Yayın tarihine göre
Ekim 2026: sömürülen ve yeni ciddi CVE kayıtları
6.608 kayıt · 12 KEV. Yayın sırasıyla.
Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.
Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.
Sayfa 65 / 67
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
36İzleyin | CVE-2026-114661İstismar yok | OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpointsopenremote · openremote · CWE-862 | Kritik9,0 | — | — | Bugün |
34İzleyin | CVE-2026-114662İstismar yok | Obot before 0.26.0 API Key Theft via CLI Login Token Requestobot-platform · obot · CWE-352 | Yüksek8,6 | — | — | Bugün |
34İzleyin | CVE-2026-114663İstismar yok | Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Argumentsvyperlang · vyper · CWE-706 | Yüksek8,6 | — | — | Bugün |
28İzleyin | CVE-2026-114664İstismar yok | Frappe before 16.33.0 Blind SQL Injection via get_eventsfrappe · frappe · CWE-89 | Yüksek7,1 | — | — | Bugün |
34İzleyin | CVE-2026-114716İstismar yok | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability.roundcube · webmail · CWE-99 | Yüksek8,5 | — | — | Bugün |
28İzleyin | CVE-2026-114720İstismar yok | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability.roundcube · webmail · CWE-93 | Yüksek7,1 | — | — | Bugün |
29İzleyin | CVE-2026-114724İstismar yok | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize().roundcube · webmail · CWE-502 | Yüksek7,4 | — | — | Bugün |
33İzleyin | CVE-2026-114727İstismar yok | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images.roundcube · webmail · CWE-829 | Yüksek8,3 | — | — | Bugün |
36İzleyin | CVE-2026-96355İstismar yok | Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175drupal · webform · CWE-1336 | Kritik9,1 | — | — | Bugün |
30İzleyin | CVE-2026-96365İstismar yok | Webform - Less critical - Denial of service - SA-CONTRIB-2026-170drupal · webform · CWE-770 | Yüksek7,5 | — | — | Bugün |
30İzleyin | CVE-2026-110353İstismar yok | HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncatehaproxy · haproxy · CWE-252 | Yüksek7,5 | — | — | Bugün |
30İzleyin | CVE-2026-110354İstismar yok | HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via ahaproxy · haproxy · CWE-835 | Yüksek7,5 | — | — | Bugün |
28İzleyin | CVE-2026-114730İstismar yok | Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass.roundcube · webmail · CWE-918 | Yüksek7,2 | — | — | Bugün |
36İzleyin | CVE-2026-114219İstismar yok | NewType Infortech｜NT OneAPP - Hard-coded Credentialsnewtype infortech · nt oneapp · CWE-798 | Kritik9,1 | — | — | Bugün |
37İzleyin | CVE-2026-114220İstismar yok | NewType Infortech｜NT OneAPP - Improper Certificate Validationnewtype infortech · nt oneapp · CWE-295 | Kritik9,3 | — | — | Bugün |
28İzleyin | CVE-2026-109927İstismar yok | CM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via cm_hipaa_update_user_roleunknown · hipaa forms · CWE-269 | Yüksek7,2 | — | — | Bugün |
28İzleyin | CVE-2026-109987İstismar yok | PixelYourSite (Free & Pro) - Unauthenticated Stored XSS via Cookieunknown · pixelyoursite · CWE-79 | Yüksek7,2 | — | — | Bugün |
30İzleyin | CVE-2026-111958İstismar yok | Royal MCP < 1.5.7 - Authentication Bypass via Preview Link Tokenunknown · royal mcp · CWE-287 | Yüksek7,5 | — | — | Bugün |
30İzleyin | CVE-2026-97328İstismar yok | WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML Parserunknown · webp express · CWE-79 | Yüksek7,5 | — | — | Bugün |
34İzleyin | CVE-2026-105270İstismar yok | Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustionarekinath · esaml · CWE-770 | Yüksek8,7 | — | — | Bugün |
35İzleyin | CVE-2026-114177İstismar yok | WordPress Xpro Elementor Addons plugin <= 1.7.10 - Cross Site Request Forgery (CSRF) vulnerabilityxpro · xpro elementor addons · CWE-352 | Yüksek8,8 | — | — | Bugün |
28İzleyin | CVE-2026-111830İstismar yok | WordPress WP Mailster plugin <= 1.9.1.0 - Cross Site Scripting (XSS) vulnerabilitywp mailster · wp mailster · CWE-79 | Yüksek7,1 | — | — | Bugün |
