Yayın tarihine göre
Ekim 2026: sömürülen ve yeni ciddi CVE kayıtları
6.699 kayıt · 12 KEV. Yayın sırasıyla.
Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.
Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.
Sayfa 53 / 67
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
34İzleyin | CVE-2026-112399İstismar yok | Pillow: APNG background disposal allocates full canvas before decompression bomb checkpython-pillow · pillow · CWE-789 | Yüksek8,7 | — | %0,2 | 3 gün önce |
34İzleyin | CVE-2026-112400İstismar yok | Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoSpython-pillow · pillow · CWE-400 | Yüksek8,7 | — | %0,2 | 3 gün önce |
34İzleyin | CVE-2026-112402İstismar yok | Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transformpython-pillow · pillow · CWE-416 | Yüksek8,7 | — | %0,4 | 3 gün önce |
36İzleyin | CVE-2026-112403İstismar yok | Pillow: Heap buffer overflow in ImagingJpegDecodepython-pillow · pillow · CWE-122 | Kritik9,2 | — | %0,3 | 3 gün önce |
35İzleyin | CVE-2026-112404İstismar yok | Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixelspython-pillow · pillow · CWE-126 | Yüksek8,8 | — | %0,2 | 3 gün önce |
34İzleyin | CVE-2026-112405İstismar yok | Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0python-pillow · pillow · CWE-476 | Yüksek8,7 | — | %0,2 | 3 gün önce |
34İzleyin | CVE-2026-112406İstismar yok | Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cyclepython-pillow · pillow · CWE-835 | Yüksek8,7 | — | %0,2 | 3 gün önce |
34İzleyin | CVE-2026-112892İstismar yok | Pillow: MSP RLE decoder expands a tiny file into unbounded memorypython-pillow · pillow · CWE-409 | Yüksek8,7 | — | %0,2 | 3 gün önce |
32İzleyin | CVE-2026-112893İstismar yok | Pillow: Invalid free in FreeType glyph rendering when a stroker is activepython-pillow · pillow · CWE-457 | Yüksek8,2 | — | %0,2 | 3 gün önce |
34İzleyin | CVE-2026-112894İstismar yok | Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)python-pillow · pillow · CWE-407 | Yüksek8,7 | — | %0,2 | 3 gün önce |
34İzleyin | CVE-2026-112895İstismar yok | Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)python-pillow · pillow · CWE-674 | Yüksek8,7 | — | %0,2 | 3 gün önce |
35İzleyin | CVE-2026-112896İstismar yok | Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds readpython-pillow · pillow · CWE-125 | Yüksek8,8 | — | %0,2 | 3 gün önce |
34İzleyin | CVE-2026-112897İstismar yok | Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG stripspython-pillow · pillow · CWE-908 | Yüksek8,7 | — | %0,2 | 3 gün önce |
36İzleyin | CVE-2026-112900İstismar yok | Pillow: Argument Injection in Ghostscript call, potentially leading into RCEpython-pillow · pillow · CWE-78 | Kritik9,2 | — | %0,4 | 3 gün önce |
35İzleyin | CVE-2026-53995Kavram kanıtı | MLflow 3.17.1 and prior Path Traversal via Trace ID APImlflow · mlflow · CWE-22 | Yüksek8,8 | — | %0,5 | 3 gün önce |
35İzleyin | CVE-2026-112370İstismar yok | H3C Magic NX15 usrlist sub_416874 os command injectionh3c · magic nx15 · CWE-77 | Yüksek8,6 | — | %1,6 | 3 gün önce |
34İzleyin | CVE-2026-112371İstismar yok | H3C Magic NX15 RPC esps write code injectionh3c · magic nx15 · CWE-74 | Yüksek8,6 | — | %0,4 | 3 gün önce |
33İzleyin | CVE-2026-105453İstismar yok | IBM Sterling Connect:Direct for Unix Improper Privilege Managementibm · sterling connect direct for unix · CWE-269 | Yüksek8,4 | — | %0,0 | 3 gün önce |
33İzleyin | CVE-2026-107366İstismar yok | Langflow OSS Authorization Bypass Through User-Controlled Keyibm · langflow oss · CWE-639 | Yüksek8,3 | — | %0,2 | 3 gün önce |
35İzleyin | CVE-2026-107400İstismar yok | Security Vulnerability identified in IBM TRIRIGA - GWT Mock Authenticationibm · tririga application platform · CWE-287 | Yüksek8,8 | — | %0,4 | 3 gün önce |
35İzleyin | CVE-2026-109126İstismar yok | IBM Verify Identity Access and IBM Security Verify Access Hard-coded Credentialsibm · verify identity access · CWE-798 | Yüksek8,8 | — | %0,1 | 3 gün önce |
30İzleyin | CVE-2026-105297İstismar yok | Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limitscloudflare · https://github.com/cloudflare/pingora · CWE-770 | Yüksek7,5 | — | %0,3 | 3 gün önce |
35İzleyin | CVE-2026-109395İstismar yok | Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoderning · compress-lzf · CWE-125 | Yüksek8,8 | — | %0,4 | 3 gün önce |
34İzleyin | CVE-2026-109440İstismar yok | LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCodeginlix-ai · langalpha · CWE-1427 | Yüksek8,7 | — | %0,4 | 3 gün önce |
