yokEPSS %0anthropics · claude-agent-sdk-python16 Eki 2026
- CVE-2026-10837430İzleyin
ERPNext: Unauthorised status modification due to missing validation
YüksekCVSS 7,7İstismar yokEPSS %0frappe · erpnext16 Eki 2026
- CVE-2026-10837228İzleyin
LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files
YüksekCVSS 7,1İstismar yokEPSS %0huangruiteng · loopx16 Eki 2026
- CVE-2026-11104430İzleyin
Disabled Sunshine clients can bypass revocation with a derived client certificate
YüksekCVSS 7,6İstismar yokEPSS %0lizardbyte · sunshine16 Eki 2026
- CVE-2026-4941032İzleyin
OpenHuman /auth/telegram CSRF allows attacker-controlled session implantation
YüksekCVSS 8,1İstismar yokEPSS %0tinyhumansai · openhuman16 Eki 2026
- CVE-2026-6243928İzleyin
Gimp: gimp: file-pvr plug-in pvr file parsing integer overflow heap-based buffer overflow vulnerability
YüksekCVSS 7,0İstismar yokEPSS %0red hat · red hat enterprise linux 1016 Eki 2026
- CVE-2026-6849830İzleyin
jackson-core: Delayed maxNameLength enforcement for char-backed input (ReaderBasedJsonParser) allows memory-exhaustion denial of service
YüksekCVSS 7,5İstismar yokEPSS %0fasterxml · jackson-core16 Eki 2026
- CVE-2026-9662634İzleyin
Arcane: Container-registry credential exfiltration via URL repoint + test to attacker host
YüksekCVSS 8,5İstismar yokEPSS %0getarcaneapp · arcane16 Eki 2026
- CVE-2026-9662735İzleyin
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
YüksekCVSS 8,8İstismar yokEPSS %0getarcaneapp · arcane16 Eki 2026
- CVE-2026-11075230İzleyin
Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment
YüksekCVSS 7,5İstismar yokEPSS %016 Eki 2026
- CVE-2026-11075339İzleyin
Text::CSV_XS versions from 1.46 before 1.65 for Perl have a use-after-free of bind_columns variables when skip_empty_rows skips an empty line in getline
KritikCVSS 9,8İstismar yokEPSS %016 Eki 2026
- CVE-2026-11075530İzleyin
Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline
YüksekCVSS 7,5İstismar yokEPSS %016 Eki 2026
- CVE-2026-11075639İzleyin
Text::CSV_XS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print
KritikCVSS 9,8İstismar yokEPSS %016 Eki 2026
- CVE-2026-11075739İzleyin
Text::CSV_XS versions before 1.65 for Perl allow record splitting by writing strings used as numbers without quotes in combine
KritikCVSS 9,8İstismar yokEPSS %016 Eki 2026
- CVE-2026-11075830İzleyin
Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace
YüksekCVSS 7,5İstismar yokEPSS %016 Eki 2026
- CVE-2026-11075939İzleyin
Text::CSV_XS versions before 1.65 for Perl return a 0xFF byte that is not in the input for an empty last field followed by a lone CR in parse
KritikCVSS 9,8İstismar yokEPSS %016 Eki 2026
- CVE-2026-11182339İzleyin
Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.
KritikCVSS 9,8Kavram kanıtıEPSS %0mage · mage-ai17 Eki 2026
- CVE-2026-11185335İzleyin
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1.
YüksekCVSS 8,8İstismar yokEPSS %1tektronix · 3 series mdo17 Eki 2026
- CVE-2026-11185432İzleyin
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1.
YüksekCVSS 8,1İstismar yokEPSS %0tektronix · 3 series mdo17 Eki 2026
- CVE-2026-11185530İzleyin
An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1.
YüksekCVSS 7,5İstismar yokEPSS %0tektronix · 3 series mdo17 Eki 2026
- CVE-2026-10473428İzleyin
Kirki <= 6.3.2 - Authenticated (Administrator+) PHP Object Injection via Deserialization of Untrusted Input via ZIP Template Import
YüksekCVSS 7,2İstismar yokEPSS %0themeum · kirki – freeform page builder, website builder & customizer17 Eki 2026
- CVE-2026-10776230İzleyin
Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter
YüksekCVSS 7,5İstismar yokEPSS %0themeum · kirki – freeform page builder, website builder & customizer17 Eki 2026
- CVE-2026-10920828İzleyin
LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters
YüksekCVSS 7,2İstismar yokEPSS %0thimpress · learnpress – wordpress lms plugin for create and sell online courses17 Eki 2026
- CVE-2026-11065336İzleyin
Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter
KritikCVSS 9,1İstismar yokEPSS %0latepoint · appointment booking plugin – latepoint | calendar & scheduling for wordpress17 Eki 2026
- CVE-2026-10389928İzleyin
EU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat_number' Parameter
YüksekCVSS 7,2İstismar yokEPSS %0daigo75 · eu vat assistant for woocommerce17 Eki 2026
- CVE-2026-10473640Planlayın
LearnPress <= 4.4.10 - Unauthenticated PHP Object Injection via 'checkout-email' Parameter
KritikCVSS 9,8Kavram kanıtıEPSS %2thimpress · learnpress – wordpress lms plugin for create and sell online courses17 Eki 2026
- CVE-2026-10812330İzleyin
WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Action
YüksekCVSS 7,5Kavram kanıtıEPSS %1murgroland · wp booking system – booking calendar17 Eki 2026
- CVE-2026-9279832İzleyin
User Registration & Membership <= 5.2.8 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Referer Header via 'referrer_url' Smart Tag
YüksekCVSS 8,1İstismar yokEPSS %0wpeverest · user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builder17 Eki 2026
- CVE-2026-9666028İzleyin
User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value
YüksekCVSS 7,2İstismar yokEPSS %0wpeverest · user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builder17 Eki 2026