30İzleyin | CVE-2026-111851İstismar yok | WordPress Royal Elementor Addons plugin <= 1.7.1068 - Arbitrary Code Execution vulnerabilitywproyal · royal elementor addons · CWE-470 | Yüksek7,6 | — | — | Bugün |
39İzleyin | CVE-2026-112241İstismar yok | WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerabilitybrainstorm force · surecart · CWE-290 | Kritik9,8 | — | — | Bugün |
35İzleyin | CVE-2026-112242İstismar yok | WordPress Profile Builder plugin <= 4.0.4 - Privilege Escalation vulnerabilitycozmoslabs · profile builder · CWE-266 | Yüksek8,8 | — | — | Bugün |
30İzleyin | CVE-2026-112312İstismar yok | WordPress ACF Extended plugin <= 0.9.2.7 - Broken Access Control vulnerabilityacf extended · acf extended · CWE-862 | Yüksek7,5 | — | — | Bugün |
37İzleyin | CVE-2026-112327İstismar yok | WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerabilitytms · amelia · CWE-89 | Kritik9,3 | — | — | Bugün |
28İzleyin | CVE-2026-112379İstismar yok | WordPress Contact Form Email plugin <= 1.3.68 - Cross Site Scripting (XSS) vulnerabilitycodepeople · contact form email · CWE-79 | Yüksek7,1 | — | — | Bugün |
29İzleyin | CVE-2026-115253İstismar yok | WatchGuard Agent Incorrect Permission Assignment in Log Directory Allows Local Log Tamperingwatchguard · watchguard agent · CWE-276 | Yüksek7,3 | — | — | Bugün |
32İzleyin | CVE-2026-86696İstismar yok | Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustionhandnot2 · esaml · CWE-770 | Yüksek8,2 | — | — | Bugün |
34İzleyin | CVE-2026-93471İstismar yok | Unbounded SAML message decompression in esaml allows memory exhaustionhandnot2 · esaml · CWE-409 | Yüksek8,7 | — | — | Bugün |
32İzleyin | CVE-2026-112085İstismar yok | webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgradeswebpack-dev-server · webpack-dev-server · CWE-346 | Yüksek8,2 | — | — | Bugün |
34İzleyin | CVE-2017-20287İstismar yok | Javo Spot WordPress Theme < 3.0.0 Path Traversal via admin-ajax.php fn Parameterjavo themes · javo spot · CWE-22 | Yüksek8,7 | — | — | Bugün |
30İzleyin | CVE-2017-20289İstismar yok | Broadstreet Ad Widget WordPress Plugin < 2.12.0 Local File Inclusion via step parameterbroadstreet · ad widget · CWE-98 | Yüksek7,7 | — | — | Bugün |
34İzleyin | CVE-2018-25438İstismar yok | Intermesh Group-Office < 3.5.5 Path Traversal via compress.phpintermesh · group-office · CWE-22 | Yüksek8,7 | — | — | Bugün |
34İzleyin | CVE-2018-25439İstismar yok | MetInfo CMS < 6.1.1 Unauthenticated Path Traversal via thumb.php dir Parametermetinfo · metinfo · CWE-22 | Yüksek8,7 | — | — | Bugün |
35İzleyin | CVE-2019-25778İstismar yok | SeaCMS 8.7 SQL Injection via comment/api/index.php rlist Parameterseacms · seacms · CWE-89 | Yüksek8,8 | — | — | Bugün |
34İzleyin | CVE-2019-25779İstismar yok | WooThemes Diarise 1.5.9 Local File Disclosure via download.phpwoothemes · diarise · CWE-22 | Yüksek8,7 | — | — | Bugün |
34İzleyin | CVE-2021-48013İstismar yok | Weaver E-cology 8.0 Unauthenticated Path Traversal via ln.FileDownloadweaver network co., ltd. · e-cology · CWE-22 | Yüksek8,7 | — | — | Bugün |
37İzleyin | CVE-2021-48014İstismar yok | FineReport 9.0 Unauthenticated Path Traversal File Write via ReportServerfanruan · finereport · CWE-22 | Kritik9,3 | — | — | Bugün |
34İzleyin | CVE-2021-48015İstismar yok | JeeWMS Path Traversal via showOrDownByurl.doerzhongxmu · jeewms · CWE-22 | Yüksek8,7 | — | — | Bugün |
37İzleyin | CVE-2021-48016İstismar yok | DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.phpdedecms · dedecms · CWE-94 | Kritik9,3 | — | — | Bugün |
34İzleyin | CVE-2021-48017İstismar yok | OrbiTeam BSCW Server < 5.2.5 / 7.4.4 Path Traversal via bscw.cgiorbiteam · bscw server · CWE-22 | Yüksek8,7 | — | — | Bugün |
35İzleyin | CVE-2022-51021İstismar yok | NotificationX WordPress Plugin < 2.3.12 Unauthenticated SQL Injection via notification REST endpointwpdeveloper · notificationx · CWE-89 | Yüksek8,8 | — | — | Bugün |
35İzleyin | CVE-2022-51022İstismar yok | YiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFile endpointliukuo362573 · yishaadmin · CWE-22 | Yüksek8,8 | — | — | Bugün |
