Yayın tarihine göre
Ekim 2026: sömürülen ve yeni ciddi CVE kayıtları
7.137 kayıt · 16 KEV. Yayın sırasıyla.
Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.
Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.
Sayfa 6 / 72
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
36İzleyin | CVE-2026-92084Kavram kanıtı | Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Outputbeaverbuilder · beaver builder page builder – drag and drop website builder · CWE-94 | Kritik9,1 | — | %0,8 | 3 Eki 2026 |
32İzleyin | CVE-2026-71883İstismar yok | Native AES packet cipher returns the raw AES key on an aliaslegion of the bouncy castle inc. · bc-lts-java · CWE-200 | Yüksek8,2 | — | %0,2 | 3 Eki 2026 |
36İzleyin | CVE-2026-71885İstismar yok | MLS X.509 credential not bound to the LeafNode signature keylegion of the bouncy castle inc. · bc-java · CWE-287 | Kritik9,2 | — | %0,1 | 3 Eki 2026 |
32İzleyin | CVE-2026-71886İstismar yok | OpenPGP certification accepted from a subkey without certification authoritylegion of the bouncy castle inc. · bc-java · CWE-285 | Yüksek8,2 | — | %0,1 | 3 Eki 2026 |
32İzleyin | CVE-2026-71887İstismar yok | OpenPGP data signature accepted from a signing subkey without cross-certificationlegion of the bouncy castle inc. · bc-java · CWE-345 | Yüksek8,2 | — | %0,0 | 3 Eki 2026 |
34İzleyin | CVE-2026-71888İstismar yok | CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absentlegion of the bouncy castle inc. · bc-java · CWE-354 | Yüksek8,7 | — | %0,1 | 3 Eki 2026 |
34İzleyin | CVE-2026-71889İstismar yok | PKIXCertPathReviewer does not apply X.509 name constraints to the target certificatelegion of the bouncy castle inc. · bc-java · CWE-295 | Yüksek8,7 | — | %0,1 | 3 Eki 2026 |
34İzleyin | CVE-2026-71890İstismar yok | MLS external commit can remove an arbitrary group memberlegion of the bouncy castle inc. · bc-java · CWE-863 | Yüksek8,7 | — | %0,2 | 3 Eki 2026 |
28İzleyin | CVE-2026-71891İstismar yok | BLS12-381 key validation accepts a public key built on a foreign curvelegion of the bouncy castle inc. · bc-java · CWE-347 | Yüksek7,1 | — | %0,1 | 3 Eki 2026 |
32İzleyin | CVE-2026-85515İstismar yok | OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity checklegion of the bouncy castle inc. · bc-java · CWE-345 | Yüksek8,2 | — | %0,1 | 3 Eki 2026 |
39İzleyin | CVE-2026-105105Kavram kanıtı | Unauthenticated ZeroMQ command/telemetry bus in AIT-Core allows remote spacecraft command injection and telemetry exfiltrationnasa-ammos · ait-core · CWE-306 | Kritik9,8 | — | %0,7 | 3 Eki 2026 |
28İzleyin | CVE-2026-105113İstismar yok | Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlocknezhahq · nezha · CWE-667 | Yüksek7,1 | — | %0,2 | 3 Eki 2026 |
35İzleyin | CVE-2026-105115İstismar yok | OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interfaceopenidentityplatform · openam · CWE-306 | Yüksek8,8 | — | %0,4 | 3 Eki 2026 |
30İzleyin | CVE-2026-105119İstismar yok | OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flowsopenidentityplatform · openam · CWE-285 | Yüksek7,6 | — | %0,1 | 3 Eki 2026 |
32İzleyin | CVE-2026-103065İstismar yok | WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerabilitythemeum · kirki · CWE-1284 | Yüksek8,2 | — | %0,2 | 3 Eki 2026 |
28İzleyin | CVE-2026-103342İstismar yok | WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerabilityunlimited elements · unlimited elements for elementor (free widgets, addons, templates) · CWE-79 | Yüksek7,1 | — | %0,1 | 3 Eki 2026 |
35İzleyin | CVE-2026-96451Kavram kanıtı | WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerabilityultimate member · ultimate member · CWE-639 | Yüksek8,8 | — | %0,4 | 3 Eki 2026 |
34İzleyin | CVE-2026-105123İstismar yok | W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload APIvincent-peugnet · wcms · CWE-434 | Yüksek8,7 | — | %0,5 | 4 Eki 2026 |
34İzleyin | CVE-2026-105126İstismar yok | LaraDashboard before 1.4.8 Privilege Escalation via Superadmin Role Tamperinglaradashboard · laradashboard · CWE-269 | Yüksek8,6 | — | %0,4 | 4 Eki 2026 |
28İzleyin | CVE-2026-105129İstismar yok | LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings APIlaradashboard · laradashboard · CWE-863 | Yüksek7,1 | — | %0,3 | 4 Eki 2026 |
67Bu hafta | CVE-2026-88779Silahlaştırılmış | Memory overflow vulnerability leading to Denial of Servicecitrix · netscaler application delivery controller · CWE-119 | Yüksek8,7 | KEV | %11,3 | 4 Eki 2026 |
81Hemen | CVE-2026-105133Silahlaştırılmış | Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authenticationahsay · cloud backup suite · CWE-287 | Orta6,9 | KEV | %79,2 | 4 Eki 2026 |
