İçeriğe atla
Noroxi

Yayın tarihine göre

Ekim 2026: sömürülen ve yeni ciddi CVE kayıtları

5.187 kayıt · 10 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 7 / 52

  • CVE-2026-104970
    32İzleyin

    Plane: InstanceAdminSignUpEndpoint TOCTOU race allows two concurrent unauthenticated callers to both bootstrap as Plane instance admins

    YüksekCVSS 8,1İstismar yokEPSS %0

    makeplane · plane5 Eki 2026

  • CVE-2026-12171
    33İzleyin

    auto-changelog: code execution via untrusted in-repository configuration (handlebarsSetup/plugins), plus argument injection, path traversal, and SSRF

    YüksekCVSS 8,4İstismar yokEPSS %0

    cookpete · auto-changelog5 Eki 2026

  • CVE-2026-86671
    33İzleyin

    In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an attacker-controlled

    YüksekCVSS 8,4İstismar yokEPSS %0

    eclipse foundation · eclipse che5 Eki 2026

  • CVE-2025-15643
    28İzleyin

    WordPress Adsmonetizer plugin <= 3.2.4 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    jose fernandez · adsmonetizer5 Eki 2026

  • CVE-2026-101919
    35İzleyin

    Hypershift: hypershift: unsanitized kubeconfig passthrough from tenant namespace to control plane

    YüksekCVSS 8,8İstismar yokEPSS %0

    red hat · multicluster engine for kubernetes5 Eki 2026

  • CVE-2026-104905
    24İzleyin

    FacturaScripts < 2026.7 PHP Object Injection via WidgetSelect

    OrtaCVSS 6,1Kavram kanıtıEPSS %0

    neorazorx · facturascripts5 Eki 2026

  • CVE-2026-104971
    34İzleyin

    Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization

    YüksekCVSS 8,5İstismar yokEPSS %0

    makeplane · plane5 Eki 2026

  • CVE-2026-104973
    30İzleyin

    Plane: DNS Rebinding Bypass of CVE-2026-30242 SSRF Fix in Webhook Delivery

    YüksekCVSS 7,6İstismar yokEPSS %0

    makeplane · plane5 Eki 2026

  • CVE-2026-104974
    32İzleyin

    Plane: Disabled User Auto-Reactivation on Login

    YüksekCVSS 8,1İstismar yokEPSS %0

    makeplane · plane5 Eki 2026

  • CVE-2026-104975
    28İzleyin

    Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints

    YüksekCVSS 7,1İstismar yokEPSS %0

    makeplane · plane5 Eki 2026

  • CVE-2026-104976
    34İzleyin

    Plane: SSRF in Gitea OAuth

    YüksekCVSS 8,7İstismar yokEPSS %0

    makeplane · plane5 Eki 2026

  • CVE-2026-104977
    30İzleyin

    Plane: Incomplete fix of CVE-2026-27706 — SSRF still reachable on: missing is_blocked_ip (CGNAT/multicast) + DNS-rebinding TOCTOU

    YüksekCVSS 7,7İstismar yokEPSS %0

    makeplane · plane5 Eki 2026

  • CVE-2026-104978
    32İzleyin

    Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance

    YüksekCVSS 8,2İstismar yokEPSS %0

    makeplane · plane5 Eki 2026

  • CVE-2026-104979
    34İzleyin

    Plane: Cross-tenant stored XSS in intake enables account takeover

    YüksekCVSS 8,7İstismar yokEPSS %0

    makeplane · plane5 Eki 2026

  • CVE-2026-105628
    30İzleyin

    Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint

    YüksekCVSS 7,6İstismar yokEPSS %0

    makeplane · plane5 Eki 2026

  • CVE-2026-105629
    28İzleyin

    Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookup

    YüksekCVSS 7,1İstismar yokEPSS %0

    makeplane · plane5 Eki 2026

  • CVE-2026-105630
    34İzleyin

    Plane: Stored XSS via SVG attachment served inline on the application origin (account takeover)

