Yayın tarihine göre
Ekim 2026: sömürülen ve yeni ciddi CVE kayıtları
8.293 kayıt · 20 KEV. Yayın sırasıyla.
Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.
Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.
Sayfa 82 / 83
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
28İzleyin | CVE-2026-118238Kavram kanıtı | The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validattenda · w18e · CWE-78 | Yüksek7,2 | — | — | Bugün |
34İzleyin | CVE-2026-104061İstismar yok | Scribus before 1.6.7 Heap Out-of-Bounds Write via PSD Image Loaderscribus · scribus · CWE-787 | Yüksek8,5 | — | — | Bugün |
34İzleyin | CVE-2026-104062İstismar yok | Scribus before 1.6.7 Heap Buffer Overflow via PICT Pixmap Loaderscribus · scribus · CWE-787 | Yüksek8,5 | — | — | Bugün |
34İzleyin | CVE-2026-104064İstismar yok | Scribus before 1.6.7 Heap Overflow via TIFF Tile Buffer Handlingscribus · scribus · CWE-190 | Yüksek8,5 | — | — | Bugün |
34İzleyin | CVE-2026-104065İstismar yok | Scribus before 1.6.7 Heap Out-of-Bounds Write via Micrografx Draw Importscribus · scribus · CWE-787 | Yüksek8,5 | — | — | Bugün |
34İzleyin | CVE-2026-104066İstismar yok | Scribus before 1.6.7 Heap Buffer Overflow via PICT 4-bit Pixel Unpackingscribus · scribus · CWE-787 | Yüksek8,5 | — | — | Bugün |
34İzleyin | CVE-2026-104067İstismar yok | Scribus before 1.6.7 Out-of-Bounds Memory Access via SVM Import Pluginscribus · scribus · CWE-787 | Yüksek8,5 | — | — | Bugün |
37İzleyin | CVE-2026-119706İstismar yok | LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserializationinternlm · lmdeploy · CWE-502 | Kritik9,3 | — | — | Bugün |
28İzleyin | CVE-2026-119707İstismar yok | SonicJS through 3.0.0 Missing Authorization in Content Write APIsonicjs-org · sonicjs · CWE-862 | Yüksek7,1 | — | — | Bugün |
28İzleyin | CVE-2026-119708İstismar yok | abp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File Disclosure via Blob Download-By-Namecolinin · abp-next-admin · CWE-639 | Yüksek7,1 | — | — | Bugün |
28İzleyin | CVE-2026-119710İstismar yok | PipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule Routepipeshub-ai · pipeshub-ai · CWE-862 | Yüksek7,1 | — | — | Bugün |
34İzleyin | CVE-2026-119713İstismar yok | Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commandspaperclipai · @paperclipai/server · CWE-78 | Yüksek8,7 | — | — | Bugün |
36İzleyin | CVE-2026-119716İstismar yok | pybars3 through 0.9.7 Code Injection via Bracketed Path Segmentswbond · pybars3 · CWE-94 | Kritik9,2 | — | — | Bugün |
36İzleyin | CVE-2026-119717İstismar yok | pybars4 through 0.9.13 Code Injection via Bracketed Path Segmentsup9inc · pybars4 · CWE-94 | Kritik9,2 | — | — | Bugün |
34İzleyin | CVE-2026-119718İstismar yok | Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Point Cacheblender foundation · blender · CWE-190 | Yüksek8,5 | — | — | Bugün |
34İzleyin | CVE-2026-119719İstismar yok | Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Thumbnail Extractionblender foundation · blender · CWE-190 | Yüksek8,5 | — | — | Bugün |
34İzleyin | CVE-2026-119722İstismar yok | Blender before 4.5.15 and 5.x before 5.2.3 Heap Out-of-Bounds Access via read_struct()blender foundation · blender · CWE-125 | Yüksek8,5 | — | — | Bugün |
32İzleyin | CVE-2026-119287İstismar yok | Zuke: Command-form registry descriptors bypass the MCP launch policyzuke-build · zuke · CWE-862 | Yüksek8,0 | — | — | Bugün |
28İzleyin | CVE-2026-119288İstismar yok | Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command linezuke-build · zuke · CWE-78 | Yüksek7,0 | — | — | Bugün |
28İzleyin | CVE-2026-119289İstismar yok | Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block a release gatezuke-build · zuke · CWE-345 | Yüksek7,1 | — | — | Bugün |