96Hemen | CVE-2026-105134Silahlaştırılmış | Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injectionahsay · cloud backup suite · CWE-77 | Kritik10,0 | KEV | %86,2 | 4 Eki 2026 |
37İzleyin | CVE-2026-105135İstismar yok | InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injectioninternlm · mindsearch · CWE-74 | Kritik9,3 | — | %0,7 | 4 Eki 2026 |
35İzleyin | CVE-2026-93549İstismar yok | CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication Bypassunknown · cocart · CWE-352 | Yüksek8,8 | — | %0,1 | 4 Eki 2026 |
21İzleyin | CVE-2026-97332Kavram kanıtı | User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite)unknown · user private files · CWE-284 | Orta5,3 | — | %0,2 | 4 Eki 2026 |
28İzleyin | CVE-2026-103062İstismar yok | WordPress TranslatePress plugin <= 3.3.6 - Cross Site Scripting (XSS) vulnerabilitycozmoslabs · translatepress · CWE-79 | Yüksek7,1 | — | %0,1 | 4 Eki 2026 |
28İzleyin | CVE-2026-103344İstismar yok | WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerabilityunlimited elements · unlimited elements for elementor (free widgets, addons, templates) · CWE-79 | Yüksek7,1 | — | %0,1 | 4 Eki 2026 |
28İzleyin | CVE-2026-103354İstismar yok | WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.11.1 - Cross Site Scripting (XSS) vulnerabilityliquid web / stellarwp · gutenberg blocks by kadence blocks · CWE-79 | Yüksek7,1 | — | %0,1 | 4 Eki 2026 |
37İzleyin | CVE-2026-103355Kavram kanıtı | WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerabilityunlimited elements · unlimited elements for elementor (free widgets, addons, templates) · CWE-89 | Kritik9,3 | — | %0,3 | 4 Eki 2026 |
28İzleyin | CVE-2026-97276İstismar yok | WordPress WP Statistics plugin <= 14.16.14 - Cross Site Scripting (XSS) vulnerabilityveronalabs · wp statistics · CWE-79 | Yüksek7,1 | — | %0,1 | 4 Eki 2026 |
30İzleyin | CVE-2026-97307İstismar yok | WordPress Cost Calculator Builder plugin <= 4.0.17 - Sensitive Data Exposure vulnerabilitystylemixthemes · cost calculator builder · CWE-201 | Yüksek7,5 | — | %0,2 | 4 Eki 2026 |
37İzleyin | CVE-2026-105207İstismar yok | ZITADEL before 4.17.3 Account Takeover via External IdP Linkingzitadel · zitadel · CWE-306 | Kritik9,3 | — | %0,3 | 4 Eki 2026 |
34İzleyin | CVE-2026-105208İstismar yok | ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokenszitadel · zitadel · CWE-649 | Yüksek8,7 | — | %0,0 | 4 Eki 2026 |
37İzleyin | CVE-2026-105209İstismar yok | ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollmentzitadel · zitadel · CWE-862 | Kritik9,3 | — | %0,2 | 4 Eki 2026 |
35İzleyin | CVE-2026-105210İstismar yok | ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlerszitadel · zitadel · CWE-287 | Yüksek8,8 | — | %0,2 | 4 Eki 2026 |
36İzleyin | CVE-2026-105211İstismar yok | ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCodezitadel · zitadel · CWE-200 | Kritik9,2 | — | %0,3 | 4 Eki 2026 |
34İzleyin | CVE-2026-105212İstismar yok | ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollmentzitadel · zitadel · CWE-287 | Yüksek8,7 | — | %0,3 | 4 Eki 2026 |
35İzleyin | CVE-2026-105213İstismar yok | ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizationszitadel · zitadel · CWE-287 | Yüksek8,8 | — | %0,2 | 4 Eki 2026 |
37İzleyin | CVE-2026-105215İstismar yok | ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callbackzitadel · zitadel · CWE-290 | Kritik9,3 | — | %0,3 | 4 Eki 2026 |
37İzleyin | CVE-2026-105086İstismar yok | WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video Titlewwbn · avideo · CWE-79 | Kritik9,3 | — | %0,2 | 4 Eki 2026 |
37İzleyin | CVE-2026-105089İstismar yok | WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templateswwbn · avideo · CWE-79 | Kritik9,3 | — | %0,2 | 4 Eki 2026 |
36İzleyin | CVE-2026-105216İstismar yok | go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helpermicro · go-micro · CWE-295 | Kritik9,1 | — | %0,1 | 4 Eki 2026 |
36İzleyin | CVE-2026-105218İstismar yok | gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Clientgo-pay · gopay · CWE-295 | Kritik9,1 | — | %0,1 | 4 Eki 2026 |
34İzleyin | CVE-2026-105219İstismar yok | Mammoth.js 1.3.0 before 1.12.3 ReDoS via Style Map Tokenisermwilliamson · mammoth.js · CWE-1333 | Yüksek8,7 | — | %0,3 | 4 Eki 2026 |
34İzleyin | CVE-2026-105220İstismar yok | Twine 2 Desktop through 2.12.0 Arbitrary Code Execution via Imported Story Filesklembot · twinejs · CWE-79 | Yüksek8,5 | — | %0,2 | 4 Eki 2026 |
36İzleyin | CVE-2026-105221Kavram kanıtı | Gist RubyGem before 6.1.0 Disabled TLS Certificate Verificationdefunkt · gist · CWE-295 | Kritik9,1 | — | %0,2 | 4 Eki 2026 |
36İzleyin | CVE-2026-105222İstismar yok | alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peeralexpechkarev · google-maps · CWE-295 | Kritik9,1 | — | %0,1 | 4 Eki 2026 |