37İzleyin | CVE-2026-109442İstismar yok | piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shellcas-bigdatalab · piflow · CWE-306 | Kritik9,3 | — | %0,6 | 3 gün önce |
34İzleyin | CVE-2026-109443İstismar yok | JoySafeter through 1.0.0 Authenticated RCE via Copilot Standard Mode Shelljd-opensource · joysafeter · CWE-653 | Yüksek8,7 | — | %0,7 | 3 gün önce |
37İzleyin | CVE-2026-109444İstismar yok | OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injectiontracer-cloud · opensre · CWE-862 | Kritik9,3 | — | %0,4 | 3 gün önce |
31İzleyin | CVE-2026-28853İstismar yok | The issue was addressed with improved checks.apple · macos · CWE-269 | Yüksek7,8 | — | %0,1 | 3 gün önce |
37İzleyin | CVE-2026-75128İstismar yok | Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpointchatchat-space · langchain-chatchat · CWE-306 | Kritik9,3 | — | %0,5 | 3 gün önce |
34İzleyin | CVE-2026-77926İstismar yok | Aix-DB 1.2.4 Authenticated RCE via ChatBI Common Agent Execute Toolapconw · aix-db · CWE-749 | Yüksek8,7 | — | %0,6 | 3 gün önce |
37İzleyin | CVE-2026-77930İstismar yok | EvoScientist 0.1.0 before 0.2.5 Human Approval Bypass via Async Sub-Agentsevoscientist · evoscientist · CWE-862 | Kritik9,3 | — | %0,4 | 3 gün önce |
37İzleyin | CVE-2026-77932İstismar yok | DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agenteosphoros-ai · db-gpt · CWE-306 | Kritik9,3 | — | %0,6 | 3 gün önce |
37İzleyin | CVE-2026-77933İstismar yok | DB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deploymenteosphoros-ai · db-gpt · CWE-1392 | Kritik9,3 | — | %0,3 | 3 gün önce |
34İzleyin | CVE-2026-77934İstismar yok | Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Code Runnercoze-dev · coze-studio · CWE-1188 | Yüksek8,7 | — | %0,5 | 3 gün önce |
34İzleyin | CVE-2026-77935İstismar yok | Coze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlerscoze-dev · coze-studio · CWE-639 | Yüksek8,7 | — | %0,3 | 3 gün önce |
37İzleyin | CVE-2026-77936İstismar yok | Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Accessletta-ai · letta · CWE-1188 | Kritik9,3 | — | %0,4 | 3 gün önce |
34İzleyin | CVE-2026-77937İstismar yok | Letta through 0.16.8 Cross-Tenant Impersonation via user_id Headerletta-ai · letta · CWE-639 | Yüksek8,6 | — | %0,4 | 3 gün önce |
28İzleyin | CVE-2026-77938İstismar yok | Letta through 0.16.8 Credential Exposure via Tool Sandbox Environment Inheritanceletta-ai · letta · CWE-526 | Yüksek7,1 | — | %0,3 | 3 gün önce |
35İzleyin | CVE-2026-86919İstismar yok | A stack overflow was addressed with improved input validation.apple · ios and ipados · CWE-121 | Yüksek8,8 | — | %0,3 | 3 gün önce |
35İzleyin | CVE-2026-86922İstismar yok | A type confusion issue was addressed with improved state management.apple · safari · CWE-843 | Yüksek8,8 | — | %0,2 | 3 gün önce |
35İzleyin | CVE-2026-86949İstismar yok | This issue was addressed by enforcing library validation on the affected binaries.apple · xcode · CWE-829 | Yüksek8,8 | — | %0,1 | 3 gün önce |
31İzleyin | CVE-2026-86961İstismar yok | A race condition was addressed with additional validation.apple · ios and ipados · CWE-362 | Yüksek7,8 | — | %0,0 | 3 gün önce |
34İzleyin | CVE-2026-102438İstismar yok | An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges asus · armoury crate · CWE-427 | Yüksek8,5 | — | %0,1 | 3 gün önce |
34İzleyin | CVE-2026-105299İstismar yok | Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deploymentscloudflare · https://github.com/cloudflare/pingora · CWE-444 | Yüksek8,7 | — | %0,3 | 3 gün önce |
32İzleyin | CVE-2026-17518İstismar yok | Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations asus · router · CWE-121 | Yüksek8,2 | — | %0,1 | 3 gün önce |
37İzleyin | CVE-2026-113380İstismar yok | In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup tsignal · ringrtc · CWE-754 | Kritik9,3 | — | %0,3 | 3 gün önce |
28İzleyin | CVE-2026-113386İstismar yok | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection.roundcube · webmail · CWE-93 | Yüksek7,1 | — | %0,9 | 3 gün önce |
30İzleyin | CVE-2026-93300Kavram kanıtı | EventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parametereventon · eventon - subscriber · CWE-89 | Yüksek7,5 | — | %0,4 | 3 gün önce |
34İzleyin | CVE-2026-97627İstismar yok | Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd.atsumi electric co., ltd. · adx5004 · CWE-912 | Yüksek8,6 | — | %0,3 | 3 gün önce |
