Yayın tarihine göre
Ekim 2026: sömürülen ve yeni ciddi CVE kayıtları
6.941 kayıt · 14 KEV. Yayın sırasıyla.
Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.
Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.
Sayfa 54 / 70
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
34İzleyin | CVE-2026-113407İstismar yok | YS-infoware|BA-Workflow - SQL Injectionys-infoware · ba-workflow · CWE-89 | Yüksek8,7 | — | %0,3 | 5 gün önce |
30İzleyin | CVE-2026-43834İstismar yok | A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code executiadvantech · adam-3600 · CWE-121 | Yüksek7,5 | — | %0,3 | 5 gün önce |
34İzleyin | CVE-2026-43835İstismar yok | A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potentadvantech · adam-3600 · CWE-345 | Yüksek8,6 | — | %0,1 | 5 gün önce |
30İzleyin | CVE-2026-113469İstismar yok | Improper Signature Verification of Active Update Filesstormshield · stormshield network security · CWE-287 | Yüksek7,5 | — | %0,1 | 5 gün önce |
37İzleyin | CVE-2026-43836İstismar yok | A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.advantech · adam-3600 · CWE-77 | Kritik9,3 | — | %0,6 | 5 gün önce |
30İzleyin | CVE-2026-43837İstismar yok | A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve codeadvantech · adam-3600 · CWE-120 | Yüksek7,5 | — | %0,3 | 5 gün önce |
36İzleyin | CVE-2026-43838İstismar yok | A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.advantech · adam-3600 · CWE-121 | Kritik9,2 | — | %0,3 | 5 gün önce |
34İzleyin | CVE-2026-43839İstismar yok | A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.advantech · adam-3600 · CWE-476 | Yüksek8,7 | — | %0,2 | 5 gün önce |
37İzleyin | CVE-2026-43844İstismar yok | A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.advantech · adam-3600 · CWE-287 | Kritik9,3 | — | %0,4 | 5 gün önce |
36İzleyin | CVE-2026-43845İstismar yok | A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.advantech · adam-3600 · CWE-640 | Kritik9,2 | — | %0,3 | 5 gün önce |
34İzleyin | CVE-2026-43846İstismar yok | A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution.advantech · adam-3600 · CWE-121 | Yüksek8,6 | — | %0,3 | 5 gün önce |
32İzleyin | CVE-2026-43847İstismar yok | A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even wheadvantech · adam-3600 · CWE-307 | Yüksek8,2 | — | %0,2 | 5 gün önce |
28İzleyin | CVE-2026-112064İstismar yok | SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin)typo3 · extension "sgalinski cookie consent" · CWE-89 | Yüksek7,1 | — | %0,3 | 5 gün önce |
28İzleyin | CVE-2026-112066İstismar yok | Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)typo3 · extension "sgalinski cookie consent" · CWE-862 | Yüksek7,1 | — | %0,4 | 5 gün önce |
27İzleyin | CVE-2026-112071Kavram kanıtı | Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)typo3 · extension "typo3 shop by coding.ms" · CWE-862 | Orta6,9 | — | %0,4 | 5 gün önce |
34İzleyin | CVE-2026-112238İstismar yok | SQL Injection in extension "File manager" (ameos_filemanager)typo3 · extension "file manager" · CWE-89 | Yüksek8,7 | — | %0,4 | 5 gün önce |
28İzleyin | CVE-2026-112239İstismar yok | Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai)typo3 · extension "typo3 ai integration extension" · CWE-862 | Yüksek7,2 | — | %0,3 | 5 gün önce |
28İzleyin | CVE-2026-113459İstismar yok | Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai)typo3 · extension "typo3 ai integration extension" · CWE-201 | Yüksek7,1 | — | %0,3 | 5 gün önce |
27İzleyin | CVE-2026-113468Kavram kanıtı | Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)typo3 · extension "typo3 shop by coding.ms" · CWE-862 | Orta6,9 | — | %0,4 | 5 gün önce |
34İzleyin | CVE-2026-43850İstismar yok | A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system.advantech · adam-3600 · CWE-77 | Yüksek8,6 | — | %1,3 | 5 gün önce |
32İzleyin | CVE-2026-43851İstismar yok | A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system.advantech · adam-3600 · CWE-22 | Yüksek8,2 | — | %0,4 | 5 gün önce |
32İzleyin | CVE-2026-43852İstismar yok | A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system.advantech · adam-3600 · CWE-22 | Yüksek8,2 | — | %0,4 | 5 gün önce |
32İzleyin | CVE-2026-43853İstismar yok | A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash.advantech · adam-3600 · CWE-617 | Yüksek8,2 | — | %0,4 | 5 gün önce |
30İzleyin | CVE-2026-43855İstismar yok | A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.advantech · adam-3600 · CWE-122 | Yüksek7,5 | — | %0,5 | 5 gün önce |
34İzleyin | CVE-2026-43856İstismar yok | A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbadvantech · adam-3600 · CWE-121 | Yüksek8,6 | — | %0,7 | 5 gün önce |
34İzleyin | CVE-2026-43857İstismar yok | A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service.advantech · adam-3600 · CWE-94 | Yüksek8,6 | — | %0,7 | 5 gün önce |