36İzleyin | CVE-2026-105223İstismar yok | maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verificationmaclof · kubernetes-client · CWE-295 | Kritik9,1 | — | %0,1 | 5 Eki 2026 |
36İzleyin | CVE-2026-105293İstismar yok | Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlerslegcord · legcord · CWE-22 | Kritik9,2 | — | %0,3 | 5 Eki 2026 |
36İzleyin | CVE-2026-105294İstismar yok | Legcord 1.1.0 through 1.3.0 Chromium Switch Injection via settings.setConfiglegcord · legcord · CWE-15 | Kritik9,1 | — | %0,1 | 5 Eki 2026 |
30İzleyin | CVE-2026-105295İstismar yok | GitAhead 2.5.0 through 2.7.1 Unverified Update Installation and TLS Bypassgitahead · gitahead · CWE-494 | Yüksek7,7 | — | %0,1 | 5 Eki 2026 |
30İzleyin | CVE-2026-20519İstismar yok | In Modem, there is a possible out of bounds write due to a missing bounds check.mediatek · mt6833 firmware · CWE-787 | Yüksek7,5 | — | %0,2 | 5 Eki 2026 |
30İzleyin | CVE-2026-20520İstismar yok | In Modem, there is a possible out of bounds write due to a missing bounds check.mediatek · mt2716 firmware · CWE-787 | Yüksek7,5 | — | %0,2 | 5 Eki 2026 |
33İzleyin | CVE-2026-20521İstismar yok | In Video HAL, there is a possible escalation of privilege due to a missing bounds check.mediatek · mt8910 firmware · CWE-121 | Yüksek8,4 | — | %0,1 | 5 Eki 2026 |
33İzleyin | CVE-2026-20522İstismar yok | In neuropilot, there is a possible out of bounds write due to a missing bounds check.mediatek · mt6881 firmware · CWE-787 | Yüksek8,4 | — | %0,1 | 5 Eki 2026 |
33İzleyin | CVE-2026-20523İstismar yok | In neuropilot, there is a possible out of bounds write due to a missing bounds check.mediatek · mt6881 firmware · CWE-787 | Yüksek8,4 | — | %0,1 | 5 Eki 2026 |
33İzleyin | CVE-2026-20524İstismar yok | In apu, there is a possible memory corruption due to improper input validation.mediatek · mt6899 firmware · CWE-1285 | Yüksek8,4 | — | %0,1 | 5 Eki 2026 |
30İzleyin | CVE-2026-20526İstismar yok | In Modem, there is a possible out of bounds write due to a missing bounds check.mediatek · mt2716 firmware · CWE-787 | Yüksek7,5 | — | %0,2 | 5 Eki 2026 |
33İzleyin | CVE-2026-20531İstismar yok | In apu, there is a possible memory corruption due to use after free.mediatek · mt8910 firmware · CWE-416 | Yüksek8,4 | — | %0,1 | 5 Eki 2026 |
35İzleyin | CVE-2026-20586İstismar yok | In vdec, there is a possible out of bounds write due to a missing bounds check.mediatek · mt8910 firmware · CWE-787 | Yüksek8,8 | — | %0,3 | 5 Eki 2026 |
26İzleyin | CVE-2026-105306Kavram kanıtı | Keycloak-services: keycloak-services: token introspection audience bypass via dynamic client registrationred hat · red hat build of keycloak · CWE-862 | Orta6,5 | — | %0,2 | 5 Eki 2026 |
21İzleyin | CVE-2026-84169İstismar yok | UPI QR Code Payment Gateway <= 1.4.3 - Unauthenticated Cross-Order Payment-Status Forgeryunknown · upi qr code payment gateway · CWE-639 | Orta5,3 | — | %0,1 | 5 Eki 2026 |
36İzleyin | CVE-2017-20285İstismar yok | YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classesCWE-470 | Kritik9,1 | — | %0,3 | 5 Eki 2026 |
29İzleyin | CVE-2019-25777İstismar yok | YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code executionCWE-502 | Yüksek7,3 | — | %0,3 | 5 Eki 2026 |
30İzleyin | CVE-2026-105314Kavram kanıtı | Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call.papermerge · papermerge · CWE-24 | Yüksek7,5 | — | %1,1 | 5 Eki 2026 |
38İzleyin | CVE-2026-100102İstismar yok | RCE via exposed JDWP debug agent in P4Searchperforce · p4 (helix core) · CWE-489 | Kritik9,5 | — | %0,3 | 5 Eki 2026 |
40Planlayın | CVE-2026-100103İstismar yok | Authentication bypass via default auth token in P4Searchperfoce · p4 (helix core) · CWE-1392 | Kritik10,0 | — | %0,4 | 5 Eki 2026 |
30İzleyin | CVE-2026-103507İstismar yok | Arbitrary file-write via log configuration path in P4Searchperforce · p4 (helix core) · CWE-73 | Yüksek7,5 | — | %0,5 | 5 Eki 2026 |
38İzleyin | CVE-2026-103510İstismar yok | Authentication bypass via blank auth token in P4Searchperforce · p4 (helix core) · CWE-636 | Kritik9,5 | — | %0,3 | 5 Eki 2026 |
34İzleyin | CVE-2026-104389İstismar yok | WordPress Sirv plugin <= 8.2.5 - SQL Injection vulnerabilitysirv · sirv · CWE-89 | Yüksek8,5 | — | %0,2 | 5 Eki 2026 |
28İzleyin | CVE-2026-104407İstismar yok | WordPress PowerPress Podcasting plugin <= 11.17.9 - Cross Site Request Forgery (CSRF) vulnerabilityblubrry podcasting · powerpress podcasting · CWE-352 | Yüksek7,1 | — | %0,0 | 5 Eki 2026 |
30İzleyin | CVE-2026-104408İstismar yok | WordPress Groundhogg plugin <= 4.8.3 - SQL Injection vulnerabilitygroundhogg · groundhogg · CWE-89 | Yüksek7,6 | — | %0,2 | 5 Eki 2026 |