35İzleyin | CVE-2022-51023İstismar yok | PHPOK < 5.4.081 SQL Injection via api.php sort Parameterphpok · phpok · CWE-89 | Yüksek8,8 | — | — | Bugün |
34İzleyin | CVE-2022-51024İstismar yok | Kavita < 0.5.4.1 Unauthenticated Path Traversal via cover-upload Endpointkareadita · kavita · CWE-22 | Yüksek8,7 | — | — | Bugün |
28İzleyin | CVE-2022-51025İstismar yok | Penta Security WAPPLES 4.0.54.1 / 5.0 / 6.0 Path Traversal via /webapi/file/transferpenta security systems · wapples · CWE-22 | Yüksek7,1 | — | — | Bugün |
35İzleyin | CVE-2024-58393İstismar yok | i-Netsolution Readymade Unilevel Ecommerce MLM SQL Injection via product-details.phpi-netsolution · readymade unilevel ecommerce mlm · CWE-89 | Yüksek8,8 | — | — | Bugün |
34İzleyin | CVE-2024-58396İstismar yok | YouDataSum CPAS Audit Management System V4 Path Traversal via downPlugs fileIdyoudatasum · cpas audit management system · CWE-22 | Yüksek8,7 | — | — | Bugün |
35İzleyin | CVE-2025-71434İstismar yok | Weaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/listweaver network co., ltd. · e-cology · CWE-89 | Yüksek8,8 | — | — | Bugün |
29İzleyin | CVE-2026-111079İstismar yok | Goose: goose: shell history and environment leak via terminal integrationred hat · red hat enterprise linux 10 · CWE-497 | Yüksek7,4 | — | — | Bugün |
28İzleyin | CVE-2026-112313İstismar yok | WordPress ACF Extended plugin <= 0.9.2.7 - Cross Site Scripting (XSS) vulnerabilityacf extended · acf extended · CWE-79 | Yüksek7,1 | — | — | Bugün |
32İzleyin | CVE-2026-112820İstismar yok | WordPress Academist Core plugin <= 1.4.1 - Local File Inclusion vulnerabilityelated-themes · academist core · CWE-98 | Yüksek8,1 | — | — | Bugün |
34İzleyin | CVE-2026-112822İstismar yok | WordPress Workreap Core plugin < 3.4.4 - SQL Injection vulnerabilityamentotech · workreap core · CWE-89 | Yüksek8,5 | — | — | Bugün |
39İzleyin | CVE-2026-112832İstismar yok | WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerabilitycozythemes · rootblox · CWE-98 | Kritik9,8 | — | — | Bugün |
28İzleyin | CVE-2026-114665İstismar yok | Goploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileComparezhenorzz · goploy · CWE-59 | Yüksek7,1 | — | — | Bugün |
36İzleyin | CVE-2026-115324İstismar yok | mem0 0.1.117 before 1.0.8 SQL Injection via Databricks Vector Storemem0ai · mem0 · CWE-89 | Kritik9,2 | — | — | Bugün |
34İzleyin | CVE-2026-115325İstismar yok | Netmaker through 1.7.0 Authorization Bypass via updateExtClient Unscoped Lookupgravitl · netmaker · CWE-639 | Yüksek8,7 | — | — | Bugün |
34İzleyin | CVE-2026-115328İstismar yok | JSON-SCADA before 0.65-alpha SQL Injection via OPC HistoryRead APIriclolsen · json-scada · CWE-89 | Yüksek8,7 | — | — | Bugün |
34İzleyin | CVE-2026-115330İstismar yok | Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metricsuselotus · lotus · CWE-89 | Yüksek8,7 | — | — | Bugün |
34İzleyin | CVE-2026-115331İstismar yok | Lotus through 0.10.2 SQL Injection via Metric Property Names and Filtersuselotus · lotus · CWE-89 | Yüksek8,7 | — | — | Bugün |
34İzleyin | CVE-2026-115332İstismar yok | Lotus through 0.10.2 SQL Injection via Subscription Filter Keysuselotus · lotus · CWE-89 | Yüksek8,7 | — | — | Bugün |
32İzleyin | CVE-2026-115333İstismar yok | Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefixuselotus · lotus · CWE-287 | Yüksek8,2 | — | — | Bugün |
30İzleyin | CVE-2026-115334İstismar yok | Lotus through 0.10.2 Authorization Bypass via switch_organization Endpointuselotus · lotus · CWE-639 | Yüksek7,6 | — | — | Bugün |
40Planlayın | CVE-2026-102785İstismar yok | Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52yootheme.com · yootheme pro extension for joomla · CWE-434 | Kritik10,0 | — | — | Bugün |
36İzleyin | CVE-2026-111497Kavram kanıtı | Out-of-Bounds Write in Google Brotli Decodergoogle · brotli · CWE-252 | Kritik9,2 | — | — | Bugün |
34İzleyin | CVE-2026-113582İstismar yok | Apache Abdera: XML external entity expansion in Atom document parsingapache software foundation · apache abdera · CWE-611 | Yüksek8,7 | — | — | Bugün |
28İzleyin | CVE-2026-66279İstismar yok | Dis-connect vulnerability in Connect Stacksilicon labs · connect sdk · CWE-940 | Yüksek7,2 | — | — | Bugün |