34İzleyin | CVE-2026-43858İstismar yok | A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.advantech · adam-3600 · CWE-121 | Yüksek8,6 | — | %0,7 | 5 gün önce |
34İzleyin | CVE-2026-85267İstismar yok | Cross-Site WebSocket Hijacking in Google Cloud Shellgoogle cloud · cloud shell · CWE-1385 | Yüksek8,7 | — | %0,2 | 5 gün önce |
30İzleyin | CVE-2026-108089İstismar yok | Apache Cocoon: Unauthenticated access to diagnostic interfacesapache software foundation · apache cocoon · CWE-497 | Yüksek7,5 | — | %0,4 | 5 gün önce |
32İzleyin | CVE-2026-113351İstismar yok | libexpat 2.7.2 through 2.9.0 Denial of Service via XML_ParserResetlibexpat · libexpat · CWE-909 | Yüksek8,2 | — | %0,4 | 5 gün önce |
30İzleyin | CVE-2026-113352İstismar yok | uTox through 0.18.1 Path Traversal via Auto-Accepted File Transfersutox · utox · CWE-22 | Yüksek7,7 | — | %0,5 | 5 gün önce |
28İzleyin | CVE-2026-113354İstismar yok | Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/contentfinsys · dockhand · CWE-863 | Yüksek7,1 | — | %0,2 | 5 gün önce |
30İzleyin | CVE-2026-113356İstismar yok | DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Conditiondokuwiki · dokuwiki · CWE-502 | Yüksek7,7 | — | %0,5 | 5 gün önce |
34İzleyin | CVE-2026-113358İstismar yok | LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routeslavalite · cms · CWE-306 | Yüksek8,7 | — | %0,4 | 5 gün önce |
37İzleyin | CVE-2026-9589İstismar yok | Unblu Spark Authorization Bypass in Configuration Cascade Operationsunblu inc. · unblu spark · CWE-639 | Kritik9,3 | — | %0,3 | 5 gün önce |
30İzleyin | CVE-2026-105311İstismar yok | Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputyred hat · streamshub console for apache kafka® · CWE-441 | Yüksek7,7 | — | %0,2 | 5 gün önce |
39İzleyin | CVE-2026-105312İstismar yok | Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalationred hat · streamshub console for apache kafka® · CWE-269 | Kritik9,9 | — | %0,3 | 5 gün önce |
35İzleyin | CVE-2026-105949İstismar yok | Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpointsred hat · streams for apache kafka 2 · CWE-287 | Yüksek8,8 | — | %0,3 | 5 gün önce |
35İzleyin | CVE-2026-113389İstismar yok | DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injectiondraytek · vigor2960 · CWE-74 | Yüksek8,6 | — | %2,1 | 5 gün önce |
34İzleyin | CVE-2026-14933İstismar yok | Unblu Spark Cross-Site Scripting in Embedded Co-Browsingunblu inc. · unblu spark · CWE-79 | Yüksek8,6 | — | %0,5 | 5 gün önce |
32İzleyin | CVE-2026-105941İstismar yok | Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultnamered hat · streams for apache kafka 3 · CWE-918 | Yüksek8,1 | — | %0,2 | 5 gün önce |
35İzleyin | CVE-2026-113390İstismar yok | DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injectiondraytek · vigor2960 · CWE-77 | Yüksek8,6 | — | %2,1 | 5 gün önce |
35İzleyin | CVE-2026-113391İstismar yok | DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injectiondraytek · vigor2960 · CWE-74 | Yüksek8,6 | — | %2,2 | 5 gün önce |
30İzleyin | CVE-2026-113619İstismar yok | Eclipse ioFog renders request templates before authenticationeclipse foundation · eclipse iofog · CWE-400 | Yüksek7,5 | — | %0,4 | 5 gün önce |
39İzleyin | CVE-2026-113620İstismar yok | Eclipse ioFog operator WebSocket accepts an unverified JWTeclipse foundation · eclipse iofog · CWE-347 | Kritik9,8 | — | %0,2 | 5 gün önce |
36İzleyin | CVE-2026-101296İstismar yok | Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanismsapache software foundation · apache tomcat · CWE-304 | Kritik9,1 | — | %0,6 | 5 gün önce |
36İzleyin | CVE-2026-101356İstismar yok | Apache Tomcat: HTTP/2 request/response mix-up after error during async processingapache software foundation · apache tomcat · CWE-362 | Kritik9,1 | — | %0,5 | 5 gün önce |
36İzleyin | CVE-2026-103119İstismar yok | Apache Tomcat: AJP response mix-upapache software foundation · apache tomcat · CWE-127 | Kritik9,1 | — | %0,6 | 5 gün önce |
31İzleyin | CVE-2026-91041İstismar yok | FileX fault-tolerant log replay writes past the destination sector when mounting a crafted FAT imageeclipse foundation · eclipse threadx - filex · CWE-787 | Yüksek7,8 | — | %0,1 | 5 gün önce |
28İzleyin | CVE-2026-112940İstismar yok | filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its owntox-dev · filelock · CWE-363 | Yüksek7,1 | — | %0,1 | 5 gün önce |
30İzleyin | CVE-2026-112942İstismar yok | launch-editor: `fs.existsSync()` existence check can be bypassed on Windowsvitejs · launch-editor · CWE-77 | Yüksek7,5 | — | %1,3 | 5 gün önce |
33İzleyin | CVE-2026-91186İstismar yok | PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds writeeclipse foundation · eclipse threadx - guix · CWE-125 | Yüksek8,4 | — | %0,1 | 5 gün önce |