33İzleyin | CVE-2026-104706İstismar yok | Mitel MiVoice Office 400 view system files path traversalmitel · mitel mivoice office 400 · CWE-31 | Yüksek8,4 | — | %0,1 | 5 Eki 2026 |
34İzleyin | CVE-2026-104805İstismar yok | Mitel MiVoice Office 400 Backup Restoration Arbitrary File Write Leading to Root Code Executionmitel · mitel mivoice office 400 · CWE-22 | Yüksek8,5 | — | %0,2 | 5 Eki 2026 |
7İzleyin | CVE-2026-104808İstismar yok | Mitel MiVoice Office 400 stored Cross-Site Scriptingmitel · mitel mivoice office 400 · CWE-79 | Düşük1,9 | — | %0,2 | 5 Eki 2026 |
33İzleyin | CVE-2026-104809İstismar yok | Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code Executionmitel · mitel mivoice office 400 · CWE-73 | Yüksek8,4 | — | %0,0 | 5 Eki 2026 |
33İzleyin | CVE-2026-104810İstismar yok | Mitel MiVoice Office 400 File Management File Browser path traversal vulnerabilitymitel · mitel mivoice office 400 · CWE-31 | Yüksek8,4 | — | %0,3 | 5 Eki 2026 |
33İzleyin | CVE-2026-104811İstismar yok | Mitel MiVoice Office 400 Music on Hold WAV File Upload Code Executionmitel · mitel mivoice office 400 · CWE-20 | Yüksek8,4 | — | %0,2 | 5 Eki 2026 |
37İzleyin | CVE-2026-105284İstismar yok | Totolink A3002MU Authentication Check boa sub_40FCFC improper authorizationtotolink · a3002mu · CWE-266 | Kritik9,3 | — | %0,8 | 5 Eki 2026 |
33İzleyin | CVE-2026-19184İstismar yok | Out-of-bounds write in the NXP GAU ADC driver due to byte-versus-sample buffer size validation mismatchzephyrproject · zephyr · CWE-787 | Yüksek8,4 | — | %0,1 | 5 Eki 2026 |
31İzleyin | CVE-2026-19185İstismar yok | Unvalidated user-supplied buffer pointers in the I3C do_ccc system call handler allow kernel memory read/write from user modezephyrproject · zephyr · CWE-822 | Yüksek7,8 | — | %0,1 | 5 Eki 2026 |
37İzleyin | CVE-2026-105285İstismar yok | Totolink A3002MU QoS Rule formIpQoS stack-based overflowtotolink · a3002mu · CWE-119 | Kritik9,3 | — | %0,6 | 5 Eki 2026 |
34İzleyin | CVE-2026-63277Kavram kanıtı | RCE via calcext:data-mappings, sql provider and jdbc connectorthe document foundation · libreoffice · CWE-829 | Yüksek8,5 | — | %0,3 | 5 Eki 2026 |
31İzleyin | CVE-2026-77805İstismar yok | Weak Executable Signature Verification Vulnerability in Progress® Telerik® Fiddler® Classicprogress software · progress® telerik® fiddler® classic · CWE-347 | Yüksek7,9 | — | %0,0 | 5 Eki 2026 |
35İzleyin | CVE-2026-92931İstismar yok | CWE-918: Server-Side Request Forgery in the Progress Sitefinity Next.js Renderer SDKprogress software · @progress/sitefinity-nextjs-sdk · CWE-918 | Yüksek8,8 | — | %0,2 | 5 Eki 2026 |
36İzleyin | CVE-2026-79820İstismar yok | A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware.hewlett packard enterprise (hpe) · hpe integrated lights-out (ilo) 7 · CWE-287 | Kritik9,0 | — | %0,2 | 5 Eki 2026 |
39İzleyin | CVE-2026-88391İstismar yok | Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstarCWE-94 | Kritik9,8 | — | %0,4 | 5 Eki 2026 |
30İzleyin | CVE-2026-88392İstismar yok | Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local().CWE-22 | Yüksek7,5 | — | %0,8 | 5 Eki 2026 |
30İzleyin | CVE-2026-88394İstismar yok | WookTeam v1.6.6 and before is vulnerable to a Directory Traversal.CWE-22 | Yüksek7,5 | — | %0,5 | 5 Eki 2026 |
37İzleyin | CVE-2026-102428Kavram kanıtı | Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16ordasoft · joomla cck · CWE-89 | Kritik9,3 | — | %0,4 | 5 Eki 2026 |
34İzleyin | CVE-2026-102775İstismar yok | Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8phoca · phoca cart · CWE-639 | Yüksek8,7 | — | %0,3 | 5 Eki 2026 |
28İzleyin | CVE-2026-104890İstismar yok | Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code executionkunstmaan · kunstmaanbundlescms · CWE-434 | Yüksek7,2 | — | %0,4 | 5 Eki 2026 |
30İzleyin | CVE-2026-104891İstismar yok | mppx-condition-gate: Free-access path grants on a self-declared wallet without proving controldouglasborthwick-crypto · mppx-condition-gate · CWE-290 | Yüksek7,5 | — | %0,2 | 5 Eki 2026 |
34İzleyin | CVE-2026-104892İstismar yok | Plane: Plaintext logging of API tokenmakeplane · plane · CWE-256 | Yüksek8,7 | — | %0,2 | 5 Eki 2026 |
39İzleyin | CVE-2026-37719İstismar yok | An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component.CWE-502 | Kritik9,8 | — | %0,7 | 5 Eki 2026 |
39İzleyin | CVE-2026-88393İstismar yok | WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export.CWE-94 | Kritik9,8 | — | %0,4 | 5 Eki 2026 |
39İzleyin | CVE-2026-88395İstismar yok | GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter.CWE-89 | Kritik9,8 | — | %0,3 | 5 Eki 2026 |
28İzleyin | CVE-2026-88396İstismar yok | ApiAdmin v5.0 and before is vulnerable to Directory Traversal.CWE-22 | Yüksek7,2 | — | %1,0 | 5 Eki 2026 |