    YüksekCVSS 8,7İstismar yokEPSS %0

    makeplane · plane5 Eki 2026

  • CVE-2026-105631
    30İzleyin

    Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosu

    YüksekCVSS 7,5İstismar yokEPSS %0

    makeplane · plane5 Eki 2026

  • CVE-2026-105632
    34İzleyin

    Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects

    YüksekCVSS 8,7İstismar yokEPSS %0

    makeplane · plane5 Eki 2026

  • CVE-2026-105633
    28İzleyin

    Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope

    YüksekCVSS 7,1İstismar yokEPSS %0

    makeplane · plane5 Eki 2026

  • CVE-2026-93316
    28İzleyin

    Starting daemon with --cdi-disabled flag can lead to panic on specific builds

    YüksekCVSS 7,1İstismar yokEPSS %0

    moby · buildkit5 Eki 2026

  • CVE-2026-93318
    30İzleyin

    Cache poisoning via unvalidated image layer DiffIDs

    YüksekCVSS 7,5İstismar yokEPSS %0

    moby · buildkit5 Eki 2026

  • CVE-2026-100515
    28İzleyin

    WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    villatheme · photo reviews for woocommerce5 Eki 2026

  • CVE-2026-103334
    30İzleyin

    WordPress Five Star Restaurant Reservations plugin <= 2.7.24 - Sensitive Data Exposure vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %0

    etoile web design incorporated · five star restaurant reservations5 Eki 2026

  • CVE-2026-103349
    28İzleyin

    WordPress Product Feed PRO for WooCommerce plugin <= 13.5.7 - PHP Object Injection vulnerability

    YüksekCVSS 7,2İstismar yokEPSS %0

    rymera web co · product feed pro for woocommerce5 Eki 2026

  • CVE-2026-103352
    37İzleyin

    WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerability

    KritikCVSS 9,3İstismar yokEPSS %0

    wp base · wp base booking5 Eki 2026

  • CVE-2026-104711
    39İzleyin

    Apache Struts: OGNL injection in the legacy RESTful action mapper

    KritikCVSS 9,8Kavram kanıtıEPSS %1

    apache · struts5 Eki 2026

  • CVE-2026-104712
    30İzleyin

    Apache Struts: Disproportionate response size when rendering BigDecimal request parameters

    YüksekCVSS 7,5İstismar yokEPSS %0

    apache · struts5 Eki 2026

  • CVE-2026-104714
    35İzleyin

    Apache Struts: Shared message formatter exposes date and time values across concurrent requests

    YüksekCVSS 8,8İstismar yokEPSS %0

    apache · struts5 Eki 2026

  • CVE-2026-105634
    32İzleyin

    Plane: Privilege Escalation: Project Guest Can Demote Admin/Member Roles

    YüksekCVSS 8,1İstismar yokEPSS %0

    makeplane · plane5 Eki 2026

  • CVE-2026-105635
    29İzleyin

    Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token

    YüksekCVSS 7,4İstismar yokEPSS %0

    makeplane · plane5 Eki 2026

  • CVE-2026-105636
    39İzleyin

    Plane: SSRF via HTTP redirect in webhook delivery (allow_redirects not set)

    KritikCVSS 9,9İstismar yokEPSS %0

    makeplane · plane5 Eki 2026

  • CVE-2026-105637
    38İzleyin

    Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)

    KritikCVSS 9,6İstismar yokEPSS %0

    makeplane · plane5 Eki 2026

  • CVE-2026-105638
    36İzleyin

    Plane: Magic-code verifier endpoint has no rate limit, enabling 6-digit OTP brute force

    KritikCVSS 9,1İstismar yokEPSS %0

    makeplane · plane5 Eki 2026

  • CVE-2026-105639
    39İzleyin

    Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane

    KritikCVSS 9,8İstismar yokEPSS %0

    makeplane · plane5 Eki 2026

  • CVE-2026-105640
    36İzleyin

    Plane: Account Takeover via Unverified OAuth Email Match (Gitea, self-managed GitLab)

    KritikCVSS 9,1İstismar yokEPSS %0

    makeplane · plane5 Eki 2026

  • CVE-2026-105641
    39İzleyin

    Plane: Hardcoded SECRET_KEY and LIVE_SERVER_SECRET_KEY shipped in aio/cli community deployment manifests — session forgery and live-server auth bypass

    KritikCVSS 9,8İstismar yokEPSS %0

    makeplane · plane5 Eki 2026

  • CVE-2026-105642
    35İzleyin

    Ghost: Remote Code Execution via Bookmark Card Images

    YüksekCVSS 8,8İstismar yokEPSS %0

    tryghost · ghost5 Eki 2026

  • CVE-2026-105643
    29İzleyin

    Ghost: Stored XSS via Embed Card Previews

    YüksekCVSS 7,3İstismar yokEPSS %0

    tryghost · ghost5 Eki 2026

  • CVE-2026-28625
    31İzleyin

    In multiple locations, there is a possible permission bypass due to a logic error in the code.