28İzleyin | CVE-2026-91189İstismar yok | GUIX binary resource loader: unvalidated glyph range causes an integer underflow and a heap out-of-bounds write when loading an untrusted font or themeeclipse foundation · eclipse threadx - guix · CWE-190 | Yüksek7,1 | — | %0,1 | 5 gün önce |
28İzleyin | CVE-2026-92162Kavram kanıtı | Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstreamflatpak · flatpak · CWE-22 | Yüksek7,2 | — | %0,1 | 5 gün önce |
31İzleyin | CVE-2026-95168İstismar yok | An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thefuck/corrector.py andCWE-94 | Yüksek7,8 | — | %0,1 | 5 gün önce |
28İzleyin | CVE-2025-71436İstismar yok | Raptor RDF Syntax Library 2.0.15 through 2.0.16 Heap Buffer Overflow via Language Taglibrdf · raptor rdf syntax library · CWE-122 | Yüksek7,1 | — | %0,5 | 5 gün önce |
30İzleyin | CVE-2026-111764İstismar yok | A2A Java SDK has a fail-open default task authorizationa2aproject · a2a-java · CWE-862 | Yüksek7,5 | — | %0,6 | 5 gün önce |
30İzleyin | CVE-2026-111765İstismar yok | A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fixa2aproject · a2a-java · CWE-522 | Yüksek7,5 | — | %0,6 | 5 gün önce |
35İzleyin | CVE-2026-112836İstismar yok | WordPress VikRentCar plugin <= 1.4.8 - Cross Site Request Forgery (CSRF) vulnerabilitye4jvikwp · vikrentcar · CWE-352 | Yüksek8,8 | — | %0,1 | 5 gün önce |
34İzleyin | CVE-2026-113605İstismar yok | Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-databasestirling-tools · stirling-pdf · CWE-184 | Yüksek8,6 | — | %0,6 | 5 gün önce |
28İzleyin | CVE-2026-113606İstismar yok | Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Foldersstirling-tools · stirling-pdf · CWE-639 | Yüksek7,1 | — | %0,2 | 5 gün önce |
28İzleyin | CVE-2026-113607İstismar yok | Configurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_datajleyva · moodle-block_configurablereports · CWE-863 | Yüksek7,1 | — | %0,4 | 5 gün önce |
36İzleyin | CVE-2026-113613İstismar yok | FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress pluginflexget · flexget · CWE-22 | Kritik9,2 | — | %0,7 | 5 gün önce |
37İzleyin | CVE-2026-113678İstismar yok | Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cronfroxlor · froxlor · CWE-59 | Kritik9,4 | — | %0,4 | 5 gün önce |
29İzleyin | CVE-2026-113679İstismar yok | HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_stringharfbuzz · harfbuzz · CWE-787 | Yüksek7,3 | — | %0,1 | 5 gün önce |
36İzleyin | CVE-2026-113682İstismar yok | Networknt light-4j 2.1.5 before 2.4.0 Authentication Bypass via Empty LDAP Passwordnetworknt · light-4j · CWE-287 | Kritik9,1 | — | %0,4 | 5 gün önce |
36İzleyin | CVE-2026-113703İstismar yok | SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofinggiuseppe99barchetta · suggestarr · CWE-290 | Kritik9,1 | — | %0,4 | 5 gün önce |
37İzleyin | CVE-2026-86471İstismar yok | Apache CouchDB: Admin credentials leading to code execution as operating system userapache software foundation · apache couchdb · CWE-78 | Kritik9,3 | — | %0,6 | 5 gün önce |
30İzleyin | CVE-2026-90797İstismar yok | Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_sessionapache software foundation · apache couchdb · CWE-409 | Yüksek7,7 | — | %0,6 | 5 gün önce |
32İzleyin | CVE-2026-90800İstismar yok | Apache CouchDB: Auth bypass in prefixed _users and _replicator databasesapache software foundation · apache couchdb · CWE-862 | Yüksek8,1 | — | %0,6 | 5 gün önce |
34İzleyin | CVE-2026-92843İstismar yok | Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secureeclipse foundation · eclipse threadx - netx duo · CWE-125 | Yüksek8,7 | — | %0,2 | 5 gün önce |
34İzleyin | CVE-2026-92853İstismar yok | Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secureeclipse foundation · eclipse threadx - netx duo · CWE-125 | Yüksek8,7 | — | %0,2 | 5 gün önce |
37İzleyin | CVE-2026-93475İstismar yok | Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509eclipse foundation · eclipse threadx - netx duo · CWE-787 | Kritik9,3 | — | %0,2 | 5 gün önce |
35İzleyin | CVE-2026-94018İstismar yok | NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow patheclipse foundation · eclipse threadx - netx duo · CWE-457 | Yüksek8,8 | — | %0,3 | 5 gün önce |
34İzleyin | CVE-2026-94192İstismar yok | Module object deallocation can free a live ThreadX kernel objecteclipse foundation · eclipse threadx · CWE-416 | Yüksek8,5 | — | %0,1 | 5 gün önce |
28İzleyin | CVE-2026-95107İstismar yok | Module object allocation size overflow corrupts the manager object pooleclipse foundation · eclipse threadx · CWE-190 | Yüksek7,0 | — | %0,1 | 5 gün önce |
34İzleyin | CVE-2026-95109İstismar yok | Cortex-A7 module data validation checks only the first address of a caller-supplied rangeeclipse foundation · eclipse threadx · CWE-125 | Yüksek8,5 | — | %0,1 | 5 gün önce |