28İzleyin | CVE-2026-102282Kavram kanıtı | adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalationcthackers · adm-zip · CWE-732 | Yüksek7,1 | — | %0,1 | 5 Eki 2026 |
- CVE-2026-9208436İzleyin
Beaver Builder Page Builder <= 2.11.0.5 - Unauthenticated Arbitrary Shortcode Execution via Sidebar Module Widget Output
KritikCVSS 9,1Kavram kanıtıEPSS %0beaverbuilder · beaver builder page builder – drag and drop website builder3 Eki 2026
- CVE-2026-7188332İzleyin
Native AES packet cipher returns the raw AES key on an alias
YüksekCVSS 8,2İstismar yokEPSS %0legion of the bouncy castle inc. · bc-lts-java3 Eki 2026
- CVE-2026-7188536İzleyin
MLS X.509 credential not bound to the LeafNode signature key
KritikCVSS 9,2İstismar yokEPSS %0legion of the bouncy castle inc. · bc-java3 Eki 2026
- CVE-2026-7188632İzleyin
OpenPGP certification accepted from a subkey without certification authority
YüksekCVSS 8,2İstismar yokEPSS %0legion of the bouncy castle inc. · bc-java3 Eki 2026
- CVE-2026-7188732İzleyin
OpenPGP data signature accepted from a signing subkey without cross-certification
YüksekCVSS 8,2İstismar yokEPSS %0legion of the bouncy castle inc. · bc-java3 Eki 2026
- CVE-2026-7188834İzleyin
CMS AuthenticatedData exposes attacker-inserted authAttrs when digestAlgorithm is absent
YüksekCVSS 8,7İstismar yokEPSS %0legion of the bouncy castle inc. · bc-java3 Eki 2026
- CVE-2026-7188934İzleyin
PKIXCertPathReviewer does not apply X.509 name constraints to the target certificate
YüksekCVSS 8,7İstismar yokEPSS %0legion of the bouncy castle inc. · bc-java3 Eki 2026
- CVE-2026-7189034İzleyin
MLS external commit can remove an arbitrary group member
YüksekCVSS 8,7İstismar yokEPSS %0legion of the bouncy castle inc. · bc-java3 Eki 2026
- CVE-2026-7189128İzleyin
BLS12-381 key validation accepts a public key built on a foreign curve
YüksekCVSS 7,1İstismar yokEPSS %0legion of the bouncy castle inc. · bc-java3 Eki 2026
- CVE-2026-8551532İzleyin
OpenPGP message truncation not reported, bypassing the SEIPDv1 integrity check
YüksekCVSS 8,2İstismar yokEPSS %0legion of the bouncy castle inc. · bc-java3 Eki 2026
- CVE-2026-10510539İzleyin
Unauthenticated ZeroMQ command/telemetry bus in AIT-Core allows remote spacecraft command injection and telemetry exfiltration
KritikCVSS 9,8Kavram kanıtıEPSS %0nasa-ammos · ait-core3 Eki 2026
- CVE-2026-10511328İzleyin
Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlock
YüksekCVSS 7,1İstismar yokEPSS %0nezhahq · nezha3 Eki 2026
- CVE-2026-10511535İzleyin
OpenAM before 16.1.3 Unauthenticated Arbitrary Class Instantiation via JAX-RPC Interface
YüksekCVSS 8,8İstismar yokEPSS %0openidentityplatform · openam3 Eki 2026
- CVE-2026-10511930İzleyin
OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows
YüksekCVSS 7,6İstismar yokEPSS %0openidentityplatform · openam3 Eki 2026
- CVE-2026-10306532İzleyin
WordPress Kirki plugin <= 6.3.1 - Arbitrary Code Execution vulnerability
YüksekCVSS 8,2İstismar yokEPSS %0themeum · kirki3 Eki 2026
- CVE-2026-10334228İzleyin
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0unlimited elements · unlimited elements for elementor (free widgets, addons, templates)3 Eki 2026
- CVE-2026-9645135İzleyin
WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability
YüksekCVSS 8,8Kavram kanıtıEPSS %0ultimate member · ultimate member3 Eki 2026
- CVE-2026-10512334İzleyin
W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API
YüksekCVSS 8,7İstismar yokEPSS %0vincent-peugnet · wcms4 Eki 2026
- CVE-2026-10512634İzleyin
LaraDashboard before 1.4.8 Privilege Escalation via Superadmin Role Tampering
YüksekCVSS 8,6İstismar yokEPSS %0laradashboard · laradashboard4 Eki 2026
- CVE-2026-10512928İzleyin
LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API
YüksekCVSS 7,1İstismar yokEPSS %0laradashboard · laradashboard4 Eki 2026
- CVE-2026-8877967Bu hafta
Memory overflow vulnerability leading to Denial of Service
YüksekCVSS 8,7KEVSilahlaştırılmışEPSS %11citrix · netscaler application delivery controller4 Eki 2026
- CVE-2026-10513381Hemen
Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication
OrtaCVSS 6,9KEVSilahlaştırılmışEPSS %79ahsay · cloud backup suite4 Eki 2026
- CVE-2026-10513496Hemen
Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection
KritikCVSS 10,0KEVSilahlaştırılmışEPSS %86ahsay · cloud backup suite4 Eki 2026
- CVE-2026-10513537İzleyin
InternLM MindSearch Planner Agent graph.py ExecutionAction.run code injection
KritikCVSS 9,3İstismar yokEPSS %0internlm · mindsearch4 Eki 2026
- CVE-2026-9354935İzleyin
CoCart 4.9.0 - 4.9.6 - Administrator Account Creation via REST API Authentication Bypass
YüksekCVSS 8,8İstismar yokEPSS %0unknown · cocart4 Eki 2026