31İzleyin | CVE-2026-104615İstismar yok | Cluster identity takeover in Fleet cluster registration allows access to another cluster's Fleet namespacesuse · rancher · CWE-290 | Yüksek7,9 | — | — | Bugün |
30İzleyin | CVE-2026-119290İstismar yok | Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow runzuke-build · zuke · CWE-532 | Yüksek7,5 | — | — | Bugün |
31İzleyin | CVE-2026-119116İstismar yok | Use-after-free in the SetClient command handler of kmstool-enclave in AWS aws-nitro-enclaves-sdk-caws · kmstool-enclave · CWE-416 | Yüksek7,8 | — | — | Bugün |
25İzleyin | CVE-2026-104623Kavram kanıtı | Authorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management clustersuse · rancher · CWE-290 | Orta6,3 | — | — | Bugün |
35İzleyin | CVE-2026-65566İstismar yok | WordPress AI Engine plugin <= 3.8.8 - Cross Site Request Forgery (CSRF) vulnerabilitymeow apps · ai engine · CWE-352 | Yüksek8,8 | — | — | Bugün |
33İzleyin | CVE-2026-115642İstismar yok | In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-openstack · keystonemiddleware · CWE-863 | Yüksek8,3 | — | — | Bugün |
40Planlayın | CVE-2026-112816İstismar yok | Improper certificate validation in the HTTPS listener in LXDcanonical · lxd · CWE-295 | Kritik10,0 | — | — | Bugün |
32İzleyin | CVE-2026-61804İstismar yok | myTinyWMS has Stored Cross-Site Scripting (XSS) in Product and Category Managementmytinywms · mytinywms · CWE-79 | Yüksek8,1 | — | — | Bugün |
40Planlayın | CVE-2026-61826İstismar yok | Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgerymorpheus65535 · bazarr · CWE-352 | Kritik10,0 | — | — | Bugün |
34İzleyin | CVE-2025-8574İstismar yok | Database Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletiontigroumeow · database cleaner: cleanup, optimization & repair · CWE-284 | Yüksek8,7 | — | — | Bugün |
30İzleyin | CVE-2026-110305İstismar yok | Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag Injehwk-fr · advanced custom fields: extended · CWE-200 | Yüksek7,5 | — | — | Bugün |
30İzleyin | CVE-2026-107630İstismar yok | Email Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 - Missing Authorization to Unauthenticated Order PII Disclosure via 'preview_ordsaadiqbal · email templates customizer and designer for wordpress and woocommerce · CWE-862 | Yüksek7,5 | — | — | Bugün |
30İzleyin | CVE-2026-97638İstismar yok | Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameterwpmudev · forminator forms – contact form, payment form & custom form builder · CWE-639 | Yüksek7,5 | — | — | Bugün |
28İzleyin | CVE-2026-96894İstismar yok | ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.10 - Unauthenticated Stored Cross-Site Scripting via Inbound Email Bodywedevs · erp: complete hr, accounting & crm suite built for woocommerce · CWE-79 | Yüksek7,2 | — | — | Bugün |
29İzleyin | CVE-2026-118205İstismar yok | Essential Addons for Elementor <= 6.8.7 - Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revisionwpdevteam · essential addons for elementor – popular elementor templates & widgets · CWE-269 | Yüksek7,4 | — | — | Bugün |
32İzleyin | CVE-2026-115346İstismar yok | Avada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Fieldthemefusion · avada | website builder for wordpress & woocommerce · CWE-434 | Yüksek8,1 | — | — | Bugün |
28İzleyin | CVE-2026-112365İstismar yok | easy.jobs <= 2.8.4 - Unauthenticated Stored Cross-Site Scripting via 'cover_letter' Parameterwpdevteam · easy.jobs – ai powered job listing, job board, career page, recruitment & hiring solution · CWE-79 | Yüksek7,2 | — | — | Bugün |
28İzleyin | CVE-2026-104744İstismar yok | Independent Analytics Pro <= 2.15.5 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameterindependent analytics · independent analytics pro · CWE-79 | Yüksek7,2 | — | — | Bugün |
