Ekim 2026: sömürülen ve yeni ciddi CVE kayıtları

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Manage

oracle corporation · oracle agile product lifecycle management for processBugün

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server).

• Kimlik doğrulamasız

oracle corporation · oracle bi publisherBugün

Vulnerability in Oracle REST Data Services (component: General).

oracle corporation · oracle rest data servicesBugün

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Manage

• Kimlik doğrulamasız

oracle corporation · oracle agile product lifecycle management for processBugün

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Manage

• Kimlik doğrulamasız

oracle corporation · oracle agile product lifecycle management for processBugün

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Manage

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

oracle corporation · oracle agile product lifecycle management for processBugün

Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Manage

• Kimlik doğrulamasız

oracle corporation · oracle agile product lifecycle management for processBugün

Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications (component: Platform).

• Yerel yetki yükseltme

oracle corporation · oracle communications billing and revenue managementBugün

Vulnerability in Oracle Essbase (component: Security).

oracle corporation · oracle essbaseBugün

Vulnerability in Oracle Essbase (component: Security).

• Kimlik doğrulamasız

oracle corporation · oracle essbaseBugün

Vulnerability in Oracle Essbase (component: Security).

oracle corporation · oracle essbaseBugün

Vulnerability in Oracle Essbase (component: Security).

oracle corporation · oracle essbaseBugün

Vulnerability in Oracle Essbase (component: Security).

oracle corporation · oracle essbaseBugün

Vulnerability in Oracle Essbase (component: Security).

oracle corporation · oracle essbaseBugün

Vulnerability in Oracle Essbase (component: Security).

• Kimlik doğrulamasız

oracle corporation · oracle essbaseBugün

Vulnerability in Oracle Essbase (component: Security).

• Kimlik doğrulamasız

oracle corporation · oracle essbaseBugün

Vulnerability in Oracle Essbase (component: Security).

• Kimlik doğrulamasız

oracle corporation · oracle essbaseBugün

Vulnerability in Oracle Essbase (component: Essbase Web Platform).

oracle corporation · oracle essbaseBugün

Vulnerability in Oracle Essbase (component: Essbase Web Platform).

oracle corporation · oracle essbaseBugün

Vulnerability in Oracle Essbase (component: Security).

oracle corporation · oracle essbaseBugün

Vulnerability in Oracle Essbase (component: Federated Partitions).

oracle corporation · oracle essbaseBugün

Vulnerability in Oracle Essbase (component: Security).

oracle corporation · oracle essbaseBugün

Vulnerability in Oracle Essbase (component: Build).

oracle corporation · oracle essbaseBugün

Vulnerability in Oracle Essbase (component: Security).

oracle corporation · oracle essbaseBugün

Vulnerability in Oracle Essbase (component: Security).

oracle corporation · oracle essbaseBugün

Vulnerability in Oracle Essbase (component: Security).

• Kimlik doğrulamasız
• Hizmet dışı bırakma

oracle corporation · oracle essbaseBugün

Vulnerability in Oracle Essbase (component: Security).

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

oracle corporation · oracle essbaseBugün

Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Dictionary Repository).

oracle corporation · oracle data integratorBugün

IBM App Connect Enterprise is vulnerable to a credential exposure

• Kimlik doğrulamasız

ibm · app connect enterpriseBugün

IBM QRadar SIEM HTTP Receiver protocol is vulnerable to a denial of service

• Kimlik doğrulamasız
• Hizmet dışı bırakma

ibm · qradar security information and event managementBugün

IBM QRadar SIEM Out-of-bounds Read

• Kimlik doğrulamasız
• Bellek hatası

ibm · qradarBugün

IBM Sterling Connect:Direct for Unix Buffer Overflow

• RCE
• Bellek hatası

ibm · sterling connect direct for unixBugün

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function c

• Kimlik doğrulamasız
• Bellek hatası

Bugün

Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base me

• Kimlik doğrulamasız

Bugün

Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variabl

• Kimlik doğrulamasız
• Bellek hatası

Bugün

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function c

• Kimlik doğrulamasız
• Bellek hatası

Bugün

Astral uv through 0.8.21 Path Traversal via Symlinks in Sdist Tar Extraction

• Kimlik doğrulamasız
• Yol geçişi

astral-sh · uvBugün

OS Command Injection in Qingteng Host Adaptive Security Platform Security Toolbox

• Girişsiz RCE
• Komut enjeksiyonu

qingteng · host adaptive security platformBugün

A vulnerability has been found in D-Link DHP-W610AV 1.02EUb03.

• Kimlik doğrulamasız

Bugün

FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocat

• Kimlik doğrulamasız
• Bellek hatası

Bugün

FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because winpr_read_png_from_buff

• Kimlik doğrulamasız
• Bellek hatası

Bugün

FreeRDP before 3.32.1 Heap Buffer Overflow via rdpsnd_server_select_format

• Bellek hatası

freerdp · freerdpBugün

FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null per-reader name in SC

• Kimlik doğrulamasız
• Bellek hatası

Bugün

FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS ce

• Kimlik doğrulamasız
• Zayıf kripto

Bugün

vLLM before 0.31.0 Remote Engine Crash via Forged Multimodal UUID

vllm-project · vllmBugün

vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens, so the EngineCore in

Bugün

vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches a processor for every

• Kimlik doğrulamasız
• Hizmet dışı bırakma

Bugün

vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers AutoProcessor.from_pretrained,