28İzleyin | CVE-2026-113402İstismar yok | ArmorX Global Technology|ArmorX Spam - Local File Inclusionarmorx global technology · armorx spam · CWE-98 | Yüksek7,1 | — | %0,3 | 3 gün önce |
28İzleyin | CVE-2026-113403İstismar yok | ArmorX Global Technology|ArmorX Spam - Command Injectionarmorx global technology · armorx spam · CWE-93 | Yüksek7,1 | — | %0,8 | 3 gün önce |
34İzleyin | CVE-2026-113404İstismar yok | Uniong|WebITR - Insecure Deserializationuniong · webitr · CWE-502 | Yüksek8,7 | — | %0,3 | 3 gün önce |
31İzleyin | CVE-2026-111090İstismar yok | Improper Signature Verification of Firmware Update Filesstormshield · stormshield network security · CWE-287 | Yüksek7,8 | — | %0,1 | 3 gün önce |
29İzleyin | CVE-2026-112177İstismar yok | Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8red hat · red hat enterprise linux 10 · CWE-648 | Yüksek7,3 | — | %0,2 | 3 gün önce |
34İzleyin | CVE-2026-113405İstismar yok | YS-infoware|BA-Workflow - SQL Injectionys-infoware · ba-workflow · CWE-89 | Yüksek8,7 | — | %0,4 | 3 gün önce |
34İzleyin | CVE-2026-113406İstismar yok | YS-infoware|BA-Workflow - SQL Injectionys-infoware · ba-workflow · CWE-89 | Yüksek8,7 | — | %0,4 | 3 gün önce |
34İzleyin | CVE-2026-113407İstismar yok | YS-infoware|BA-Workflow - SQL Injectionys-infoware · ba-workflow · CWE-89 | Yüksek8,7 | — | %0,3 | 3 gün önce |
30İzleyin | CVE-2026-43834İstismar yok | A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code executiadvantech · adam-3600 · CWE-121 | Yüksek7,5 | — | %0,3 | 3 gün önce |
34İzleyin | CVE-2026-43835İstismar yok | A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentadvantech · adam-3600 · CWE-345 | Yüksek8,6 | — | %0,1 | 3 gün önce |
30İzleyin | CVE-2026-113469İstismar yok | Improper Signature Verification of Active Update Filesstormshield · stormshield network security · CWE-287 | Yüksek7,5 | — | %0,1 | 3 gün önce |
37İzleyin | CVE-2026-43836İstismar yok | A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.advantech · adam-3600 · CWE-77 | Kritik9,3 | — | %0,6 | 3 gün önce |
30İzleyin | CVE-2026-43837İstismar yok | A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve codeadvantech · adam-3600 · CWE-120 | Yüksek7,5 | — | %0,3 | 3 gün önce |
36İzleyin | CVE-2026-43838İstismar yok | A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.advantech · adam-3600 · CWE-121 | Kritik9,2 | — | %0,3 | 3 gün önce |
34İzleyin | CVE-2026-43839İstismar yok | A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.advantech · adam-3600 · CWE-476 | Yüksek8,7 | — | %0,2 | 3 gün önce |
37İzleyin | CVE-2026-43844İstismar yok | A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.advantech · adam-3600 · CWE-287 | Kritik9,3 | — | %0,4 | 3 gün önce |
36İzleyin | CVE-2026-43845İstismar yok | A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.advantech · adam-3600 · CWE-640 | Kritik9,2 | — | %0,3 | 3 gün önce |
34İzleyin | CVE-2026-43846İstismar yok | A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution.advantech · adam-3600 · CWE-121 | Yüksek8,6 | — | %0,3 | 3 gün önce |
32İzleyin | CVE-2026-43847İstismar yok | A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even wheadvantech · adam-3600 · CWE-307 | Yüksek8,2 | — | %0,2 | 3 gün önce |
28İzleyin | CVE-2026-112064İstismar yok | SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin)typo3 · extension "sgalinski cookie consent" · CWE-89 | Yüksek7,1 | — | %0,3 | 3 gün önce |
28İzleyin | CVE-2026-112066İstismar yok | Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)typo3 · extension "sgalinski cookie consent" · CWE-862 | Yüksek7,1 | — | %0,4 | 3 gün önce |
27İzleyin | CVE-2026-112071Kavram kanıtı | Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)typo3 · extension "typo3 shop by coding.ms" · CWE-862 | Orta6,9 | — | %0,4 | 3 gün önce |
34İzleyin | CVE-2026-112238İstismar yok | SQL Injection in extension "File manager" (ameos_filemanager)typo3 · extension "file manager" · CWE-89 | Yüksek8,7 | — | %0,4 | 3 gün önce |
28İzleyin | CVE-2026-112239İstismar yok | Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai)typo3 · extension "typo3 ai integration extension" · CWE-862 | Yüksek7,2 | — | %0,3 | 3 gün önce |
28İzleyin | CVE-2026-113459İstismar yok | Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai)typo3 · extension "typo3 ai integration extension" · CWE-201 | Yüksek7,1 | — | %0,3 | 3 gün önce |