    YüksekCVSS 7,8İstismar yokEPSS %0

    google · android5 Eki 2026

  • CVE-2026-28640
    31İzleyin

    In checkCallerIsCertInstallerOrSelfInProfile of CredentialStorageActivity.java, there is a possible permission bypass due to improper input

    YüksekCVSS 7,8İstismar yokEPSS %0

    google · android5 Eki 2026

  • CVE-2026-28641
    31İzleyin

    In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, there is a possible permission bypass due to a logic e

    YüksekCVSS 7,8İstismar yokEPSS %0

    google · android5 Eki 2026

  • CVE-2026-28647
    31İzleyin

    In updateState of DeviceAdminAppsPreferenceController.java, there is a possible permission bypass due to a logic error in the code.

    YüksekCVSS 7,8İstismar yokEPSS %0

    google · android5 Eki 2026

  • CVE-2026-28648
    31İzleyin

    In Settings, there is a possible permission bypass due to a confused deputy.

    YüksekCVSS 7,8İstismar yokEPSS %0

    google · android5 Eki 2026

  • CVE-2026-45524
    35İzleyin

    In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check.

    YüksekCVSS 8,8İstismar yokEPSS %0

    google · android5 Eki 2026

  • CVE-2026-49878
    28İzleyin

    In wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a possible out-of-bounds write due to a logic error in the code.

    YüksekCVSS 7,2İstismar yokEPSS %0

    google · android5 Eki 2026

  • CVE-2026-49880
    31İzleyin

    In multiple functions of nfa_nfcee_act.cc, there is a possible out-of-bounds write due to a missing bounds check.

    YüksekCVSS 7,8İstismar yokEPSS %0

    google · android5 Eki 2026

  • CVE-2026-49885
    31İzleyin

    In rw_t4t_update_file of rw_t4t.cc, there is a possible out-of-bounds write due to an integer overflow.

    YüksekCVSS 7,8İstismar yokEPSS %0

    google · android5 Eki 2026

  • CVE-2026-49933
    31İzleyin

    In handle_le_monitor_device_event of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitia

    YüksekCVSS 7,8İstismar yokEPSS %0

    google · android5 Eki 2026

  • CVE-2026-49937
    31İzleyin

    In multiple functions of MessageQueueBase.h, there is a possible out of bounds read due to an incorrect bounds check.

    YüksekCVSS 7,8İstismar yokEPSS %0

    google · android5 Eki 2026

  • CVE-2026-55266
    31İzleyin

    In qsort of libufdt_sysdeps_vendor.c, there is a possible out-of-bounds write due to resource exhaustion.

    YüksekCVSS 7,8İstismar yokEPSS %0

    google · android5 Eki 2026

  • CVE-2026-55269
    31İzleyin

    In FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety issue due to improper input validation.

    YüksekCVSS 7,8İstismar yokEPSS %0

    google · android5 Eki 2026

  • CVE-2026-55270
    31İzleyin

    In dialInternal in multiple locations, there is a possible permission bypass due to a confused deputy.

    YüksekCVSS 7,8İstismar yokEPSS %0

    google · android5 Eki 2026

  • CVE-2026-55280
    35İzleyin

    In multiple locations, there is a possible out-of-bounds write due to uninitialized data.

    YüksekCVSS 8,8İstismar yokEPSS %0

    google · android5 Eki 2026

  • CVE-2026-55286
    31İzleyin

    In stpropnci_process of stpropnci.cc, there is a possible out of bounds write due to an incorrect bounds check.

    YüksekCVSS 7,8İstismar yokEPSS %0

    google · android5 Eki 2026

  • CVE-2026-58815
    31İzleyin

    In multiple locations, there is a possible out of bounds write due to an incorrect bounds check.

    YüksekCVSS 7,8İstismar yokEPSS %0

    google · android5 Eki 2026

  • CVE-2026-58835
    35İzleyin

    In cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a heap buffer overflow.

    YüksekCVSS 8,8İstismar yokEPSS %0

    google · android5 Eki 2026

  • CVE-2026-58841
    31İzleyin

    In multiple functions of VirtualAudioControllerTest.java, there is a possible permission bypass due to a logic error in the code.

    YüksekCVSS 7,8İstismar yokEPSS %0

    google · android5 Eki 2026

  • CVE-2026-58854
    31İzleyin

    In multiple locations, there is a possible memory corruption due to type confusion.

    YüksekCVSS 7,8İstismar yokEPSS %0

    google · android5 Eki 2026

  • CVE-2026-58859
    31İzleyin

    In multiple places, there is a possible denial of service due to an uncaught exception.