35İzleyin | CVE-2026-105894İstismar yok | Ak Framework <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Updateakbilisim · ak framework · CWE-269 | Yüksek8,8 | — | — | Bugün |
30İzleyin | CVE-2026-76012İstismar yok | Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Uplosmub · photo gallery, sliders, proofing and themes – nextgen gallery · CWE-434 | Yüksek7,5 | — | — | Bugün |
34İzleyin | CVE-2026-119760İstismar yok | sniproxy through 0.7.0 NULL Pointer Dereference via resolv_cancel()dlundquist · sniproxy · CWE-476 | Yüksek8,7 | — | — | Bugün |
34İzleyin | CVE-2026-119762İstismar yok | Axigen Mail Server before 10.5.69, 10.6.40, and 10.7.2 Unauthenticated DoS via Nested Requestsaxigen · axigen mail server · CWE-674 | Yüksek8,7 | — | — | Bugün |
29İzleyin | CVE-2026-119764İstismar yok | Mythic 3.2.16 through 3.4.0.61 Stored XSS via Agent-Downloaded File Previewits-a-feature · mythic · CWE-79 | Yüksek7,4 | — | — | Bugün |
36İzleyin | CVE-2026-119978İstismar yok | Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStoreflowiseai · flowise · CWE-749 | Kritik9,0 | — | — | Bugün |
32İzleyin | CVE-2026-118696İstismar yok | In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026jetbrains · intellij idea · CWE-299 | Yüksek8,0 | — | — | Bugün |
36İzleyin | CVE-2026-118697İstismar yok | In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon trusted compromised intermejetbrains · toolbox app · CWE-295 | Kritik9,0 | — | — | Bugün |
28İzleyin | CVE-2026-84243İstismar yok | gettext: Directory traversal via the LANGUAGE environment variablethe gnu c library · glibc · CWE-22 | Yüksek7,0 | — | — | Bugün |
34İzleyin | CVE-2026-119979İstismar yok | LM Studio before 0.4.22+1 Path Traversal via Model Downloaderelement labs · lm studio · CWE-22 | Yüksek8,7 | — | — | Bugün |
31İzleyin | CVE-2026-119777İstismar yok | Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: stack buffer overflow in h.266/vvc parserred hat · red hat enterprise linux 10 · CWE-787 | Yüksek7,8 | — | — | Bugün |
32İzleyin | CVE-2026-61854İstismar yok | VoiceSentinel: Race condition in report buffer cleanup can corrupt transcript data and cause unbounded disk growthjackh54 · voicesentinel · CWE-362 | Yüksek8,2 | — | — | Bugün |
34İzleyin | CVE-2026-62160İstismar yok | Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddlewaredaptin · daptin · CWE-400 | Yüksek8,7 | — | — | Bugün |
32İzleyin | CVE-2026-62162İstismar yok | Hydra: Deposit Claim omits Head state-token spending requirementcardano-scaling · hydra · CWE-862 | Yüksek8,2 | — | — | Bugün |
39İzleyin | CVE-2026-119526İstismar yok | WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerabilitythemerex · royal event · CWE-502 | Kritik9,8 | — | — | Bugün |
28İzleyin | CVE-2026-28160İstismar yok | WordPress VikRentCar plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerabilitye4jvikwp · vikrentcar · CWE-79 | Yüksek7,1 | — | — | Bugün |
37İzleyin | CVE-2026-39732İstismar yok | WordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerabilityivijan-stefan stipic · transliterator · CWE-89 | Kritik9,3 | — | — | Bugün |
30İzleyin | CVE-2026-39734İstismar yok | WordPress WP EasyPay plugin <= 4.5.4 - Path Traversal vulnerabilitysaad iqbal · wp easypay · CWE-35 | Yüksek7,5 | — | — | Bugün |
39İzleyin | CVE-2026-39738İstismar yok | WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerabilityfunnelkit · funnelkit automations · CWE-502 | Kritik9,8 | — | — | Bugün |
28İzleyin | CVE-2026-39786İstismar yok | WordPress BA Book Everything plugin <= 1.8.33 - Cross Site Scripting (XSS) vulnerabilitybookingalgorithms · ba book everything · CWE-79 | Yüksek7,1 | — | — | Bugün |
28İzleyin | CVE-2026-48201İstismar yok | WordPress Fast Velocity Minify plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerabilityraul p. · fast velocity minify · CWE-79 | Yüksek7,1 | — | — | Bugün |