27İzleyin | CVE-2026-113468Kavram kanıtı | Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)typo3 · extension "typo3 shop by coding.ms" · CWE-862 | Orta6,9 | — | %0,4 | 3 gün önce |
34İzleyin | CVE-2026-43850İstismar yok | A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system.advantech · adam-3600 · CWE-77 | Yüksek8,6 | — | %1,3 | 3 gün önce |
32İzleyin | CVE-2026-43851İstismar yok | A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system.advantech · adam-3600 · CWE-22 | Yüksek8,2 | — | %0,4 | 3 gün önce |
32İzleyin | CVE-2026-43852İstismar yok | A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system.advantech · adam-3600 · CWE-22 | Yüksek8,2 | — | %0,4 | 3 gün önce |
32İzleyin | CVE-2026-43853İstismar yok | A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash.advantech · adam-3600 · CWE-617 | Yüksek8,2 | — | %0,4 | 3 gün önce |
30İzleyin | CVE-2026-43855İstismar yok | A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.advantech · adam-3600 · CWE-122 | Yüksek7,5 | — | %0,5 | 3 gün önce |
34İzleyin | CVE-2026-43856İstismar yok | A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbadvantech · adam-3600 · CWE-121 | Yüksek8,6 | — | %0,7 | 3 gün önce |
34İzleyin | CVE-2026-43857İstismar yok | A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service.advantech · adam-3600 · CWE-94 | Yüksek8,6 | — | %0,7 | 3 gün önce |
34İzleyin | CVE-2026-43858İstismar yok | A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.advantech · adam-3600 · CWE-121 | Yüksek8,6 | — | %0,7 | 3 gün önce |
34İzleyin | CVE-2026-85267İstismar yok | Cross-Site WebSocket Hijacking in Google Cloud Shellgoogle cloud · cloud shell · CWE-1385 | Yüksek8,7 | — | %0,2 | 3 gün önce |
30İzleyin | CVE-2026-108089İstismar yok | Apache Cocoon: Unauthenticated access to diagnostic interfacesapache software foundation · apache cocoon · CWE-497 | Yüksek7,5 | — | %0,4 | 3 gün önce |
32İzleyin | CVE-2026-113351İstismar yok | libexpat 2.7.2 through 2.9.0 Denial of Service via XML_ParserResetlibexpat · libexpat · CWE-909 | Yüksek8,2 | — | %0,4 | 3 gün önce |
30İzleyin | CVE-2026-113352İstismar yok | uTox through 0.18.1 Path Traversal via Auto-Accepted File Transfersutox · utox · CWE-22 | Yüksek7,7 | — | %0,5 | 3 gün önce |
28İzleyin | CVE-2026-113354İstismar yok | Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/contentfinsys · dockhand · CWE-863 | Yüksek7,1 | — | %0,2 | 3 gün önce |
30İzleyin | CVE-2026-113356İstismar yok | DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Conditiondokuwiki · dokuwiki · CWE-502 | Yüksek7,7 | — | %0,5 | 3 gün önce |
34İzleyin | CVE-2026-113358İstismar yok | LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routeslavalite · cms · CWE-306 | Yüksek8,7 | — | %0,4 | 3 gün önce |
37İzleyin | CVE-2026-9589İstismar yok | Unblu Spark Authorization Bypass in Configuration Cascade Operationsunblu inc. · unblu spark · CWE-639 | Kritik9,3 | — | %0,3 | 3 gün önce |
30İzleyin | CVE-2026-105311İstismar yok | Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputyred hat · streamshub console for apache kafka® · CWE-441 | Yüksek7,7 | — | %0,2 | 3 gün önce |
39İzleyin | CVE-2026-105312İstismar yok | Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalationred hat · streamshub console for apache kafka® · CWE-269 | Kritik9,9 | — | %0,3 | 3 gün önce |
35İzleyin | CVE-2026-105949İstismar yok | Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpointsred hat · streams for apache kafka 2 · CWE-287 | Yüksek8,8 | — | %0,2 | 3 gün önce |
35İzleyin | CVE-2026-113389İstismar yok | DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injectiondraytek · vigor2960 · CWE-74 | Yüksek8,6 | — | %2,1 | 3 gün önce |
34İzleyin | CVE-2026-14933İstismar yok | Unblu Spark Cross-Site Scripting in Embedded Co-Browsingunblu inc. · unblu spark · CWE-79 | Yüksek8,6 | — | %0,5 | 3 gün önce |
32İzleyin | CVE-2026-105941İstismar yok | Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultnamered hat · streams for apache kafka 3 · CWE-918 | Yüksek8,1 | — | %0,2 | 3 gün önce |
35İzleyin | CVE-2026-113390İstismar yok | DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injectiondraytek · vigor2960 · CWE-77 | Yüksek8,6 | — | %2,1 | 3 gün önce |
35İzleyin | CVE-2026-113391İstismar yok | DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injectiondraytek · vigor2960 · CWE-74 | Yüksek8,6 | — | %2,2 | 3 gün önce |
30İzleyin | CVE-2026-113619İstismar yok | Eclipse ioFog renders request templates before authenticationeclipse foundation · eclipse iofog · CWE-400 | Yüksek7,5 | — | %0,4 | 3 gün önce |