30İzleyin | CVE-2026-113658İstismar yok | ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directoryapostrophecms · apostrophe · CWE-400 | Yüksek7,5 | — | %0,5 | 5 gün önce |
35İzleyin | CVE-2026-28328İstismar yok | SolarWinds Observability Self-Hosted broken authorization schemasolarwinds · solarwinds observability self-hosted · CWE-863 | Yüksek8,8 | — | %0,4 | 5 gün önce |
36İzleyin | CVE-2026-105772İstismar yok | Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId and sessionIdgoogle · adk typescript (@google/adk) · CWE-22 | Kritik9,1 | — | %0,5 | 5 gün önce |
32İzleyin | CVE-2026-111756İstismar yok | follow-redirects array-form headers bypass cross-origin credential strippingfollow-redirects · follow-redirects · CWE-200 | Yüksek8,2 | — | %0,3 | 5 gün önce |
35İzleyin | CVE-2026-113506İstismar yok | aaPanel File Manager common.py ExecShell os command injectionCWE-77 | Yüksek8,6 | — | %2,0 | 5 gün önce |
28İzleyin | CVE-2026-113666İstismar yok | ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of serviceapostrophecms · apostrophe · CWE-400 | Yüksek7,1 | — | %0,4 | 5 gün önce |
39İzleyin | CVE-2026-113672İstismar yok | Argo CD: A Jsonnet import can read files from the repo-serverargoproj · argo-cd · CWE-22 | Kritik9,9 | — | %0,8 | 5 gün önce |
30İzleyin | CVE-2026-113711İstismar yok | ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-exportapostrophecms · apostrophe · CWE-400 | Yüksek7,5 | — | %0,5 | 5 gün önce |
38İzleyin | CVE-2026-113802İstismar yok | Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handlerwavlink · wl-wn530be1-a · CWE-78 | Kritik9,3 | — | %2,8 | 5 gün önce |
35İzleyin | CVE-2026-100134İstismar yok | Acrobat for Edge | Out-of-bounds Write (CWE-787)adobe · acrobat for edge · CWE-787 | Yüksek8,8 | — | %0,6 | 5 gün önce |
34İzleyin | CVE-2026-111767İstismar yok | MCP TypeScript SDK: Experimental tasks were not tied to the session that created themmodelcontextprotocol · typescript-sdk · CWE-639 | Yüksek8,6 | — | %0,3 | 5 gün önce |
39İzleyin | CVE-2026-113708İstismar yok | Argo CD: A Kustomize remote ref can run commands in the repo-serverargoproj · argo-cd · CWE-88 | Kritik9,9 | — | %0,6 | 5 gün önce |
39İzleyin | CVE-2026-113709İstismar yok | Argo CD: A Kustomize Helm config home can run commands in the repo-serverargoproj · argo-cd · CWE-829 | Kritik9,9 | — | %0,4 | 5 gün önce |
28İzleyin | CVE-2026-113808İstismar yok | Stored XSS on SNS Enrollment Portalstormshield · stormshield network security · CWE-79 | Yüksek7,1 | — | %0,2 | 5 gün önce |
28İzleyin | CVE-2026-113810İstismar yok | Stored XSS on SNS Enrollment Portalstormshield · stormshield network security · CWE-79 | Yüksek7,0 | — | %0,0 | 5 gün önce |
30İzleyin | GHSA-46jr-4wx8-v453İstismar yok | MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validationCWE-770 | Yüksek7,5 | — | — | 5 gün önce |
30İzleyin | GHSA-jm63-cq47-j5jpİstismar yok | MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to anotherCWE-362 | Yüksek7,7 | — | — | 5 gün önce |
19İzleyin | CVE-2026-107692Kavram kanıtı | War Thunder Account Impersonationgaijin entertainment · war thunder · CWE-319 | Orta4,8 | — | %0,1 | 5 gün önce |
36İzleyin | CVE-2026-112380İstismar yok | Missing authorization in the WhatsApp channel in Kiro Crewamazon · kiro crew · CWE-862 | Kritik9,0 | — | %0,4 | 5 gün önce |
28İzleyin | CVE-2026-113718İstismar yok | virtualenv: Xonsh activation literals depend on the script decoding codecpypa · virtualenv · CWE-94 | Yüksek7,1 | — | %0,1 | 5 gün önce |
31İzleyin | CVE-2026-113722İstismar yok | virtualenv: Generated POSIX console launchers interpret destination paths as shell syntaxpypa · virtualenv · CWE-78 | Yüksek7,8 | — | %0,1 | 5 gün önce |
28İzleyin | CVE-2026-113723İstismar yok | virtualenv: Bash prompt values can change meaning under older compatibility modespypa · virtualenv · CWE-78 | Yüksek7,1 | — | %0,1 | 5 gün önce |
31İzleyin | CVE-2026-113725İstismar yok | virtualenv bash activate runs commands from an environment name with a backslash before $pypa · virtualenv · CWE-78 | Yüksek7,8 | — | %0,1 | 5 gün önce |
- CVE-2026-11340734İzleyin
YS-infoware|BA-Workflow - SQL Injection
YüksekCVSS 8,7İstismar yokEPSS %0ys-infoware · ba-workflow5 gün önce
- CVE-2026-4383430İzleyin
A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code executi
YüksekCVSS 7,5İstismar yokEPSS %0advantech · adam-36005 gün önce
- CVE-2026-4383534İzleyin
A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware upgrade file, potent
YüksekCVSS 8,6İstismar yokEPSS %0advantech · adam-36005 gün önce
- CVE-2026-11346930İzleyin
Improper Signature Verification of Active Update Files
YüksekCVSS 7,5İstismar yokEPSS %0stormshield · stormshield network security5 gün önce
- CVE-2026-4383637İzleyin
A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.