30İzleyin | CVE-2026-85079İstismar yok | Out-of-bounds write in Zigbee Simple_Desc_req handlingsilicon labs · emberznet · CWE-121 | Yüksek7,5 | — | — | Bugün |
32İzleyin | CVE-2026-92709İstismar yok | Rsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCErsyslog · rsyslog · CWE-22 | Yüksek8,1 | — | — | Bugün |
30İzleyin | CVE-2026-94502İstismar yok | Out-of-bounds write in Zigbee Publish Price Matrix handlingsilicon labs · emberznet · CWE-121 | Yüksek7,5 | — | — | Bugün |
30İzleyin | CVE-2026-111181İstismar yok | body-parser vulnerable to Denial of Service via trailing bytes after a compressed request bodybody-parser · body-parser · CWE-248 | Yüksek7,5 | — | — | Bugün |
30İzleyin | CVE-2026-113872İstismar yok | multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardownmulter · multer · CWE-248 | Yüksek7,5 | — | — | Bugün |
28İzleyin | CVE-2026-114510İstismar yok | Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document contentstevereiner · flexible-graphrag · CWE-116 | Yüksek7,1 | — | — | Bugün |
33İzleyin | CVE-2026-16477İstismar yok | Insecure Deserialization of .cleanshot Files in CleanShot Xmtw · cleanshot x · CWE-502 | Yüksek8,4 | — | — | Bugün |
29İzleyin | CVE-2026-61791İstismar yok | OCO-Server: Stored XSS through agent hostnames in command buttonsschorschii · oco-server · CWE-83 | Yüksek7,4 | — | — | Bugün |
29İzleyin | GHSA-pxh4-856f-4h89İstismar yok | PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgeryCWE-347 | Yüksek7,4 | — | — | Bugün |
28İzleyin | CVE-2026-115450İstismar yok | Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifiermarcoscamara01 · ecommerce template · CWE-472 | Yüksek7,1 | — | — | Bugün |
28İzleyin | CVE-2026-115453İstismar yok | Cross user deletion and modification of cart and wishlist rows in Ecommerce Template through unscoped primary key queriesmarcoscamara01 · ecommerce template · CWE-639 | Yüksek7,1 | — | — | Bugün |
30İzleyin | CVE-2026-115482İstismar yok | In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not lilitespeedtech · lsquic · CWE-770 | Yüksek7,5 | — | — | Bugün |
0İzleyin | CVE-2026-51954Kavram kanıtı | An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL wit | — | — | — | Bugün |
32İzleyin | CVE-2026-94482İstismar yok | Next.js: Denial of Service in App Router using Server Actionsvercel · next.js · CWE-770 | Yüksek8,2 | — | — | Bugün |
32İzleyin | GHSA-78g4-xqwv-q3g8İstismar yok | Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()CWE-1395 | Yüksek8,1 | — | — | Bugün |
34İzleyin | CVE-2026-104068İstismar yok | JetBackup WordPress Plugin < 3.1.24.10 Symlink Arbitrary File Write via Backup Restorejetbackup · jetbackup · CWE-59 | Yüksek8,6 | — | — | Bugün |
30İzleyin | CVE-2026-114605İstismar yok | dnspython dns.name.from_wire_parser() excessive CPU userthalley · dnspython · CWE-674 | Yüksek7,5 | — | — | Bugün |
36İzleyin | CVE-2026-114607İstismar yok | better-auth: OAuth state can be used as a Magic Link to sign in as another userbetter-auth · better-auth · CWE-287 | Kritik9,1 | — | — | Bugün |
30İzleyin | CVE-2026-75507İstismar yok | GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rulegraphql-python · graphql-core · CWE-400 | Yüksek7,5 | — | — | Bugün |
30İzleyin | CVE-2026-75508İstismar yok | GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limitgraphql-python · graphql-core · CWE-400 | Yüksek7,5 | — | — | Bugün |
38İzleyin | CVE-2026-97631İstismar yok | Pre-boot RCE in EDK II PXE drivertianocore · edk2 · CWE-120 | Kritik9,5 | — | — | Bugün |
35İzleyin | CVE-2026-108357İstismar yok | PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Servicephpoffice · phpspreadsheet · CWE-611 | Yüksek8,8 | — | — | Bugün |
35İzleyin | CVE-2026-108358İstismar yok | PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Servicephpoffice · phpspreadsheet · CWE-611 | Yüksek8,8 | — | — | Bugün |
34İzleyin | CVE-2026-108359İstismar yok | PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)phpoffice · phpspreadsheet · CWE-400 | Yüksek8,7 | — | — | Bugün |