- CVE-2026-9733221İzleyin
User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite)
OrtaCVSS 5,3Kavram kanıtıEPSS %0unknown · user private files4 Eki 2026
- CVE-2026-10306228İzleyin
WordPress TranslatePress plugin <= 3.3.6 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0cozmoslabs · translatepress4 Eki 2026
- CVE-2026-10334428İzleyin
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0unlimited elements · unlimited elements for elementor (free widgets, addons, templates)4 Eki 2026
- CVE-2026-10335428İzleyin
WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.11.1 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0liquid web / stellarwp · gutenberg blocks by kadence blocks4 Eki 2026
- CVE-2026-10335537İzleyin
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - SQL Injection vulnerability
KritikCVSS 9,3Kavram kanıtıEPSS %0unlimited elements · unlimited elements for elementor (free widgets, addons, templates)4 Eki 2026
- CVE-2026-9727628İzleyin
WordPress WP Statistics plugin <= 14.16.14 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0veronalabs · wp statistics4 Eki 2026
- CVE-2026-9730730İzleyin
WordPress Cost Calculator Builder plugin <= 4.0.17 - Sensitive Data Exposure vulnerability
YüksekCVSS 7,5İstismar yokEPSS %0stylemixthemes · cost calculator builder4 Eki 2026
- CVE-2026-10520737İzleyin
ZITADEL before 4.17.3 Account Takeover via External IdP Linking
KritikCVSS 9,3İstismar yokEPSS %0zitadel · zitadel4 Eki 2026
- CVE-2026-10520834İzleyin
ZITADEL before 4.17.3 Session Hijacking via Forgeable IdP Intent Tokens
YüksekCVSS 8,7İstismar yokEPSS %0zitadel · zitadel4 Eki 2026
- CVE-2026-10520937İzleyin
ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment
KritikCVSS 9,3İstismar yokEPSS %0zitadel · zitadel4 Eki 2026
- CVE-2026-10521035İzleyin
ZITADEL before 4.17.1 Unauthenticated MFA Enrollment via Login V1 Init Handlers
YüksekCVSS 8,8İstismar yokEPSS %0zitadel · zitadel4 Eki 2026
- CVE-2026-10521136İzleyin
ZITADEL before 4.17.1 Authentication Bypass via Login V2 OTP returnCode
KritikCVSS 9,2İstismar yokEPSS %0zitadel · zitadel4 Eki 2026
- CVE-2026-10521234İzleyin
ZITADEL before 3.4.14 and 4.16.2 Account Takeover via Passkey Enrollment
YüksekCVSS 8,7İstismar yokEPSS %0zitadel · zitadel4 Eki 2026
- CVE-2026-10521335İzleyin
ZITADEL before 4.17.1 Authentication Bypass via Login V2 for Deactivated Organizations
YüksekCVSS 8,8İstismar yokEPSS %0zitadel · zitadel4 Eki 2026
- CVE-2026-10521537İzleyin
ZITADEL before 4.16.2 Account Pre-Hijacking via Forged External IdP Callback
KritikCVSS 9,3İstismar yokEPSS %0zitadel · zitadel4 Eki 2026
- CVE-2026-10508637İzleyin
WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video Title
KritikCVSS 9,3İstismar yokEPSS %0wwbn · avideo4 Eki 2026
- CVE-2026-10508937İzleyin
WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates
KritikCVSS 9,3İstismar yokEPSS %0wwbn · avideo4 Eki 2026
- CVE-2026-10521636İzleyin
go-micro before 6.0.0 Disabled TLS Certificate Verification via tls.Config Helper
KritikCVSS 9,1İstismar yokEPSS %0micro · go-micro4 Eki 2026
- CVE-2026-10521836İzleyin
gopay before 1.5.119 Disabled TLS Certificate Verification in xhttp Client
KritikCVSS 9,1İstismar yokEPSS %0go-pay · gopay4 Eki 2026
- CVE-2026-10521934İzleyin
Mammoth.js 1.3.0 before 1.12.3 ReDoS via Style Map Tokeniser
YüksekCVSS 8,7İstismar yokEPSS %0mwilliamson · mammoth.js4 Eki 2026
- CVE-2026-10522034İzleyin
Twine 2 Desktop through 2.12.0 Arbitrary Code Execution via Imported Story Files
YüksekCVSS 8,5İstismar yokEPSS %0klembot · twinejs4 Eki 2026
- CVE-2026-10522136İzleyin
Gist RubyGem before 6.1.0 Disabled TLS Certificate Verification
KritikCVSS 9,1Kavram kanıtıEPSS %0defunkt · gist4 Eki 2026
- CVE-2026-10522236İzleyin
alexpechkarev/google-maps through 12.16 Disabled TLS Certificate Verification via ssl_verify_peer
KritikCVSS 9,1İstismar yokEPSS %0alexpechkarev · google-maps4 Eki 2026
- CVE-2026-10522336İzleyin
maclof kubernetes-client 0.17.0 before 0.32.0 Disabled TLS Certificate Verification
KritikCVSS 9,1İstismar yokEPSS %0maclof · kubernetes-client5 Eki 2026
- CVE-2026-10529336İzleyin
Legcord 1.1.0 through 1.3.0 Path Traversal via Theme IPC Handlers
KritikCVSS 9,2İstismar yokEPSS %0legcord · legcord5 Eki 2026
- CVE-2026-10529436İzleyin
Legcord 1.1.0 through 1.3.0 Chromium Switch Injection via settings.setConfig
KritikCVSS 9,1İstismar yokEPSS %0legcord · legcord5 Eki 2026
- CVE-2026-10529530İzleyin
GitAhead 2.5.0 through 2.7.1 Unverified Update Installation and TLS Bypass
YüksekCVSS 7,7İstismar yokEPSS %0gitahead · gitahead5 Eki 2026
- CVE-2026-2051930İzleyin
In Modem, there is a possible out of bounds write due to a missing bounds check.