KritikCVSS 9,3İstismar yokEPSS %0advantech · adam-36005 gün önce
- CVE-2026-4383730İzleyin
A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest authentication to achieve code
YüksekCVSS 7,5İstismar yokEPSS %0advantech · adam-36005 gün önce
- CVE-2026-4383836İzleyin
A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.
KritikCVSS 9,2İstismar yokEPSS %0advantech · adam-36005 gün önce
- CVE-2026-4383934İzleyin
A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.
YüksekCVSS 8,7İstismar yokEPSS %0advantech · adam-36005 gün önce
- CVE-2026-4384437İzleyin
A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.
KritikCVSS 9,3İstismar yokEPSS %0advantech · adam-36005 gün önce
- CVE-2026-4384536İzleyin
A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.
KritikCVSS 9,2İstismar yokEPSS %0advantech · adam-36005 gün önce
- CVE-2026-4384634İzleyin
A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to achieve code execution.
YüksekCVSS 8,6İstismar yokEPSS %0advantech · adam-36005 gün önce
- CVE-2026-4384732İzleyin
A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without restrictions, even whe
YüksekCVSS 8,2İstismar yokEPSS %0advantech · adam-36005 gün önce
- CVE-2026-11206428İzleyin
SQL Injection in extension "sgalinski Cookie Consent" (sg_cookie_optin)
YüksekCVSS 7,1İstismar yokEPSS %0typo3 · extension "sgalinski cookie consent"5 gün önce
- CVE-2026-11206628İzleyin
Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)
YüksekCVSS 7,1İstismar yokEPSS %0typo3 · extension "sgalinski cookie consent"5 gün önce
- CVE-2026-11207127İzleyin
Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
OrtaCVSS 6,9Kavram kanıtıEPSS %0typo3 · extension "typo3 shop by coding.ms"5 gün önce
- CVE-2026-11223834İzleyin
SQL Injection in extension "File manager" (ameos_filemanager)
YüksekCVSS 8,7İstismar yokEPSS %0typo3 · extension "file manager"5 gün önce
- CVE-2026-11223928İzleyin
Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai)
YüksekCVSS 7,2İstismar yokEPSS %0typo3 · extension "typo3 ai integration extension"5 gün önce
- CVE-2026-11345928İzleyin
Sensitive Data Exposure in extension "TYPO3 AI Integration Extension" (ns_t3ai)
YüksekCVSS 7,1İstismar yokEPSS %0typo3 · extension "typo3 ai integration extension"5 gün önce
- CVE-2026-11346827İzleyin
Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)
OrtaCVSS 6,9Kavram kanıtıEPSS %0typo3 · extension "typo3 shop by coding.ms"5 gün önce
- CVE-2026-4385034İzleyin
A command injection vulnerability could allow an authenticated attacker to achieve root-level code execution on the system.
YüksekCVSS 8,6İstismar yokEPSS %1advantech · adam-36005 gün önce
- CVE-2026-4385132İzleyin
A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system.
YüksekCVSS 8,2İstismar yokEPSS %0advantech · adam-36005 gün önce
- CVE-2026-4385232İzleyin
A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system.
YüksekCVSS 8,2İstismar yokEPSS %0advantech · adam-36005 gün önce
- CVE-2026-4385332İzleyin
A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash.
YüksekCVSS 8,2İstismar yokEPSS %0advantech · adam-36005 gün önce
- CVE-2026-4385530İzleyin
A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.
YüksekCVSS 7,5İstismar yokEPSS %0advantech · adam-36005 gün önce
- CVE-2026-4385634İzleyin
A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arb
YüksekCVSS 8,6İstismar yokEPSS %0advantech · adam-36005 gün önce
- CVE-2026-4385734İzleyin
A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service.
YüksekCVSS 8,6İstismar yokEPSS %0advantech · adam-36005 gün önce
- CVE-2026-4385834İzleyin
A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.