34İzleyin | CVE-2026-113873İstismar yok | SmileCDR HAPI FHIR improper data decompressionsmilecdr · hapi fhir · CWE-409 | Yüksek8,7 | — | — | Bugün |
34İzleyin | CVE-2026-113874İstismar yok | SmileCDR HAPI FHIR trusted tenant partition overridesmilecdr · hapi fhir · CWE-863 | Yüksek8,6 | — | — | Bugün |
36İzleyin | CVE-2026-114611İstismar yok | OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-schorschii · oco-server · CWE-295 | Kritik9,1 | — | — | Bugün |
28İzleyin | CVE-2026-93336İstismar yok | Missing authorization in the unit resources download route in Juju controllerscanonical · juju · CWE-862 | Yüksek7,1 | — | — | Bugün |
34İzleyin | CVE-2026-97635İstismar yok | Agent Zero Web UI XSSagent zero · agent zero · CWE-79 | Yüksek8,6 | — | — | Bugün |
37İzleyin | CVE-2022-51026İstismar yok | Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Loginbytebase · bytebase · CWE-290 | Kritik9,3 | — | — | Bugün |
34İzleyin | CVE-2026-114519İstismar yok | Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accountsroskus · prospero flow crm · CWE-862 | Yüksek8,6 | — | — | Bugün |
- CVE-2026-11466136İzleyin
OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints
KritikCVSS 9,0İstismar yokopenremote · openremoteBugün
- CVE-2026-11466234İzleyin
Obot before 0.26.0 API Key Theft via CLI Login Token Request
YüksekCVSS 8,6İstismar yokobot-platform · obotBugün
- CVE-2026-11466334İzleyin
Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments
YüksekCVSS 8,6İstismar yokvyperlang · vyperBugün
- CVE-2026-11466428İzleyin
Frappe before 16.33.0 Blind SQL Injection via get_events
YüksekCVSS 7,1İstismar yokfrappe · frappeBugün
- CVE-2026-11471634İzleyin
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability.
YüksekCVSS 8,5İstismar yokroundcube · webmailBugün
- CVE-2026-11472028İzleyin
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability.
YüksekCVSS 7,1İstismar yokroundcube · webmailBugün
- CVE-2026-11472429İzleyin
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize().
YüksekCVSS 7,4İstismar yokroundcube · webmailBugün
- CVE-2026-11472733İzleyin
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images.
YüksekCVSS 8,3İstismar yokroundcube · webmailBugün
- CVE-2026-9635536İzleyin
Webform - Critical - Remote Code Execution - SA-CONTRIB-2026-175
KritikCVSS 9,1İstismar yokdrupal · webformBugün
- CVE-2026-9636530İzleyin
Webform - Less critical - Denial of service - SA-CONTRIB-2026-170
YüksekCVSS 7,5İstismar yokdrupal · webformBugün
- CVE-2026-11035330İzleyin
HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncate
YüksekCVSS 7,5İstismar yokhaproxy · haproxyBugün
- CVE-2026-11035430İzleyin
HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via a
YüksekCVSS 7,5İstismar yokhaproxy · haproxyBugün
- CVE-2026-11473028İzleyin
Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass.
YüksekCVSS 7,2İstismar yokroundcube · webmailBugün
- CVE-2026-11421936İzleyin
NewType Infortech｜NT OneAPP - Hard-coded Credentials
KritikCVSS 9,1İstismar yoknewtype infortech · nt oneappBugün
- CVE-2026-11422037İzleyin
NewType Infortech｜NT OneAPP - Improper Certificate Validation
KritikCVSS 9,3İstismar yoknewtype infortech · nt oneappBugün
- CVE-2026-10992728İzleyin
CM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via cm_hipaa_update_user_role
YüksekCVSS 7,2İstismar yokunknown · hipaa formsBugün
- CVE-2026-10998728İzleyin
PixelYourSite (Free & Pro) - Unauthenticated Stored XSS via Cookie
YüksekCVSS 7,2İstismar yokunknown · pixelyoursiteBugün
- CVE-2026-11195830İzleyin
Royal MCP < 1.5.7 - Authentication Bypass via Preview Link Token
YüksekCVSS 7,5İstismar yokunknown · royal mcpBugün
- CVE-2026-9732830İzleyin
WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML Parser
YüksekCVSS 7,5İstismar yokunknown · webp expressBugün
- CVE-2026-10527034İzleyin
Unbounded atom creation while parsing SAML messages in esaml allows atom table exhaustion
YüksekCVSS 8,7İstismar yokarekinath · esamlBugün
- CVE-2026-11417735İzleyin
WordPress Xpro Elementor Addons plugin <= 1.7.10 - Cross Site Request Forgery (CSRF) vulnerability
