Ekim 2026: sömürülen ve yeni ciddi CVE kayıtları

Use after free in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a

• Girişsiz RCE
• Bellek hatası

google · chrome2 gün önce

Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbit

• Girişsiz RCE

google · chrome2 gün önce

Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code ins

• Girişsiz RCE

google · chrome2 gün önce

Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outs

• Girişsiz RCE

google · chrome2 gün önce

Memory corruption in HTML in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the

• Girişsiz RCE
• Bellek hatası

google · chrome2 gün önce

Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the s

• Girişsiz RCE
• Bellek hatası

google · chrome2 gün önce

Improper input validation in Core in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arb

• Girişsiz RCE

google · chrome2 gün önce

Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside th

• Girişsiz RCE
• Bellek hatası

google · chrome2 gün önce

Improper input validation in WebRTC in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code

• Girişsiz RCE

google · chrome2 gün önce

Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitr

• Girişsiz RCE

google · chrome2 gün önce

Use after free in Browser in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside t

• Girişsiz RCE
• Bellek hatası

google · chrome2 gün önce

Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code

• Girişsiz RCE

google · chrome2 gün önce

Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary

• Girişsiz RCE

google · chrome2 gün önce

Use after free in ImageCapture in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbo

• Girişsiz RCE
• Bellek hatası

google · chrome2 gün önce

Improper input validation in Metrics in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbi

• Girişsiz RCE

google · chrome2 gün önce

Improper input validation in Headless in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary cod

• Girişsiz RCE

google · chrome2 gün önce

Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside t

• Girişsiz RCE
• Bellek hatası

google · chrome2 gün önce

Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox v

• Girişsiz RCE
• Bellek hatası

google · chrome2 gün önce

Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside th

• Girişsiz RCE
• Bellek hatası

google · chrome2 gün önce

Use after free in Modularization in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sand

• Girişsiz RCE
• Bellek hatası

google · chrome2 gün önce

Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outsi

• Girişsiz RCE
• Bellek hatası

google · chrome2 gün önce

Improper input validation in ReadingList in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary

• Girişsiz RCE

google · chrome2 gün önce

Use after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via

• Girişsiz RCE
• Bellek hatası

google · chrome2 gün önce

Use after free in PDFium in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the

• Girişsiz RCE
• Bellek hatası

google · chrome2 gün önce

Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside

• Girişsiz RCE
• Bellek hatası

google · chrome2 gün önce

Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox

• Girişsiz RCE
• Bellek hatası

google · chrome2 gün önce

Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code in

• Girişsiz RCE

google · chrome2 gün önce

Memory corruption in Payments in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox

• Girişsiz RCE
• Bellek hatası

google · chrome2 gün önce

Use after free in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox vi

• Girişsiz RCE
• Bellek hatası

google · chrome2 gün önce

Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via

• Girişsiz RCE
• Bellek hatası

google · chrome2 gün önce

Memory corruption in Cache in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside th

• Girişsiz RCE
• Bellek hatası

google · chrome2 gün önce

Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a

• Girişsiz RCE
• Bellek hatası

google · chrome2 gün önce

Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code in

• Girişsiz RCE

google · chrome2 gün önce

Improper input validation in Command in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code

• Girişsiz RCE

google · chrome2 gün önce

Use after free in WTF in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a c

• Girişsiz RCE
• Bellek hatası

google · chrome2 gün önce

Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside

• Girişsiz RCE
• Bellek hatası

google · chrome2 gün önce

Memory corruption in WebAudio in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside

• Girişsiz RCE
• Bellek hatası

google · chrome2 gün önce

Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the s

• Girişsiz RCE
• Bellek hatası

google · chrome2 gün önce

GRR has a Reflected XSS issue

• Kimlik doğrulamasız
• XSS

jeromedevome · grr2 gün önce

Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401

jhuckaby · cronicle2 gün önce

GRR vulnerable to Remote Code Execution Via PHP Code Injection

• RCE

jeromedevome · grr2 gün önce

GRR vulnerable to Arbitrary File Read and Deletion

• Yol geçişi

jeromedevome · grr2 gün önce

Nuxt Ollama: public runtime configuration discloses the configured cloud API key

• Kimlik doğrulamasız
• Bilgi sızıntısı

thoda-dev · nuxt-ollama2 gün önce

ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and then, on the fast path

• Kimlik doğrulamasız
• Bellek hatası
• Hizmet dışı bırakma

2 gün önce

The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] b

• Kimlik doğrulamasız
• Hizmet dışı bırakma

2 gün önce

jackson-dataformat-protobuf: integer overflow in ProtobufParser._readStringKey() allows OutOfMemoryError from an 8-byte payload