- CVE-2026-11239934İzleyin
Pillow: APNG background disposal allocates full canvas before decompression bomb check
YüksekCVSS 8,7İstismar yokEPSS %0python-pillow · pillow3 gün önce
- CVE-2026-11240034İzleyin
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
YüksekCVSS 8,7İstismar yokEPSS %0python-pillow · pillow3 gün önce
- CVE-2026-11240234İzleyin
Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
YüksekCVSS 8,7İstismar yokEPSS %0python-pillow · pillow3 gün önce
- CVE-2026-11240336İzleyin
Pillow: Heap buffer overflow in ImagingJpegDecode
KritikCVSS 9,2İstismar yokEPSS %0python-pillow · pillow3 gün önce
- CVE-2026-11240435İzleyin
Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
YüksekCVSS 8,8İstismar yokEPSS %0python-pillow · pillow3 gün önce
- CVE-2026-11240534İzleyin
Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0
YüksekCVSS 8,7İstismar yokEPSS %0python-pillow · pillow3 gün önce
- CVE-2026-11240634İzleyin
Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle
YüksekCVSS 8,7İstismar yokEPSS %0python-pillow · pillow3 gün önce
- CVE-2026-11289234İzleyin
Pillow: MSP RLE decoder expands a tiny file into unbounded memory
YüksekCVSS 8,7İstismar yokEPSS %0python-pillow · pillow3 gün önce
- CVE-2026-11289332İzleyin
Pillow: Invalid free in FreeType glyph rendering when a stroker is active
YüksekCVSS 8,2İstismar yokEPSS %0python-pillow · pillow3 gün önce
- CVE-2026-11289434İzleyin
Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
YüksekCVSS 8,7İstismar yokEPSS %0python-pillow · pillow3 gün önce
- CVE-2026-11289534İzleyin
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
YüksekCVSS 8,7İstismar yokEPSS %0python-pillow · pillow3 gün önce
- CVE-2026-11289635İzleyin
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
YüksekCVSS 8,8İstismar yokEPSS %0python-pillow · pillow3 gün önce
- CVE-2026-11289734İzleyin
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
YüksekCVSS 8,7İstismar yokEPSS %0python-pillow · pillow3 gün önce
- CVE-2026-11290036İzleyin
Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
KritikCVSS 9,2İstismar yokEPSS %0python-pillow · pillow3 gün önce
- CVE-2026-5399535İzleyin
MLflow 3.17.1 and prior Path Traversal via Trace ID API
YüksekCVSS 8,8Kavram kanıtıEPSS %0mlflow · mlflow3 gün önce
- CVE-2026-11237035İzleyin
H3C Magic NX15 usrlist sub_416874 os command injection
YüksekCVSS 8,6İstismar yokEPSS %1h3c · magic nx153 gün önce
- CVE-2026-11237134İzleyin
H3C Magic NX15 RPC esps write code injection
YüksekCVSS 8,6İstismar yokEPSS %0h3c · magic nx153 gün önce
- CVE-2026-10545333İzleyin
IBM Sterling Connect:Direct for Unix Improper Privilege Management
YüksekCVSS 8,4İstismar yokEPSS %0ibm · sterling connect direct for unix3 gün önce
- CVE-2026-10736633İzleyin
Langflow OSS Authorization Bypass Through User-Controlled Key
YüksekCVSS 8,3İstismar yokEPSS %0ibm · langflow oss3 gün önce
- CVE-2026-10740035İzleyin
Security Vulnerability identified in IBM TRIRIGA - GWT Mock Authentication
YüksekCVSS 8,8İstismar yokEPSS %0ibm · tririga application platform3 gün önce
- CVE-2026-10912635İzleyin
IBM Verify Identity Access and IBM Security Verify Access Hard-coded Credentials
YüksekCVSS 8,8İstismar yokEPSS %0ibm · verify identity access3 gün önce
- CVE-2026-10529730İzleyin
Pingora HTTP/2 server memory exhaustion through unbounded default header-list and concurrent-stream limits
YüksekCVSS 7,5İstismar yokEPSS %0cloudflare · https://github.com/cloudflare/pingora3 gün önce
- CVE-2026-10939535İzleyin
Ning compress-lzf before 1.2.0 Out-of-Bounds Memory Access via UnsafeChunkDecoder
YüksekCVSS 8,8İstismar yokEPSS %0ning · compress-lzf3 gün önce
- CVE-2026-10944034İzleyin
LangAlpha through 2026.09.07 Indirect Prompt Injection RCE via Bash and ExecuteCode
YüksekCVSS 8,7İstismar yokEPSS %0ginlix-ai · langalpha3 gün önce
- CVE-2026-10944237İzleyin
piflow 2.0.0 through 2.0.1 Unauthenticated RCE via Chat Agent exec_shell
KritikCVSS 9,3İstismar yokEPSS %0cas-bigdatalab · piflow3 gün önce
- CVE-2026-10944334İzleyin
JoySafeter through 1.0.0 Authenticated RCE via Copilot Standard Mode Shell
YüksekCVSS 8,7İstismar yokEPSS %0jd-opensource · joysafeter3 gün önce
- CVE-2026-10944437İzleyin
OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injection
KritikCVSS 9,3İstismar yokEPSS %0tracer-cloud · opensre3 gün önce
- CVE-2026-2885331İzleyin
The issue was addressed with improved checks.