YüksekCVSS 8,8İstismar yokxpro · xpro elementor addonsBugün
- CVE-2026-11183028İzleyin
WordPress WP Mailster plugin <= 1.9.1.0 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokwp mailster · wp mailsterBugün
- CVE-2026-11185130İzleyin
WordPress Royal Elementor Addons plugin <= 1.7.1068 - Arbitrary Code Execution vulnerability
YüksekCVSS 7,6İstismar yokwproyal · royal elementor addonsBugün
- CVE-2026-11224139İzleyin
WordPress SureCart plugin <= 4.9.5 - Broken Authentication vulnerability
KritikCVSS 9,8İstismar yokbrainstorm force · surecartBugün
- CVE-2026-11224235İzleyin
WordPress Profile Builder plugin <= 4.0.4 - Privilege Escalation vulnerability
YüksekCVSS 8,8İstismar yokcozmoslabs · profile builderBugün
- CVE-2026-11231230İzleyin
WordPress ACF Extended plugin <= 0.9.2.7 - Broken Access Control vulnerability
YüksekCVSS 7,5İstismar yokacf extended · acf extendedBugün
- CVE-2026-11232737İzleyin
WordPress Amelia plugin <= 2.4.11 - SQL Injection vulnerability
KritikCVSS 9,3İstismar yoktms · ameliaBugün
- CVE-2026-11237928İzleyin
WordPress Contact Form Email plugin <= 1.3.68 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokcodepeople · contact form emailBugün
- CVE-2026-11525329İzleyin
WatchGuard Agent Incorrect Permission Assignment in Log Directory Allows Local Log Tampering
YüksekCVSS 7,3İstismar yokwatchguard · watchguard agentBugün
- CVE-2026-8669632İzleyin
Unbounded atom creation from unsigned LogoutResponse status codes in esaml allows atom table exhaustion
YüksekCVSS 8,2İstismar yokhandnot2 · esamlBugün
- CVE-2026-9347134İzleyin
Unbounded SAML message decompression in esaml allows memory exhaustion
YüksekCVSS 8,7İstismar yokhandnot2 · esamlBugün
- CVE-2026-11208532İzleyin
webpack-dev-server vulnerable to cross-origin WebSocket access via proxied upgrades
YüksekCVSS 8,2İstismar yokwebpack-dev-server · webpack-dev-serverBugün
- CVE-2017-2028734İzleyin
Javo Spot WordPress Theme < 3.0.0 Path Traversal via admin-ajax.php fn Parameter
YüksekCVSS 8,7İstismar yokjavo themes · javo spotBugün
- CVE-2017-2028930İzleyin
Broadstreet Ad Widget WordPress Plugin < 2.12.0 Local File Inclusion via step parameter
YüksekCVSS 7,7İstismar yokbroadstreet · ad widgetBugün
- CVE-2018-2543834İzleyin
Intermesh Group-Office < 3.5.5 Path Traversal via compress.php
YüksekCVSS 8,7İstismar yokintermesh · group-officeBugün
- CVE-2018-2543934İzleyin
MetInfo CMS < 6.1.1 Unauthenticated Path Traversal via thumb.php dir Parameter
YüksekCVSS 8,7İstismar yokmetinfo · metinfoBugün
- CVE-2019-2577835İzleyin
SeaCMS 8.7 SQL Injection via comment/api/index.php rlist Parameter
YüksekCVSS 8,8İstismar yokseacms · seacmsBugün
- CVE-2019-2577934İzleyin
WooThemes Diarise 1.5.9 Local File Disclosure via download.php
YüksekCVSS 8,7İstismar yokwoothemes · diariseBugün
- CVE-2021-4801334İzleyin
Weaver E-cology 8.0 Unauthenticated Path Traversal via ln.FileDownload
YüksekCVSS 8,7İstismar yokweaver network co., ltd. · e-cologyBugün
- CVE-2021-4801437İzleyin
FineReport 9.0 Unauthenticated Path Traversal File Write via ReportServer
KritikCVSS 9,3İstismar yokfanruan · finereportBugün
- CVE-2021-4801534İzleyin
JeeWMS Path Traversal via showOrDownByurl.do
YüksekCVSS 8,7İstismar yokerzhongxmu · jeewmsBugün
- CVE-2021-4801637İzleyin
DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php
KritikCVSS 9,3İstismar yokdedecms · dedecmsBugün
- CVE-2021-4801734İzleyin
OrbiTeam BSCW Server < 5.2.5 / 7.4.4 Path Traversal via bscw.cgi
YüksekCVSS 8,7İstismar yokorbiteam · bscw serverBugün
- CVE-2022-5102135İzleyin
NotificationX WordPress Plugin < 2.3.12 Unauthenticated SQL Injection via notification REST endpoint
YüksekCVSS 8,8İstismar yokwpdeveloper · notificationxBugün
- CVE-2022-5102235İzleyin
YiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFile endpoint
YüksekCVSS 8,8İstismar yokliukuo362573 · yishaadminBugün
- CVE-2022-5102335İzleyin
PHPOK < 5.4.081 SQL Injection via api.php sort Parameter
YüksekCVSS 8,8İstismar yokphpok · phpokBugün
- CVE-2022-5102434İzleyin