28İzleyin | CVE-2026-54855İstismar yok | WordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerabilitycozmoslabs · profile builder · CWE-79 | Yüksek7,1 | — | — | Bugün |
35İzleyin | CVE-2026-73186İstismar yok | WordPress Enable Media Replace plugin <= 4.2.2 - PHP Object Injection vulnerabilityshortpixel · enable media replace · CWE-502 | Yüksek8,8 | — | — | Bugün |
35İzleyin | CVE-2026-78527İstismar yok | WordPress GS Testimonial Slider plugin <= 3.3.10 - PHP Object Injection vulnerabilitygs plugins · gs testimonial slider · CWE-502 | Yüksek8,8 | — | — | Bugün |
39İzleyin | CVE-2026-90888İstismar yok | WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerabilityleadsnap · leadsnap · CWE-502 | Kritik9,8 | — | — | Bugün |
28İzleyin | CVE-2026-94175İstismar yok | WordPress All In One Login plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerabilitysaad iqbal · all in one login · CWE-79 | Yüksek7,1 | — | — | Bugün |
28İzleyin | CVE-2026-105077İstismar yok | WordPress Ad Inserter plugin <= 2.8.19 - Cross Site Scripting (XSS) vulnerabilityspacetime · ad inserter · CWE-79 | Yüksek7,1 | — | — | Bugün |
39İzleyin | CVE-2026-116386İstismar yok | WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerabilitycozy vision technologies pvt. ltd. · sms alert order notifications · CWE-266 | Kritik9,8 | — | — | Bugün |
30İzleyin | CVE-2026-116401İstismar yok | WordPress HUSKY plugin <= 1.4.6 - Broken Access Control vulnerabilityrealmag777 · husky · CWE-862 | Yüksek7,5 | — | — | Bugün |
28İzleyin | CVE-2026-116405İstismar yok | WordPress VikRentCar plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerabilitye4jvikwp · vikrentcar · CWE-79 | Yüksek7,1 | — | — | Bugün |
28İzleyin | CVE-2026-116847İstismar yok | WordPress Mang Board WP plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerabilitykitae park · mang board wp · CWE-79 | Yüksek7,1 | — | — | Bugün |
28İzleyin | CVE-2026-116851İstismar yok | WordPress eCommerce Product Catalog plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerabilityimplecode · ecommerce product catalog · CWE-79 | Yüksek7,1 | — | — | Bugün |
36İzleyin | CVE-2026-116852İstismar yok | WordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerabilitymarketing fire · widget options · CWE-94 | Kritik9,1 | — | — | Bugün |
30İzleyin | CVE-2026-116861İstismar yok | WordPress Flexible Chat plugin <= 1.1.0 - Sensitive Data Exposure vulnerabilitywpdesk · flexible chat · CWE-201 | Yüksek7,5 | — | — | Bugün |
30İzleyin | CVE-2026-116862İstismar yok | WordPress WP REST Cache plugin <= 2026.3.1 - Broken Access Control vulnerabilityacato · wp rest cache · CWE-862 | Yüksek7,5 | — | — | Bugün |
35İzleyin | CVE-2026-118086İstismar yok | WordPress WP BASE Booking plugin <= 6.5.2 - Privilege Escalation vulnerabilityhakan ozevin · wp base booking · CWE-266 | Yüksek8,8 | — | — | Bugün |
28İzleyin | CVE-2026-118089İstismar yok | WordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerabilityrextheme · product feed manager · CWE-502 | Yüksek7,2 | — | — | Bugün |
35İzleyin | CVE-2026-118090İstismar yok | WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerabilitystylemix · masterstudy lms · CWE-502 | Yüksek8,8 | — | — | Bugün |
30İzleyin | CVE-2026-62264İstismar yok | PDF Reader MCP: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEYsylphxai · pdf-reader-mcp · CWE-200 | Yüksek7,5 | — | — | Bugün |
30İzleyin | CVE-2026-46560İstismar yok | OpenAM Authentication Bypass via RADIUS Spoofingopenidentityplatform · openam · CWE-347 | Yüksek7,5 | — | — | Bugün |
35İzleyin | CVE-2026-61845İstismar yok | Crass: Large numeric exponents cause CPU and memory denial of servicergrove · crass · CWE-789 | Yüksek8,9 | — | — | Bugün |