YüksekCVSS 7,8İstismar yokEPSS %0apple · macos3 gün önce
- CVE-2026-7512837İzleyin
Langchain-Chatchat through 0.3.1.3 Unauthenticated RCE via /tools/call Endpoint
KritikCVSS 9,3İstismar yokEPSS %0chatchat-space · langchain-chatchat3 gün önce
- CVE-2026-7792634İzleyin
Aix-DB 1.2.4 Authenticated RCE via ChatBI Common Agent Execute Tool
YüksekCVSS 8,7İstismar yokEPSS %0apconw · aix-db3 gün önce
- CVE-2026-7793037İzleyin
EvoScientist 0.1.0 before 0.2.5 Human Approval Bypass via Async Sub-Agents
KritikCVSS 9,3İstismar yokEPSS %0evoscientist · evoscientist3 gün önce
- CVE-2026-7793237İzleyin
DB-GPT through 0.8.2 Unauthenticated RCE via /api/v1/chat/react-agent
KritikCVSS 9,3İstismar yokEPSS %0eosphoros-ai · db-gpt3 gün önce
- CVE-2026-7793337İzleyin
DB-GPT through 0.8.2 Hardcoded MySQL Root Credentials in docker-compose Deployment
KritikCVSS 9,3İstismar yokEPSS %0eosphoros-ai · db-gpt3 gün önce
- CVE-2026-7793434İzleyin
Coze Studio before 0.5.0 RCE via Unsandboxed Local Python Code Runner
YüksekCVSS 8,7İstismar yokEPSS %0coze-dev · coze-studio3 gün önce
- CVE-2026-7793534İzleyin
Coze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlers
YüksekCVSS 8,7İstismar yokEPSS %0coze-dev · coze-studio3 gün önce
- CVE-2026-7793637İzleyin
Letta through 0.16.8 Insecure Default Configuration Unauthenticated API and PostgreSQL Access
KritikCVSS 9,3İstismar yokEPSS %0letta-ai · letta3 gün önce
- CVE-2026-7793734İzleyin
Letta through 0.16.8 Cross-Tenant Impersonation via user_id Header
YüksekCVSS 8,6İstismar yokEPSS %0letta-ai · letta3 gün önce
- CVE-2026-7793828İzleyin
Letta through 0.16.8 Credential Exposure via Tool Sandbox Environment Inheritance
YüksekCVSS 7,1İstismar yokEPSS %0letta-ai · letta3 gün önce
- CVE-2026-8691935İzleyin
A stack overflow was addressed with improved input validation.
YüksekCVSS 8,8İstismar yokEPSS %0apple · ios and ipados3 gün önce
- CVE-2026-8692235İzleyin
A type confusion issue was addressed with improved state management.
YüksekCVSS 8,8İstismar yokEPSS %0apple · safari3 gün önce
- CVE-2026-8694935İzleyin
This issue was addressed by enforcing library validation on the affected binaries.
YüksekCVSS 8,8İstismar yokEPSS %0apple · xcode3 gün önce
- CVE-2026-8696131İzleyin
A race condition was addressed with additional validation.
YüksekCVSS 7,8İstismar yokEPSS %0apple · ios and ipados3 gün önce
- CVE-2026-10243834İzleyin
An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges
YüksekCVSS 8,5İstismar yokEPSS %0asus · armoury crate3 gün önce
- CVE-2026-10529934İzleyin
Pingora forwards client-nominated Connection headers to HTTP/1 upstreams, allowing ACL bypass in specific chained deployments
YüksekCVSS 8,7İstismar yokEPSS %0cloudflare · https://github.com/cloudflare/pingora3 gün önce
- CVE-2026-1751832İzleyin
Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations
YüksekCVSS 8,2İstismar yokEPSS %0asus · router3 gün önce
- CVE-2026-11338037İzleyin
In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the ability of a local hangup t
KritikCVSS 9,3İstismar yokEPSS %0signal · ringrtc3 gün önce
- CVE-2026-11338628İzleyin
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection.