Kavita < 0.5.4.1 Unauthenticated Path Traversal via cover-upload Endpoint
YüksekCVSS 8,7İstismar yokkareadita · kavitaBugün
- CVE-2022-5102528İzleyin
Penta Security WAPPLES 4.0.54.1 / 5.0 / 6.0 Path Traversal via /webapi/file/transfer
YüksekCVSS 7,1İstismar yokpenta security systems · wapplesBugün
- CVE-2024-5839335İzleyin
i-Netsolution Readymade Unilevel Ecommerce MLM SQL Injection via product-details.php
YüksekCVSS 8,8İstismar yoki-netsolution · readymade unilevel ecommerce mlmBugün
- CVE-2024-5839634İzleyin
YouDataSum CPAS Audit Management System V4 Path Traversal via downPlugs fileId
YüksekCVSS 8,7İstismar yokyoudatasum · cpas audit management systemBugün
- CVE-2025-7143435İzleyin
Weaver E-cology < 10.76 Unauthenticated SQL Injection via doc/out/more/list
YüksekCVSS 8,8İstismar yokweaver network co., ltd. · e-cologyBugün
- CVE-2026-11107929İzleyin
Goose: goose: shell history and environment leak via terminal integration
YüksekCVSS 7,4İstismar yokred hat · red hat enterprise linux 10Bugün
- CVE-2026-11231328İzleyin
WordPress ACF Extended plugin <= 0.9.2.7 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokacf extended · acf extendedBugün
- CVE-2026-11282032İzleyin
WordPress Academist Core plugin <= 1.4.1 - Local File Inclusion vulnerability
YüksekCVSS 8,1İstismar yokelated-themes · academist coreBugün
- CVE-2026-11282234İzleyin
WordPress Workreap Core plugin < 3.4.4 - SQL Injection vulnerability
YüksekCVSS 8,5İstismar yokamentotech · workreap coreBugün
- CVE-2026-11283239İzleyin
WordPress Rootblox plugin <= 1.0.6 - Local File Inclusion vulnerability
KritikCVSS 9,8İstismar yokcozythemes · rootbloxBugün
- CVE-2026-11466528İzleyin
Goploy 1.18.0 before 1.18.1 Symlink Following Arbitrary File Read via /deploy/fileDiff and /deploy/fileCompare
YüksekCVSS 7,1İstismar yokzhenorzz · goployBugün
- CVE-2026-11532436İzleyin
mem0 0.1.117 before 1.0.8 SQL Injection via Databricks Vector Store
KritikCVSS 9,2İstismar yokmem0ai · mem0Bugün
- CVE-2026-11532534İzleyin
Netmaker through 1.7.0 Authorization Bypass via updateExtClient Unscoped Lookup
YüksekCVSS 8,7İstismar yokgravitl · netmakerBugün
- CVE-2026-11532834İzleyin
JSON-SCADA before 0.65-alpha SQL Injection via OPC HistoryRead API
YüksekCVSS 8,7İstismar yokriclolsen · json-scadaBugün
- CVE-2026-11533034İzleyin
Lotus through 0.10.2 SQL Injection via Custom SQL Billable Metrics
YüksekCVSS 8,7İstismar yokuselotus · lotusBugün
- CVE-2026-11533134İzleyin
Lotus through 0.10.2 SQL Injection via Metric Property Names and Filters
YüksekCVSS 8,7İstismar yokuselotus · lotusBugün
- CVE-2026-11533234İzleyin
Lotus through 0.10.2 SQL Injection via Subscription Filter Keys
YüksekCVSS 8,7İstismar yokuselotus · lotusBugün
- CVE-2026-11533332İzleyin
Lotus through 0.10.2 Improper Authentication via Event Ingestion API Key Prefix
YüksekCVSS 8,2İstismar yokuselotus · lotusBugün
- CVE-2026-11533430İzleyin
Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint
YüksekCVSS 7,6İstismar yokuselotus · lotusBugün
- CVE-2026-10278540Planlayın
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52
KritikCVSS 10,0İstismar yokyootheme.com · yootheme pro extension for joomlaBugün
- CVE-2026-11149736İzleyin
Out-of-Bounds Write in Google Brotli Decoder
KritikCVSS 9,2Kavram kanıtıgoogle · brotliBugün
- CVE-2026-11358234İzleyin
Apache Abdera: XML external entity expansion in Atom document parsing
YüksekCVSS 8,7İstismar yokapache software foundation · apache abderaBugün
- CVE-2026-6627928İzleyin
Dis-connect vulnerability in Connect Stack
YüksekCVSS 7,2İstismar yoksilicon labs · connect sdkBugün
- CVE-2026-8507930İzleyin
Out-of-bounds write in Zigbee Simple_Desc_req handling
YüksekCVSS 7,5İstismar yoksilicon labs · emberznetBugün
- CVE-2026-9270932İzleyin
Rsyslog: DynFile Path Traversal → Arbitrary File Write as Root → RCE
YüksekCVSS 8,1İstismar yokrsyslog · rsyslogBugün
- CVE-2026-9450230İzleyin
Out-of-bounds write in Zigbee Publish Price Matrix handling
YüksekCVSS 7,5İstismar yoksilicon labs · emberznetBugün
- CVE-2026-11118130İzleyin
body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