YüksekCVSS 8,6İstismar yokEPSS %0advantech · adam-36005 gün önce
- CVE-2026-8526734İzleyin
Cross-Site WebSocket Hijacking in Google Cloud Shell
YüksekCVSS 8,7İstismar yokEPSS %0google cloud · cloud shell5 gün önce
- CVE-2026-10808930İzleyin
Apache Cocoon: Unauthenticated access to diagnostic interfaces
YüksekCVSS 7,5İstismar yokEPSS %0apache software foundation · apache cocoon5 gün önce
- CVE-2026-11335132İzleyin
libexpat 2.7.2 through 2.9.0 Denial of Service via XML_ParserReset
YüksekCVSS 8,2İstismar yokEPSS %0libexpat · libexpat5 gün önce
- CVE-2026-11335230İzleyin
uTox through 0.18.1 Path Traversal via Auto-Accepted File Transfers
YüksekCVSS 7,7İstismar yokEPSS %0utox · utox5 gün önce
- CVE-2026-11335428İzleyin
Dockhand before 1.0.46 Arbitrary File Read via /api/system/files/content
YüksekCVSS 7,1İstismar yokEPSS %0finsys · dockhand5 gün önce
- CVE-2026-11335630İzleyin
DokuWiki before 2026-07-14c PHP Object Injection via Draft Race Condition
YüksekCVSS 7,7İstismar yokEPSS %0dokuwiki · dokuwiki5 gün önce
- CVE-2026-11335834İzleyin
LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes
YüksekCVSS 8,7İstismar yokEPSS %0lavalite · cms5 gün önce
- CVE-2026-958937İzleyin
Unblu Spark Authorization Bypass in Configuration Cascade Operations
KritikCVSS 9,3İstismar yokEPSS %0unblu inc. · unblu spark5 gün önce
- CVE-2026-10531130İzleyin
Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy
YüksekCVSS 7,7İstismar yokEPSS %0red hat · streamshub console for apache kafka®5 gün önce
- CVE-2026-10531239İzleyin
Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation
KritikCVSS 9,9İstismar yokEPSS %0red hat · streamshub console for apache kafka®5 gün önce
- CVE-2026-10594935İzleyin
Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints
YüksekCVSS 8,8İstismar yokEPSS %0red hat · streams for apache kafka 25 gün önce
- CVE-2026-11338935İzleyin
DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection
YüksekCVSS 8,6İstismar yokEPSS %2draytek · vigor29605 gün önce
- CVE-2026-1493334İzleyin
Unblu Spark Cross-Site Scripting in Embedded Co-Browsing
YüksekCVSS 8,6İstismar yokEPSS %0unblu inc. · unblu spark5 gün önce
- CVE-2026-10594132İzleyin
Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname
YüksekCVSS 8,1İstismar yokEPSS %0red hat · streams for apache kafka 35 gün önce
- CVE-2026-11339035İzleyin
DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection
YüksekCVSS 8,6İstismar yokEPSS %2draytek · vigor29605 gün önce
- CVE-2026-11339135İzleyin
DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection
YüksekCVSS 8,6İstismar yokEPSS %2draytek · vigor29605 gün önce
- CVE-2026-11361930İzleyin
Eclipse ioFog renders request templates before authentication
YüksekCVSS 7,5İstismar yokEPSS %0eclipse foundation · eclipse iofog5 gün önce
- CVE-2026-11362039İzleyin
Eclipse ioFog operator WebSocket accepts an unverified JWT
KritikCVSS 9,8İstismar yokEPSS %0eclipse foundation · eclipse iofog5 gün önce
- CVE-2026-10129636İzleyin
Apache Tomcat: JNDIRealm bind credential validation fails open for non-GSSAPI SASL mechanisms
KritikCVSS 9,1İstismar yokEPSS %0apache software foundation · apache tomcat5 gün önce
- CVE-2026-10135636İzleyin
Apache Tomcat: HTTP/2 request/response mix-up after error during async processing
KritikCVSS 9,1İstismar yokEPSS %0apache software foundation · apache tomcat5 gün önce
- CVE-2026-10311936İzleyin
Apache Tomcat: AJP response mix-up
KritikCVSS 9,1İstismar yokEPSS %0apache software foundation · apache tomcat5 gün önce
- CVE-2026-9104131İzleyin
FileX fault-tolerant log replay writes past the destination sector when mounting a crafted FAT image
YüksekCVSS 7,8İstismar yokEPSS %0eclipse foundation · eclipse threadx - filex5 gün önce
- CVE-2026-11294028İzleyin
filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own
YüksekCVSS 7,1İstismar yokEPSS %0tox-dev · filelock5 gün önce
- CVE-2026-11294230İzleyin
launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
YüksekCVSS 7,5İstismar yokEPSS %1vitejs · launch-editor5 gün önce
- CVE-2026-9118633İzleyin
PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds write
YüksekCVSS 8,4İstismar yokEPSS %0eclipse foundation · eclipse threadx - guix5 gün önce
- CVE-2026-9118928İzleyin