YüksekCVSS 7,1İstismar yokEPSS %0roundcube · webmail3 gün önce
- CVE-2026-9330030İzleyin
EventON - Subscriber <= 1.4.5 - Unauthenticated SQL Injection via 'email' Parameter
YüksekCVSS 7,5Kavram kanıtıEPSS %0eventon · eventon - subscriber3 gün önce
- CVE-2026-9762734İzleyin
Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd.
YüksekCVSS 8,6İstismar yokEPSS %0atsumi electric co., ltd. · adx50043 gün önce
- CVE-2026-11340228İzleyin
ArmorX Global Technology|ArmorX Spam - Local File Inclusion
YüksekCVSS 7,1İstismar yokEPSS %0armorx global technology · armorx spam3 gün önce
- CVE-2026-11340328İzleyin
ArmorX Global Technology|ArmorX Spam - Command Injection
YüksekCVSS 7,1İstismar yokEPSS %0armorx global technology · armorx spam3 gün önce
- CVE-2026-11340434İzleyin
Uniong|WebITR - Insecure Deserialization
YüksekCVSS 8,7İstismar yokEPSS %0uniong · webitr3 gün önce
- CVE-2026-11109031İzleyin
Improper Signature Verification of Firmware Update Files
YüksekCVSS 7,8İstismar yokEPSS %0stormshield · stormshield network security3 gün önce
- CVE-2026-11217729İzleyin
Ghostscript: reintroduction of .charkeys -dsafer bypass in rhel 8
YüksekCVSS 7,3İstismar yokEPSS %0red hat · red hat enterprise linux 103 gün önce
- CVE-2026-11340534İzleyin
YS-infoware|BA-Workflow - SQL Injection
YüksekCVSS 8,7İstismar yokEPSS %0ys-infoware · ba-workflow3 gün önce
- CVE-2026-11340634İzleyin
YS-infoware|BA-Workflow - SQL Injection
YüksekCVSS 8,7İstismar yokEPSS %0ys-infoware · ba-workflow3 gün önce
- CVE-2026-11340734İzleyin
YS-infoware|BA-Workflow - SQL Injection
YüksekCVSS 8,7İstismar yokEPSS %0ys-infoware · ba-workflow3 gün önce
- CVE-2026-4383430İzleyin
A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code executi
YüksekCVSS 7,5İstismar yokEPSS %0advantech · adam-36003 gün önce
- CVE-2026-4383534İzleyin
A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potent
YüksekCVSS 8,6İstismar yokEPSS %0advantech · adam-36003 gün önce
- CVE-2026-11346930İzleyin
Improper Signature Verification of Active Update Files
YüksekCVSS 7,5İstismar yokEPSS %0stormshield · stormshield network security3 gün önce
- CVE-2026-4383637İzleyin
A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.
KritikCVSS 9,3İstismar yokEPSS %0advantech · adam-36003 gün önce
- CVE-2026-4383730İzleyin
A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code
YüksekCVSS 7,5İstismar yokEPSS %0advantech · adam-36003 gün önce
- CVE-2026-4383836İzleyin
A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.
KritikCVSS 9,2İstismar yokEPSS %0advantech · adam-36003 gün önce
- CVE-2026-4383934İzleyin
A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.
YüksekCVSS 8,7İstismar yokEPSS %0advantech · adam-36003 gün önce
- CVE-2026-4384437İzleyin
A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.
KritikCVSS 9,3İstismar yokEPSS %0advantech · adam-36003 gün önce
- CVE-2026-4384536İzleyin
A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.
KritikCVSS 9,2İstismar yokEPSS %0advantech · adam-36003 gün önce
- CVE-2026-4384634İzleyin
A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution.
YüksekCVSS 8,6İstismar yokEPSS %0advantech · adam-36003 gün önce
- CVE-2026-4384732İzleyin
A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even whe
YüksekCVSS 8,2İstismar yokEPSS %0advantech · adam-36003 gün önce
- CVE-2026-11206428İzleyin
SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin)
YüksekCVSS 7,1İstismar yokEPSS %0typo3 · extension "sgalinski cookie consent"3 gün önce
- CVE-2026-11206628İzleyin
Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)
YüksekCVSS 7,1İstismar yokEPSS %0typo3 · extension "sgalinski cookie consent"3 gün önce
- CVE-2026-11207127İzleyin
Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
OrtaCVSS 6,9Kavram kanıtıEPSS %0typo3 · extension "typo3 shop by coding.ms"3 gün önce
- CVE-2026-11223834İzleyin
SQL Injection in extension "File manager" (ameos_filemanager)
YüksekCVSS 8,7İstismar yokEPSS %0typo3 · extension "file manager"3 gün önce
- CVE-2026-11223928İzleyin
Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai)
YüksekCVSS 7,2İstismar yokEPSS %0typo3 · extension "typo3 ai integration extension"3 gün önce
- CVE-2026-11345928İzleyin
Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai)
YüksekCVSS 7,1İstismar yokEPSS %0typo3 · extension "typo3 ai integration extension"3 gün önce
- CVE-2026-11346827İzleyin
Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
OrtaCVSS 6,9Kavram kanıtıEPSS %0typo3 · extension "typo3 shop by coding.ms"3 gün önce
- CVE-2026-4385034İzleyin
A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system.