• Girişsiz RCE

Bugün

vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying cal

• Erişim denetimi (IDOR)

Bugün

vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs

• Kimlik doğrulamasız
• Hizmet dışı bırakma

vllm-project · vllmBugün

ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role hold

• RCE
• Erişim denetimi (IDOR)

Bugün

SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows

• Kimlik doğrulamasız
• Yol geçişi

Bugün

Trigger.dev before 4.7.3 Tenant Filtering Bypass via Query Table Placeholders

• SQL enjeksiyonu

triggerdotdev · trigger.devBugün

Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block ru

• Erişim denetimi (IDOR)

Bugün

Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session endpoint that allows public

• Erişim denetimi (IDOR)

Bugün

Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that allows authenticated attac

• Erişim denetimi (IDOR)

Bugün

Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which re

Bugün

Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and SetActiveOnTaskScheduleService that

• Erişim denetimi (IDOR)

Bugün

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into g

• SQL enjeksiyonu

Bugün

Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain enviro

• Erişim denetimi (IDOR)

Bugün

Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authent

• Yol geçişi

Bugün

Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags qu

• SQL enjeksiyonu

Bugün

Trigger.dev through 4.7.6 Missing Authentication in Supervisor Workload API

• Kimlik doğrulama atlatma

triggerdotdev · trigger.devBugün

Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from hosting/docker/.env.example allow authenticat

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma
• Gömülü kimlik bilgisi

Bugün

Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticat

• Kimlik doğrulamasız
• Gömülü kimlik bilgisi

Bugün

Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/aut

• Kimlik doğrulamasız
• CSRF

Bugün

Trigger.dev CLI 3.0.0 before 4.5.4 Missing Authentication in MCP Server

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

trigger.dev · cli-v3Bugün

Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run replay route (resources

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

Bugün

Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write.

• Girişsiz RCE
• Yol geçişi

Bugün

Dulwich before 1.2.9 Infinite Loop DoS via Pack.resolve_object

• Kimlik doğrulamasız
• Hizmet dışı bırakma

jelmer · dulwichBugün

Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that allows attackers to writ

Bugün

Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to writ

• Yol geçişi

Bugün

Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files ou

• Yol geçişi

Bugün

adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the Node.js process via a mal

• Kimlik doğrulamasız

Bugün

adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content validation by supplying

• Kimlik doğrulamasız

Bugün

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server fil

• Kimlik doğrulamasız
• Yol geçişi

Bugün

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell

• Girişsiz RCE
• SSRF

Bugün

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access t

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

Bugün

uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via craf

• Kimlik doğrulamasız
• Yol geçişi

Bugün

Astral uv before 0.11.6 Arbitrary File Deletion via Wheel RECORD Entries

• Kimlik doğrulamasız
• Yol geçişi

astral-sh · uvBugün

sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that, under certain runtime-spe

• RCE
• Bellek hatası

Bugün

Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code execution on glibc-based L

• RCE
• Bellek hatası

Bugün

Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2

Bugün

Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero int

• Kimlik doğrulamasız

Bugün

Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all

• Kimlik doğrulamasız
• Gömülü kimlik bilgisi

Bugün

Deserialization of untrusted data in capa

• RCE
• Deserializasyon

mandiant flare · capaBugün

Deserialization of untrusted data in floss

• RCE
• Deserializasyon

mandiant flare · flossBugün

Tenda AC19 httpd Web Management Service SetFirewallCfg formSetFirewallCfg stack-based overflow

• Kimlik doğrulamasız
• Bellek hatası

tenda · ac19Bugün

Duplicator <= 1.5.17 and Duplicator Pro <= 4.6.10 - Unauthenticated PHP Object Injection

• Girişsiz RCE
• Deserializasyon

smub · duplicator – backups & migration plugin – cloud backups, scheduled backups, & moreBugün

Universal Naming Convention (UNC) Path Injection in Cerberus FTP Server

cerberus · cerberus ftp serverBugün

Modern Events Calendar (Lite & Pro) < 7.37.0 - Subscriber+ SQLi via mec_attendees AJAX Action

• SQL enjeksiyonu

unknown · modern events calendar liteBugün

Falang multilanguage for WordPress < 1.4.6 - Subscriber+ Stored XSS via Term Translation

• XSS

unknown · falang multilanguage for wordpressBugün

Uncanny Toolkit for LearnDash < 3.8.2 - Account Takeover via Password Reset CSRF

• Kimlik doğrulamasız
• CSRF

unknown · uncanny toolkit for learndashBugün

Backup and Staging by WP Time Capsule < 1.22.28 - Subscriber+ Staging-to-Live Deployment via wptc_copy_stage_to_live

• Erişim denetimi (IDOR)

unknown · backup and staging by wp time capsuleBugün

Simple Banner < 3.3.3 - Authenticated Privilege Escalation via User Permissions Setting

unknown · simple bannerBugün

WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter

• Kimlik doğrulamasız
• XSS

unknown · wp booking systemBugün

WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registration Role After Stripe Disconnect

• Kimlik doğrulamasız

unknown · wp user managerBugün

Redirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored XSS via Lead Debug Metabox

• Kimlik doğrulamasız
• XSS

unknown · redirection for contact form 7Bugün

Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actions

• Kimlik doğrulamasız
• XSS

unknown · user profile builderBugün

miniOrange 2FA 6.2.9 - 6.3.0 - 2FA Bypass via Passkey Second-Factor Rebinding

• Kimlik doğrulama atlatma

unknown · miniorange 2faBugün