GUIX binary resource loader: unvalidated glyph range causes an integer underflow and a heap out-of-bounds write when loading an untrusted font or theme
YüksekCVSS 7,1İstismar yokEPSS %0eclipse foundation · eclipse threadx - guix5 gün önce
- CVE-2026-9216228İzleyin
Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstream
YüksekCVSS 7,2Kavram kanıtıEPSS %0flatpak · flatpak5 gün önce
- CVE-2026-9516831İzleyin
An issue in nvbn thefuck v.3.32 allows a local attacker to execute arbitrary code via the get_rules_import_paths in thefuck/corrector.py and
YüksekCVSS 7,8İstismar yokEPSS %05 gün önce
- CVE-2025-7143628İzleyin
Raptor RDF Syntax Library 2.0.15 through 2.0.16 Heap Buffer Overflow via Language Tag
YüksekCVSS 7,1İstismar yokEPSS %0librdf · raptor rdf syntax library5 gün önce
- CVE-2026-11176430İzleyin
A2A Java SDK has a fail-open default task authorization
YüksekCVSS 7,5İstismar yokEPSS %0a2aproject · a2a-java5 gün önce
- CVE-2026-11176530İzleyin
A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix
YüksekCVSS 7,5İstismar yokEPSS %0a2aproject · a2a-java5 gün önce
- CVE-2026-11283635İzleyin
WordPress VikRentCar plugin <= 1.4.8 - Cross Site Request Forgery (CSRF) vulnerability
YüksekCVSS 8,8İstismar yokEPSS %0e4jvikwp · vikrentcar5 gün önce
- CVE-2026-11360534İzleyin
Stirling-PDF 2.13.2 through 3.2.0 H2 SQL Denylist Bypass via import-database
YüksekCVSS 8,6İstismar yokEPSS %0stirling-tools · stirling-pdf5 gün önce
- CVE-2026-11360628İzleyin
Stirling-PDF 3.0.0 through 3.2.0 Authorization Bypass via Processing Folders
YüksekCVSS 7,1İstismar yokEPSS %0stirling-tools · stirling-pdf5 gün önce
- CVE-2026-11360728İzleyin
Configurable Reports block for Moodle before 5.3.0 Authorization Bypass via get_report_data
YüksekCVSS 7,1İstismar yokEPSS %0jleyva · moodle-block_configurablereports5 gün önce
- CVE-2026-11361336İzleyin
FlexGet before 3.20.7 Path Traversal (Zip Slip) via decompress plugin
KritikCVSS 9,2İstismar yokEPSS %0flexget · flexget5 gün önce
- CVE-2026-11367837İzleyin
Froxlor before 2.3.15 Symlink Following Privilege Escalation via Traffic Cron
KritikCVSS 9,4İstismar yokEPSS %0froxlor · froxlor5 gün önce
- CVE-2026-11367929İzleyin
HarfBuzz 8.0.0 through 14.6.0 Out-of-Bounds Write via WebAssembly font_glyph_to_string
YüksekCVSS 7,3İstismar yokEPSS %0harfbuzz · harfbuzz5 gün önce
- CVE-2026-11368236İzleyin
Networknt light-4j 2.1.5 before 2.4.0 Authentication Bypass via Empty LDAP Password
KritikCVSS 9,1İstismar yokEPSS %0networknt · light-4j5 gün önce
- CVE-2026-11370336İzleyin
SuggestArr before 3.0.0 Authentication Bypass via X-Forwarded-For Spoofing
KritikCVSS 9,1İstismar yokEPSS %0giuseppe99barchetta · suggestarr5 gün önce
- CVE-2026-8647137İzleyin
Apache CouchDB: Admin credentials leading to code execution as operating system user
KritikCVSS 9,3İstismar yokEPSS %0apache software foundation · apache couchdb5 gün önce
- CVE-2026-9079730İzleyin
Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session
YüksekCVSS 7,7İstismar yokEPSS %0apache software foundation · apache couchdb5 gün önce
- CVE-2026-9080032İzleyin
Apache CouchDB: Auth bypass in prefixed _users and _replicator databases
YüksekCVSS 8,1İstismar yokEPSS %0apache software foundation · apache couchdb5 gün önce
- CVE-2026-9284334İzleyin
Out-of-bounds Read via the TLS 1.3 Certificate extensions_length in NetX Secure
YüksekCVSS 8,7İstismar yokEPSS %0eclipse foundation · eclipse threadx - netx duo5 gün önce
- CVE-2026-9285334İzleyin
Out-of-bounds Read via a Zero-length TLS 1.3 Certificate Message in NetX Secure
YüksekCVSS 8,7İstismar yokEPSS %0eclipse foundation · eclipse threadx - netx duo5 gün önce
- CVE-2026-9347537İzleyin
Out-of-bounds Write via an Unbounded RSA Modulus in NetX Secure X.509
KritikCVSS 9,3İstismar yokEPSS %0eclipse foundation · eclipse threadx - netx duo5 gün önce
- CVE-2026-9401835İzleyin
NetX Duo Web HTTP server releases an uninitialized packet pointer on the PUT Content-Length underflow path
YüksekCVSS 8,8İstismar yokEPSS %0eclipse foundation · eclipse threadx - netx duo5 gün önce
- CVE-2026-9419234İzleyin
Module object deallocation can free a live ThreadX kernel object
YüksekCVSS 8,5İstismar yokEPSS %0eclipse foundation · eclipse threadx5 gün önce