    YüksekCVSS 7,8İstismar yokEPSS %0

    google · android5 Eki 2026

  • CVE-2026-58865
    30İzleyin

    In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check.

    YüksekCVSS 7,5İstismar yokEPSS %0

    google · android5 Eki 2026

  • CVE-2026-58880
    28İzleyin

    In handle_app_val_response of btif_rc.cc, there is a possible way to achieve code execution due to a race condition.

    YüksekCVSS 7,0İstismar yokEPSS %0

    google · android5 Eki 2026

  • CVE-2026-88424
    39İzleyin

    FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter().

    KritikCVSS 9,8İstismar yokEPSS %0

    5 Eki 2026

  • CVE-2026-97283
    39İzleyin

    WordPress Advanced Post Manager plugin <= 4.5.5 - PHP Object Injection vulnerability

    KritikCVSS 9,8İstismar yokEPSS %0

    liquid web / stellarwp · advanced post manager5 Eki 2026

  • CVE-2026-97303
    30İzleyin

    WordPress Scratch & Win – Giveaways and Contests plugin <= 3.0.2 - Broken Access Control vulnerability

    YüksekCVSS 7,6İstismar yokEPSS %0

    apps mav · scratch & win – giveaways and contests5 Eki 2026

  • CVE-2026-97309
    28İzleyin

    WordPress RepairBuddy plugin <= 4.1226 - Sensitive Data Exposure vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    webful creations · repairbuddy5 Eki 2026

  • CVE-2026-100506
    28İzleyin

    WordPress WP Spell Check plugin <= 12.1 - PHP Object Injection vulnerability

    YüksekCVSS 7,2İstismar yokEPSS %0

    wp spell check · wp spell check5 Eki 2026

  • CVE-2026-100511
    35İzleyin

    WordPress VK Google Job Posting Manager plugin <= 1.3.1 - PHP Object Injection vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %0

    vektor inc. · vk google job posting manager5 Eki 2026

  • CVE-2026-103066
    34İzleyin

    WordPress WP BASE Booking plugin <= 6.4.0 - SQL Injection vulnerability

    YüksekCVSS 8,5İstismar yokEPSS %0

    wp base · wp base booking5 Eki 2026

  • CVE-2026-103348
    28İzleyin

    WordPress WP Ultimate Exporter plugin <= 3.0 - PHP Object Injection vulnerability

    YüksekCVSS 7,2İstismar yokEPSS %0

    smackcoders inc. · wp ultimate exporter5 Eki 2026

  • CVE-2026-105649
    29İzleyin

    Ghost: Stored XSS via SVG Uploads Bypassing Sanitization

    YüksekCVSS 7,3İstismar yokEPSS %0

    tryghost · ghost5 Eki 2026

  • CVE-2026-105650
    32İzleyin

    Ghost: Stored XSS via oEmbed Photo Responses

    YüksekCVSS 8,1İstismar yokEPSS %0

    tryghost · ghost5 Eki 2026

  • CVE-2026-105651
    29İzleyin

    Ghost: Stored XSS via Bookmark Card Images

    YüksekCVSS 7,3İstismar yokEPSS %0

    tryghost · ghost5 Eki 2026

  • CVE-2026-105675
    30İzleyin

    Ghost: Invite Token Disclosure in Ghost Admin API

    YüksekCVSS 7,5İstismar yokEPSS %0

    tryghost · ghost5 Eki 2026

  • CVE-2026-105677
    28İzleyin

    Ghost: Remote Code Execution via Theme Translation Files

    YüksekCVSS 7,2İstismar yokEPSS %0

    tryghost · ghost5 Eki 2026

  • CVE-2026-105679
    29İzleyin

    Ghost: Stored XSS via File Uploads on Local Storage

    YüksekCVSS 7,3İstismar yokEPSS %0

    tryghost · ghost5 Eki 2026

  • CVE-2026-105681
    26İzleyin

    Ghost: Authorization Bypass in Comments Feature

    OrtaCVSS 6,5İstismar yokEPSS %0

    tryghost · ghost5 Eki 2026

  • CVE-2026-105691
    39İzleyin

    Penpot: Authenticated OS Command Injection in Penpot SVG Exporter via Legacy fill-color

    KritikCVSS 9,9İstismar yokEPSS %0

    penpot · penpot5 Eki 2026

  • CVE-2026-78860
    31İzleyin

    An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext

    YüksekCVSS 7,8İstismar yokEPSS %0

    5 Eki 2026

  • CVE-2026-78861
    30İzleyin

    An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key

    YüksekCVSS 7,7İstismar yokEPSS %0

    5 Eki 2026

  • CVE-2026-93617
    28İzleyin

    WordPress Sunshine Photo Cart plugin <= 3.7.1 - PHP Object Injection vulnerability

    YüksekCVSS 7,2İstismar yokEPSS %0

    wp sunshine · sunshine photo cart5 Eki 2026

  • CVE-2026-94201
    32İzleyin

    Filtering an :atom attribute with unsafe_to_atom? can exhaust the BEAM atom table in Ash

    YüksekCVSS 8,2İstismar yokEPSS %0

    ash-project · ash5 Eki 2026

  • CVE-2026-95263
    28İzleyin

    Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control.