YüksekCVSS 8,6İstismar yokEPSS %1advantech · adam-36003 gün önce
- CVE-2026-4385132İzleyin
A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system.
YüksekCVSS 8,2İstismar yokEPSS %0advantech · adam-36003 gün önce
- CVE-2026-4385232İzleyin
A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system.
YüksekCVSS 8,2İstismar yokEPSS %0advantech · adam-36003 gün önce
- CVE-2026-4385332İzleyin
A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash.
YüksekCVSS 8,2İstismar yokEPSS %0advantech · adam-36003 gün önce
- CVE-2026-4385530İzleyin
A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.
YüksekCVSS 7,5İstismar yokEPSS %0advantech · adam-36003 gün önce
- CVE-2026-4385634İzleyin
A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arb
YüksekCVSS 8,6İstismar yokEPSS %0advantech · adam-36003 gün önce
- CVE-2026-4385734İzleyin
A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service.
YüksekCVSS 8,6İstismar yokEPSS %0advantech · adam-36003 gün önce
- CVE-2026-4385834İzleyin
A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.
YüksekCVSS 8,6İstismar yokEPSS %0advantech · adam-36003 gün önce
- CVE-2026-8526734İzleyin
Cross-Site WebSocket Hijacking in Google Cloud Shell
YüksekCVSS 8,7İstismar yokEPSS %0google cloud · cloud shell3 gün önce
- CVE-2026-10808930İzleyin
Apache Cocoon: Unauthenticated access to diagnostic interfaces
YüksekCVSS 7,5İstismar yokEPSS %0apache software foundation · apache cocoon3 gün önce
- CVE-2026-11335132İzleyin
libexpat 2.7.2 through 2.9.0 Denial of Service via XML_ParserReset
YüksekCVSS 8,2İstismar yokEPSS %0libexpat · libexpat3 gün önce
- CVE-2026-11335230İzleyin
uTox through 0.18.1 Path Traversal via Auto-Accepted File Transfers
YüksekCVSS 7,7İstismar yokEPSS %0utox · utox3 gün önce
- CVE-2026-11335428İzleyin
Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/content
YüksekCVSS 7,1İstismar yokEPSS %0finsys · dockhand3 gün önce
- CVE-2026-11335630İzleyin
DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition
YüksekCVSS 7,7İstismar yokEPSS %0dokuwiki · dokuwiki3 gün önce
- CVE-2026-11335834İzleyin
LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes
YüksekCVSS 8,7İstismar yokEPSS %0lavalite · cms3 gün önce
- CVE-2026-958937İzleyin
Unblu Spark Authorization Bypass in Configuration Cascade Operations
KritikCVSS 9,3İstismar yokEPSS %0unblu inc. · unblu spark3 gün önce
- CVE-2026-10531130İzleyin
Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy
YüksekCVSS 7,7İstismar yokEPSS %0red hat · streamshub console for apache kafka®3 gün önce
- CVE-2026-10531239İzleyin
Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation
KritikCVSS 9,9İstismar yokEPSS %0red hat · streamshub console for apache kafka®3 gün önce
- CVE-2026-10594935İzleyin
Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints
YüksekCVSS 8,8İstismar yokEPSS %0red hat · streams for apache kafka 23 gün önce
- CVE-2026-11338935İzleyin
DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection
YüksekCVSS 8,6İstismar yokEPSS %2draytek · vigor29603 gün önce
- CVE-2026-1493334İzleyin
Unblu Spark Cross-Site Scripting in Embedded Co-Browsing
YüksekCVSS 8,6İstismar yokEPSS %0unblu inc. · unblu spark3 gün önce
- CVE-2026-10594132İzleyin
Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname
YüksekCVSS 8,1İstismar yokEPSS %0red hat · streams for apache kafka 33 gün önce
- CVE-2026-11339035İzleyin
DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection
YüksekCVSS 8,6İstismar yokEPSS %2draytek · vigor29603 gün önce
- CVE-2026-11339135İzleyin
DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection
YüksekCVSS 8,6İstismar yokEPSS %2draytek · vigor29603 gün önce
- CVE-2026-11361930İzleyin
Eclipse ioFog renders request templates before authentication
YüksekCVSS 7,5İstismar yokEPSS %0eclipse foundation · eclipse iofog3 gün önce