- CVE-2026-9510728İzleyin
Module object allocation size overflow corrupts the manager object pool
YüksekCVSS 7,0İstismar yokEPSS %0eclipse foundation · eclipse threadx5 gün önce
- CVE-2026-9510934İzleyin
Cortex-A7 module data validation checks only the first address of a caller-supplied range
YüksekCVSS 8,5İstismar yokEPSS %0eclipse foundation · eclipse threadx5 gün önce
- CVE-2026-11365830İzleyin
ApostropheCMS: Unauthenticated CSV import requests leave rejected uploads in the system temporary directory
YüksekCVSS 7,5İstismar yokEPSS %0apostrophecms · apostrophe5 gün önce
- CVE-2026-2832835İzleyin
SolarWinds Observability Self-Hosted broken authorization schema
YüksekCVSS 8,8İstismar yokEPSS %0solarwinds · solarwinds observability self-hosted5 gün önce
- CVE-2026-10577236İzleyin
Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId and sessionId
KritikCVSS 9,1İstismar yokEPSS %0google · adk typescript (@google/adk)5 gün önce
- CVE-2026-11175632İzleyin
follow-redirects array-form headers bypass cross-origin credential stripping
YüksekCVSS 8,2İstismar yokEPSS %0follow-redirects · follow-redirects5 gün önce
- CVE-2026-11350635İzleyin
aaPanel File Manager common.py ExecShell os command injection
YüksekCVSS 8,6İstismar yokEPSS %25 gün önce
- CVE-2026-11366628İzleyin
ApostropheCMS: Authenticated projection-exclusion prototype-member deletion in @apostrophecms/db-connect causes process-wide denial of service
YüksekCVSS 7,1İstismar yokEPSS %0apostrophecms · apostrophe5 gün önce
- CVE-2026-11367239İzleyin
Argo CD: A Jsonnet import can read files from the repo-server
KritikCVSS 9,9İstismar yokEPSS %0argoproj · argo-cd5 gün önce
- CVE-2026-11371130İzleyin
ApostropheCMS: Unauthenticated resource exhaustion via pre-auth aposBigUpload processing in @apostrophecms/import-export
YüksekCVSS 7,5İstismar yokEPSS %0apostrophecms · apostrophe5 gün önce
- CVE-2026-11380238İzleyin
Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler
KritikCVSS 9,3İstismar yokEPSS %2wavlink · wl-wn530be1-a5 gün önce
- CVE-2026-10013435İzleyin
Acrobat for Edge | Out-of-bounds Write (CWE-787)
YüksekCVSS 8,8İstismar yokEPSS %0adobe · acrobat for edge5 gün önce
- CVE-2026-11176734İzleyin
MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
YüksekCVSS 8,6İstismar yokEPSS %0modelcontextprotocol · typescript-sdk5 gün önce
- CVE-2026-11370839İzleyin
Argo CD: A Kustomize remote ref can run commands in the repo-server
KritikCVSS 9,9İstismar yokEPSS %0argoproj · argo-cd5 gün önce
- CVE-2026-11370939İzleyin
Argo CD: A Kustomize Helm config home can run commands in the repo-server
KritikCVSS 9,9İstismar yokEPSS %0argoproj · argo-cd5 gün önce
- CVE-2026-11380828İzleyin
Stored XSS on SNS Enrollment Portal
YüksekCVSS 7,1İstismar yokEPSS %0stormshield · stormshield network security5 gün önce
- CVE-2026-11381028İzleyin
Stored XSS on SNS Enrollment Portal
YüksekCVSS 7,0İstismar yokEPSS %0stormshield · stormshield network security5 gün önce
- GHSA-46jr-4wx8-v45330İzleyin
MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
YüksekCVSS 7,5İstismar yok5 gün önce
- GHSA-jm63-cq47-j5jp30İzleyin
MCP TypeScript server SDK: Shared transport or server instances delivered one HTTP client's messages to another
YüksekCVSS 7,7İstismar yok5 gün önce
- CVE-2026-10769219İzleyin
War Thunder Account Impersonation
OrtaCVSS 4,8Kavram kanıtıEPSS %0gaijin entertainment · war thunder5 gün önce
- CVE-2026-11238036İzleyin
Missing authorization in the WhatsApp channel in Kiro Crew
KritikCVSS 9,0İstismar yokEPSS %0amazon · kiro crew5 gün önce
- CVE-2026-11371828İzleyin
virtualenv: Xonsh activation literals depend on the script decoding codec
YüksekCVSS 7,1İstismar yokEPSS %0pypa · virtualenv5 gün önce
- CVE-2026-11372231İzleyin
virtualenv: Generated POSIX console launchers interpret destination paths as shell syntax
YüksekCVSS 7,8İstismar yokEPSS %0pypa · virtualenv5 gün önce
- CVE-2026-11372328İzleyin
virtualenv: Bash prompt values can change meaning under older compatibility modes
YüksekCVSS 7,1İstismar yokEPSS %0pypa · virtualenv5 gün önce
- CVE-2026-11372531İzleyin
virtualenv bash activate runs commands from an environment name with a backslash before $
YüksekCVSS 7,8İstismar yokEPSS %0pypa · virtualenv5 gün önce