YüksekCVSS 7,5İstismar yokEPSS %0mediatek · mt6833 firmware5 Eki 2026
- CVE-2026-2052030İzleyin
In Modem, there is a possible out of bounds write due to a missing bounds check.
YüksekCVSS 7,5İstismar yokEPSS %0mediatek · mt2716 firmware5 Eki 2026
- CVE-2026-2052133İzleyin
In Video HAL, there is a possible escalation of privilege due to a missing bounds check.
YüksekCVSS 8,4İstismar yokEPSS %0mediatek · mt8910 firmware5 Eki 2026
- CVE-2026-2052233İzleyin
In neuropilot, there is a possible out of bounds write due to a missing bounds check.
YüksekCVSS 8,4İstismar yokEPSS %0mediatek · mt6881 firmware5 Eki 2026
- CVE-2026-2052333İzleyin
In neuropilot, there is a possible out of bounds write due to a missing bounds check.
YüksekCVSS 8,4İstismar yokEPSS %0mediatek · mt6881 firmware5 Eki 2026
- CVE-2026-2052433İzleyin
In apu, there is a possible memory corruption due to improper input validation.
YüksekCVSS 8,4İstismar yokEPSS %0mediatek · mt6899 firmware5 Eki 2026
- CVE-2026-2052630İzleyin
In Modem, there is a possible out of bounds write due to a missing bounds check.
YüksekCVSS 7,5İstismar yokEPSS %0mediatek · mt2716 firmware5 Eki 2026
- CVE-2026-2053133İzleyin
In apu, there is a possible memory corruption due to use after free.
YüksekCVSS 8,4İstismar yokEPSS %0mediatek · mt8910 firmware5 Eki 2026
- CVE-2026-2058635İzleyin
In vdec, there is a possible out of bounds write due to a missing bounds check.
YüksekCVSS 8,8İstismar yokEPSS %0mediatek · mt8910 firmware5 Eki 2026
- CVE-2026-10530626İzleyin
Keycloak-services: keycloak-services: token introspection audience bypass via dynamic client registration
OrtaCVSS 6,5Kavram kanıtıEPSS %0red hat · red hat build of keycloak5 Eki 2026
- CVE-2026-8416921İzleyin
UPI QR Code Payment Gateway <= 1.4.3 - Unauthenticated Cross-Order Payment-Status Forgery
OrtaCVSS 5,3İstismar yokEPSS %0unknown · upi qr code payment gateway5 Eki 2026
- CVE-2017-2028536İzleyin
YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes
KritikCVSS 9,1İstismar yokEPSS %05 Eki 2026
- CVE-2019-2577729İzleyin
YAML versions before 1.27_001 for Perl allow a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution
YüksekCVSS 7,3İstismar yokEPSS %05 Eki 2026
- CVE-2026-10531430İzleyin
Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call.
YüksekCVSS 7,5Kavram kanıtıEPSS %1papermerge · papermerge5 Eki 2026
- CVE-2026-10010238İzleyin
RCE via exposed JDWP debug agent in P4Search
KritikCVSS 9,5İstismar yokEPSS %0perforce · p4 (helix core)5 Eki 2026
- CVE-2026-10010340Planlayın
Authentication bypass via default auth token in P4Search
KritikCVSS 10,0İstismar yokEPSS %0perfoce · p4 (helix core)5 Eki 2026
- CVE-2026-10350730İzleyin
Arbitrary file-write via log configuration path in P4Search
YüksekCVSS 7,5İstismar yokEPSS %0perforce · p4 (helix core)5 Eki 2026
- CVE-2026-10351038İzleyin
Authentication bypass via blank auth token in P4Search
KritikCVSS 9,5İstismar yokEPSS %0perforce · p4 (helix core)5 Eki 2026
- CVE-2026-10438934İzleyin
WordPress Sirv plugin <= 8.2.5 - SQL Injection vulnerability
YüksekCVSS 8,5İstismar yokEPSS %0sirv · sirv5 Eki 2026
- CVE-2026-10440728İzleyin
WordPress PowerPress Podcasting plugin <= 11.17.9 - Cross Site Request Forgery (CSRF) vulnerability
YüksekCVSS 7,1İstismar yokEPSS %0blubrry podcasting · powerpress podcasting5 Eki 2026
- CVE-2026-10440830İzleyin
WordPress Groundhogg plugin <= 4.8.3 - SQL Injection vulnerability
YüksekCVSS 7,6İstismar yokEPSS %0groundhogg · groundhogg5 Eki 2026
- CVE-2026-10470633İzleyin
Mitel MiVoice Office 400 view system files path traversal
YüksekCVSS 8,4İstismar yokEPSS %0mitel · mitel mivoice office 4005 Eki 2026
- CVE-2026-10480534İzleyin
Mitel MiVoice Office 400 Backup Restoration Arbitrary File Write Leading to Root Code Execution
YüksekCVSS 8,5İstismar yokEPSS %0mitel · mitel mivoice office 4005 Eki 2026
- CVE-2026-1048087İzleyin
Mitel MiVoice Office 400 stored Cross-Site Scripting
DüşükCVSS 1,9İstismar yokEPSS %0mitel · mitel mivoice office 4005 Eki 2026