YüksekCVSS 7,5İstismar yokbody-parser · body-parserBugün
- CVE-2026-11387230İzleyin
multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
YüksekCVSS 7,5İstismar yokmulter · multerBugün
- CVE-2026-11451028İzleyin
Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content
YüksekCVSS 7,1İstismar yokstevereiner · flexible-graphragBugün
- CVE-2026-1647733İzleyin
Insecure Deserialization of .cleanshot Files in CleanShot X
YüksekCVSS 8,4İstismar yokmtw · cleanshot xBugün
- CVE-2026-6179129İzleyin
OCO-Server: Stored XSS through agent hostnames in command buttons
YüksekCVSS 7,4İstismar yokschorschii · oco-serverBugün
- GHSA-pxh4-856f-4h8929İzleyin
PyJWT: HS256/384/512 verify accepts empty HMAC key via oct JWK (PyJWK/PyJWKClient) enabling token forgery
YüksekCVSS 7,4İstismar yokBugün
- CVE-2026-11545028İzleyin
Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier
YüksekCVSS 7,1İstismar yokmarcoscamara01 · ecommerce templateBugün
- CVE-2026-11545328İzleyin
Cross user deletion and modification of cart and wishlist rows in Ecommerce Template through unscoped primary key queries
YüksekCVSS 7,1İstismar yokmarcoscamara01 · ecommerce templateBugün
- CVE-2026-11548230İzleyin
In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not li
YüksekCVSS 7,5İstismar yoklitespeedtech · lsquicBugün
- CVE-2026-519540İzleyin
An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth authorization URL wit
Kavram kanıtıBugün
- CVE-2026-9448232İzleyin
Next.js: Denial of Service in App Router using Server Actions
YüksekCVSS 8,2İstismar yokvercel · next.jsBugün
- GHSA-78g4-xqwv-q3g832İzleyin
Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from Image.open().load()
YüksekCVSS 8,1İstismar yokBugün
- CVE-2026-10406834İzleyin
JetBackup WordPress Plugin < 3.1.24.10 Symlink Arbitrary File Write via Backup Restore
YüksekCVSS 8,6İstismar yokjetbackup · jetbackupBugün
- CVE-2026-11460530İzleyin
dnspython dns.name.from_wire_parser() excessive CPU use
YüksekCVSS 7,5İstismar yokrthalley · dnspythonBugün
- CVE-2026-11460736İzleyin
better-auth: OAuth state can be used as a Magic Link to sign in as another user
KritikCVSS 9,1İstismar yokbetter-auth · better-authBugün
- CVE-2026-7550730İzleyin
GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule
YüksekCVSS 7,5İstismar yokgraphql-python · graphql-coreBugün
- CVE-2026-7550830İzleyin
GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit
YüksekCVSS 7,5İstismar yokgraphql-python · graphql-coreBugün
- CVE-2026-9763138İzleyin
Pre-boot RCE in EDK II PXE driver
KritikCVSS 9,5İstismar yoktianocore · edk2Bugün
- CVE-2026-10835735İzleyin
PhpSpreadsheet: XmlScanner Bypass via Double-Encoded unentity() TOCTOU Allows XXE and Denial of Service
YüksekCVSS 8,8İstismar yokphpoffice · phpspreadsheetBugün
- CVE-2026-10835835İzleyin
PhpSpreadsheet: XmlScanner Bypass via ISO-2022 Escape Sequences Allows XXE and Denial of Service
YüksekCVSS 8,8İstismar yokphpoffice · phpspreadsheetBugün
- CVE-2026-10835934İzleyin
PhpSpreadsheet ODS Reader: Unbounded number-rows-repeated → CPU & Memory Exhaustion (DoS)
YüksekCVSS 8,7İstismar yokphpoffice · phpspreadsheetBugün
- CVE-2026-11387334İzleyin
SmileCDR HAPI FHIR improper data decompression
YüksekCVSS 8,7İstismar yoksmilecdr · hapi fhirBugün
- CVE-2026-11387434İzleyin
SmileCDR HAPI FHIR trusted tenant partition override
YüksekCVSS 8,6İstismar yoksmilecdr · hapi fhirBugün
- CVE-2026-11461136İzleyin
OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-
KritikCVSS 9,1İstismar yokschorschii · oco-serverBugün
- CVE-2026-9333628İzleyin
Missing authorization in the unit resources download route in Juju controllers
YüksekCVSS 7,1İstismar yokcanonical · jujuBugün
- CVE-2026-9763534İzleyin
Agent Zero Web UI XSS
YüksekCVSS 8,6İstismar yokagent zero · agent zeroBugün
- CVE-2022-5102637İzleyin
Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Login
KritikCVSS 9,3İstismar yokbytebase · bytebaseBugün
- CVE-2026-11451934İzleyin
Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts
YüksekCVSS 8,6İstismar yokroskus · prospero flow crmBugün