• Kimlik doğrulamasız
• Bellek hatası
• Hizmet dışı bırakma

fasterxml · jackson-dataformat-protobuf2 gün önce

jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CV

• Kimlik doğrulamasız
• Deserializasyon

fasterxml · jackson-databind2 gün önce

Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

artbees · jupiter x core2 gün önce

Linksys WAG200G through 1.01.06 OS Command Injection via timer_interval in setup.cgi

• RCE
• Komut enjeksiyonu

linksys · wag200g2 gün önce

Linksys WAG200G through 1.01.06 Admin Password Change Without Current Password

linksys · wag200g2 gün önce

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Database Backup Exposure via /admin/backup

• Kimlik doğrulamasız

c97net · qengine cms2 gün önce

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Local File Inclusion via admin/task.php

• Yol geçişi

c97net · qengine cms2 gün önce

C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, Cart Engine through 3.0.0 Unrestricted File Upload via Image Fields

• Dosya yükleme

c97net · qengine cms2 gün önce

CrushFTP before 7.3.0 Cross-Site Request Forgery via /WebInterface/function/

• Kimlik doğrulamasız
• CSRF

crushftp · crushftp2 gün önce

AI Marketing Expert <= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter

• Kimlik doğrulamasız
• XSS

nalam-1 · ai marketing expert — ai email marketing, ai content generator, seo analyzer, ai workflow automation, social media & ai chatbot2 gün önce

affiliate-toolkit <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting via 'atkp_product_producturl' Parameter

• Kimlik doğrulamasız
• XSS

cservit · affiliate-toolkit – multi-network affiliate & amazon product display2 gün önce

Xerte Online Toolkits through 3.15.5 RCE via Language Pack Import

• RCE
• Dosya yükleme

thexerteproject · xerteonlinetoolkits2 gün önce

rtl_433 through 25.12 Stack-Based Buffer Overflow via Proflame 2 Decoder

• Kimlik doğrulamasız
• Bellek hatası

merbanan · rtl_4332 gün önce

libexpat through 2.9.0 NULL Pointer Dereference via External Entity Subparser

• Kimlik doğrulamasız
• Bellek hatası

libexpat · libexpat2 gün önce

libexpat through 2.9.0 Integer Overflow in storeAtts via attIndex and nPrefixes

• Kimlik doğrulamasız
• Bellek hatası

libexpat · libexpat2 gün önce

LibreSSL ocspcheck through 4.4.0 Memory Exhaustion via Unbounded OCSP HTTP Response

• Kimlik doğrulamasız
• Hizmet dışı bırakma

openbsd · libressl2 gün önce

llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv()

• Kimlik doğrulamasız
• Bellek hatası

ggml-org · llama.cpp2 gün önce

mews/pos through 2.0.0 Missing Hash Verification in 3D Pay and 3D Host Callbacks

• Kimlik doğrulamasız

mewebstudio · pos2 gün önce

Tabularis before 0.28.0 SQL Injection via MCP describe_table table_name

• SQL enjeksiyonu

tabularisdb · tabularis2 gün önce

Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler

• Girişsiz RCE
• Dosya yükleme

pie register · pie register premium2 gün önce

AMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute

• Kimlik doğrulamasız
• XSS

mohammed_kaludi · amp for wp – accelerated mobile pages2 gün önce

affiliate-toolkit <= 3.9.2 - Authenticated (Contributor+) Arbitrary File Upload via 'atkp_product_largeimageurl' Parameter

• RCE
• Dosya yükleme

cservit · affiliate-toolkit – multi-network affiliate & amazon product display2 gün önce

Animated Text Block <= 1.2.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode Attribute

• Kimlik doğrulamasız
• Erişim denetimi (IDOR)

bplugins · animated text block – add typing and looping text effects2 gün önce

Rank Math SEO <= 1.0.276 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution

• RCE
• Deserializasyon

rankmath · rank math seo – ai seo tools to dominate seo rankings2 gün önce

Code injection in EagleCloud Aquila on-premises version

• RCE

eaglecloud · aquila2 gün önce

Insufficiently protected credentials in EagleCloud Aquila on-premises version

• Kimlik doğrulamasız
• Bilgi sızıntısı

eaglecloud · aquila2 gün önce

Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload

• Girişsiz RCE
• Dosya yükleme

unknown · checkout files upload for woocommerce2 gün önce

WooCommerce Menu Cart < 3.2.1 - Unauthenticated Stored XSS via Cart Item Variation Attribute

• Kimlik doğrulamasız
• XSS

unknown · menu cart for woocommerce2 gün önce

Persian WooCommerce SMS 7.2.0 - 7.3.1 - Reflected XSS via 'pwsms_mobiles' Parameter

• Kimlik doğrulamasız
• XSS

unknown · افزونه پیامک ووکامرس | persian woocommerce sms2 gün önce

GoSMTP < 1.2.5 - Plugin Activator+ Privilege Escalation via SMTP Settings

unknown · gosmtp2 gün önce

Product Designer for WooCommerce WordPress | Lumise <= 2.1.2 - Unauthenticated Arbitrary File Read via 'design.stages[*].image' Parameter in Cart JSON Upload

• Kimlik doğrulamasız
• Yol geçişi

king-theme · product designer for woocommerce wordpress | lumise2 gün önce

Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass

• Girişsiz RCE
• Dosya yükleme

kleor · contact manager2 gün önce

Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter

magepeopleteam · event booking manager for woocommerce – sell tickets, event registration, rsvp & event calendar2 gün önce

The Innovative Form Builder <= 1.5.1 - Authenticated (Custom+) Arbitrary File Upload via 'allowedFileExtensions' Configuration + Public /form/submission/ Multip

• RCE
• Dosya yükleme

melograno · the innovative form builder – ivyforms2 gün önce

MxChat <= 3.2.25 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'feedback' Parameter via mxchat_save_rating

• Kimlik doğrulamasız
• XSS

mxchat · mxchat – ai chatbot & content generation for wordpress2 gün önce

Prime Slider <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Content_Guard Regex Quote-Escape

• Kimlik doğrulamasız
• XSS

bdthemes · prime slider – hero slider, carousel, woocommerce & post slider elementor addons2 gün önce

VikRentCar Car Rental Management System <= 1.4.8 - Cross-Site Request Forgery to Remote Code Execution via 'condtext_update_tmpl' AJAX Task

• Girişsiz RCE
• CSRF

e4jvikwp · vikrentcar car rental management system2 gün önce

Database backups are vulnerable to offline attacks.

• Zayıf kripto

axis communications ab · axis camera station pro2 gün önce

Memberpress <= 1.14.1 - Cross-Site Request Forgery via 'user_email' Parameter

• Kimlik doğrulamasız
• CSRF

memberpress · memberpress2 gün önce

Dell PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.

• RCE
• Komut enjeksiyonu

dell · powerprotect data domain virtual edition2 gün önce

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re

• RCE
• Komut enjeksiyonu

dell · powerprotect data domain2 gün önce

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma
• Erişim denetimi (IDOR)

dell · powerprotect data domain2 gün önce

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re

• Yol geçişi

dell · powerprotect data domain2 gün önce

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re

• RCE
• Komut enjeksiyonu

dell · powerprotect data domain2 gün önce

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re

• Girişsiz RCE
• Kimlik doğrulama atlatma

dell · powerprotect data domain2 gün önce

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1

• Kimlik doğrulama atlatma

dell · powerprotect data domain management center2 gün önce

SQL injection (SQLi) in the user authentication module of Futurum Software

• Girişsiz RCE
• SQL enjeksiyonu

futurum software · futurum software user authentication module2 gün önce

Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1

• RCE
• Komut enjeksiyonu

dell · powerprotect data domain management center2 gün önce

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re

• Bellek hatası

dell · powerprotect data domain2 gün önce

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re

• Kimlik doğrulamasız
• Gömülü kimlik bilgisi

dell · powerprotect data domain2 gün önce

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, contain an Improper Check for Dropped Privileges vulnerability.

dell · powerprotect data domain2 gün önce

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re

• Bellek hatası

dell · powerprotect data domain2 gün önce

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re

dell · powerprotect data domain2 gün önce

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re

• RCE
• Komut enjeksiyonu

dell · powerprotect data domain2 gün önce

Local privilege escalation due to improper authentication.

• Kimlik doğrulama atlatma
• Yerel yetki yükseltme

acronis · acronis cyber protect cloud agent2 gün önce