    YüksekCVSS 7,2İstismar yokEPSS %0

    5 Eki 2026

  • CVE-2026-95265
    30İzleyin

    Feehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint.

    YüksekCVSS 7,5İstismar yokEPSS %0

    5 Eki 2026

  • CVE-2026-97257
    35İzleyin

    WordPress Simple Event Planner plugin <= 1.5.7 - PHP Object Injection vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %0

    presstigers · simple event planner5 Eki 2026

  • CVE-2026-102262
    28İzleyin

    Newell Brands DYMO ID parent directory open to path traversal through improper spheres of control

    YüksekCVSS 7,0Kavram kanıtıEPSS %0

    newell brands · dymo id5 Eki 2026

  • CVE-2026-105697
    39İzleyin

    Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration

    KritikCVSS 9,9İstismar yokEPSS %0

    langflow-ai · langflow5 Eki 2026

  • CVE-2026-105699
    28İzleyin

    Langflow: Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers

    YüksekCVSS 7,1İstismar yokEPSS %0

    langflow-ai · langflow5 Eki 2026

  • CVE-2026-105740
    39İzleyin

    Langflow: Authenticated RCE via MCP Stdio transport allows any user to execute arbitrary OS commands on the server

    KritikCVSS 9,9İstismar yokEPSS %0

    langflow-ai · langflow5 Eki 2026

  • CVE-2026-105741
    28İzleyin

    Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration Write

    YüksekCVSS 7,1İstismar yokEPSS %0

    langflow-ai · langflow5 Eki 2026

  • CVE-2026-105773
    29İzleyin

    Canimaan Software ClamXAV local privilege escalation

    YüksekCVSS 7,3İstismar yokEPSS %0

    canimaan software · clamxav5 Eki 2026

  • CVE-2026-77226
    36İzleyin

    Camunda 7.24.0 < 7.24.15 Incorrect Authorization via SetupResource Endpoint

    KritikCVSS 9,2İstismar yokEPSS %0

    camunda · camunda 75 Eki 2026

  • CVE-2026-0461
    30İzleyin

    Insufficient boundary validation in the USB boot mode implementation of AMD Zynq™ UltraScale+ MPSoC and RFSoC devices could allow unbounded

    YüksekCVSS 7,5İstismar yokEPSS %0

    amd · zynq™ ultrascale+ mpsocs5 Eki 2026

  • CVE-2026-105744
    35İzleyin

    Docling: Arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine

    YüksekCVSS 8,8İstismar yokEPSS %0

    docling · docling5 Eki 2026

  • CVE-2026-105745
    31İzleyin

    Docling: Plugin entry points are imported before the allow_external_plugins check

    YüksekCVSS 7,8İstismar yokEPSS %0

    docling · docling5 Eki 2026

  • CVE-2026-105750
    30İzleyin

    Docling: `enable_local_fetch` is not enforced in HTML browser-rendering mode

    YüksekCVSS 7,5İstismar yokEPSS %0

    docling · docling5 Eki 2026

  • CVE-2026-21589
    71Bu hafta

    This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Ba

    KritikCVSS 9,3KEVSilahlaştırılmışEPSS %12

    atlassian · bitbucket data center5 Eki 2026

  • CVE-2026-91107
    37İzleyin

    openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR)

    KritikCVSS 9,3İstismar yokEPSS %0

    os4ed · opensis-classic5 Eki 2026

  • CVE-2026-104852
    32İzleyin

    GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`

    YüksekCVSS 8,2İstismar yokEPSS %0

    ardatan · graphql-tools5 Eki 2026

  • CVE-2026-105759
    30İzleyin

    vLLM: Unbounded Prometheus label cardinality from attacker-controlled HTTP method tokens in the vLLM Rust frontend metrics middleware (unauthenticated denial of

    YüksekCVSS 7,5İstismar yokEPSS %0

    vllm · vllm5 Eki 2026