- CVE-2026-10480933İzleyin
Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code Execution
YüksekCVSS 8,4İstismar yokEPSS %0mitel · mitel mivoice office 4005 Eki 2026
- CVE-2026-10481033İzleyin
Mitel MiVoice Office 400 File Management File Browser path traversal vulnerability
YüksekCVSS 8,4İstismar yokEPSS %0mitel · mitel mivoice office 4005 Eki 2026
- CVE-2026-10481133İzleyin
Mitel MiVoice Office 400 Music on Hold WAV File Upload Code Execution
YüksekCVSS 8,4İstismar yokEPSS %0mitel · mitel mivoice office 4005 Eki 2026
- CVE-2026-10528437İzleyin
Totolink A3002MU Authentication Check boa sub_40FCFC improper authorization
KritikCVSS 9,3İstismar yokEPSS %0totolink · a3002mu5 Eki 2026
- CVE-2026-1918433İzleyin
Out-of-bounds write in the NXP GAU ADC driver due to byte-versus-sample buffer size validation mismatch
YüksekCVSS 8,4İstismar yokEPSS %0zephyrproject · zephyr5 Eki 2026
- CVE-2026-1918531İzleyin
Unvalidated user-supplied buffer pointers in the I3C do_ccc system call handler allow kernel memory read/write from user mode
YüksekCVSS 7,8İstismar yokEPSS %0zephyrproject · zephyr5 Eki 2026
- CVE-2026-10528537İzleyin
Totolink A3002MU QoS Rule formIpQoS stack-based overflow
KritikCVSS 9,3İstismar yokEPSS %0totolink · a3002mu5 Eki 2026
- CVE-2026-6327734İzleyin
RCE via calcext:data-mappings, sql provider and jdbc connector
YüksekCVSS 8,5Kavram kanıtıEPSS %0the document foundation · libreoffice5 Eki 2026
- CVE-2026-7780531İzleyin
Weak Executable Signature Verification Vulnerability in Progress® Telerik® Fiddler® Classic
YüksekCVSS 7,9İstismar yokEPSS %0progress software · progress® telerik® fiddler® classic5 Eki 2026
- CVE-2026-9293135İzleyin
CWE-918: Server-Side Request Forgery in the Progress Sitefinity Next.js Renderer SDK
YüksekCVSS 8,8İstismar yokEPSS %0progress software · @progress/sitefinity-nextjs-sdk5 Eki 2026
- CVE-2026-7982036İzleyin
A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware.
KritikCVSS 9,0İstismar yokEPSS %0hewlett packard enterprise (hpe) · hpe integrated lights-out (ilo) 75 Eki 2026
- CVE-2026-8839139İzleyin
Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar
KritikCVSS 9,8İstismar yokEPSS %05 Eki 2026
- CVE-2026-8839230İzleyin
Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local().
YüksekCVSS 7,5İstismar yokEPSS %05 Eki 2026
- CVE-2026-8839430İzleyin
WookTeam v1.6.6 and before is vulnerable to a Directory Traversal.
YüksekCVSS 7,5İstismar yokEPSS %05 Eki 2026
- CVE-2026-10242837İzleyin
Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16
KritikCVSS 9,3Kavram kanıtıEPSS %0ordasoft · joomla cck5 Eki 2026
- CVE-2026-10277534İzleyin
Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8
YüksekCVSS 8,7İstismar yokEPSS %0phoca · phoca cart5 Eki 2026
- CVE-2026-10489028İzleyin
Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution
YüksekCVSS 7,2İstismar yokEPSS %0kunstmaan · kunstmaanbundlescms5 Eki 2026
- CVE-2026-10489130İzleyin
mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control
YüksekCVSS 7,5İstismar yokEPSS %0douglasborthwick-crypto · mppx-condition-gate5 Eki 2026
- CVE-2026-10489234İzleyin
Plane: Plaintext logging of API token
YüksekCVSS 8,7İstismar yokEPSS %0makeplane · plane5 Eki 2026
- CVE-2026-3771939İzleyin
An issue in dormakaba evolo Service (all versions) allows a remote attacker to execute arbitrary code as SYSTEM via a .NET component.
KritikCVSS 9,8İstismar yokEPSS %05 Eki 2026
- CVE-2026-8839339İzleyin
WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export.
KritikCVSS 9,8İstismar yokEPSS %05 Eki 2026
- CVE-2026-8839539İzleyin
GouGuOA v6.0.5 and before is vulnerable to SQL Injection in /home/message/rubbish via the keywords parameter.
KritikCVSS 9,8İstismar yokEPSS %05 Eki 2026
- CVE-2026-8839628İzleyin
ApiAdmin v5.0 and before is vulnerable to Directory Traversal.
YüksekCVSS 7,2İstismar yokEPSS %15 Eki 2026
- CVE-2026-10228228İzleyin
adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation
YüksekCVSS 7,1Kavram kanıtıEPSS %0cthackers · adm-zip5 Eki 2026