30İzleyin | CVE-2026-59978İstismar yok | AdminNeo: version-cache array injection causes persistent denial of serviceadminneo-org · adminneo · CWE-20 | Yüksek7,5 | — | — | Bugün |
32İzleyin | CVE-2026-61586İstismar yok | Copernik XML Factory: Improper restriction of XInclude resource resolution in Copernik XML Factory (stock JDK provider)copernik-eu · copernik-xml-factory · CWE-611 | Yüksek8,2 | — | — | Bugün |
32İzleyin | CVE-2026-62331İstismar yok | praktor: Telegram upload traversal permits persistent agent instruction injectionmtzanidakis · praktor · CWE-22 | Yüksek8,2 | — | — | Bugün |
29İzleyin | CVE-2026-78402İstismar yok | Stack Buffer Overflow in Sentinel Keys Serverthalesgroup · sentinel keys server · CWE-121 | Yüksek7,3 | — | — | Bugün |
37İzleyin | CVE-2026-78403İstismar yok | Unauthenticated Stack Buffer Overflow in Sentinel Keys Serverthalesgroup · sentinel keys server · CWE-121 | Kritik9,3 | — | — | Bugün |
34İzleyin | CVE-2026-62284İstismar yok | OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxyosac-project · osac-operator · CWE-94 | Yüksek8,6 | — | — | Bugün |
28İzleyin | CVE-2026-62301İstismar yok | MyTube: Visitor Can Access Hidden Video Metadata and Contentfranklioxygen · mytube · CWE-862 | Yüksek7,1 | — | — | Bugün |
34İzleyin | CVE-2026-62302İstismar yok | MyTube: Unauthenticated Media Access via Static Routes Bypassing Loginfranklioxygen · mytube · CWE-306 | Yüksek8,7 | — | — | Bugün |
36İzleyin | CVE-2026-55598İstismar yok | PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation)madeofpendletonwool · pinepods · CWE-918 | Kritik9,1 | — | — | Bugün |
37İzleyin | CVE-2026-61850İstismar yok | Kargo: Privilege escalation via Project RBAC management in the Kargo APIakuity · kargo · CWE-269 | Kritik9,3 | — | — | Bugün |
34İzleyin | CVE-2026-115830İstismar yok | Secret Server JWT issuance errordelinea · secret server · CWE-863 | Yüksek8,7 | — | — | Bugün |
34İzleyin | CVE-2026-115829İstismar yok | Secret Server partial login bypassdelinea · secret server · CWE-288 | Yüksek8,7 | — | — | Bugün |
32İzleyin | CVE-2026-116238İstismar yok | pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checkspgadmin.org · pgadmin 4 · CWE-307 | Yüksek8,1 | — | — | Bugün |
34İzleyin | CVE-2026-116239İstismar yok | pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same usernamepgadmin.org · pgadmin 4 · CWE-287 | Yüksek8,5 | — | — | Bugün |
39İzleyin | CVE-2026-116241İstismar yok | pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifierpgadmin.org · pgadmin 4 · CWE-78 | Kritik9,9 | — | — | Bugün |
32İzleyin | CVE-2026-116242İstismar yok | pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identitypgadmin.org · pgadmin 4 · CWE-522 | Yüksek8,2 | — | — | Bugün |
30İzleyin | CVE-2026-116243İstismar yok | pgAdmin 4: Utility binary path can point at a shared storage directorypgadmin.org · pgadmin 4 · CWE-426 | Yüksek7,5 | — | — | Bugün |
32İzleyin | CVE-2026-116244İstismar yok | pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentialspgadmin.org · pgadmin 4 · CWE-522 | Yüksek8,2 | — | — | Bugün |
32İzleyin | CVE-2026-116245İstismar yok | pgAdmin 4: Connection services are not restricted in server modepgadmin.org · pgadmin 4 · CWE-522 | Yüksek8,2 | — | — | Bugün |
32İzleyin | CVE-2026-116247İstismar yok | pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificatepgadmin.org · pgadmin 4 · CWE-522 | Yüksek8,2 | — | — | Bugün |
33İzleyin | CVE-2026-116249İstismar yok | pgAdmin 4: Connection file paths and parameter keys escape the user's storage directorypgadmin.org · pgadmin 4 · CWE-22 | Yüksek8,4 | — | — | Bugün |
- CVE-2026-11823828İzleyin
The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature due to improper validat
YüksekCVSS 7,2Kavram kanıtıtenda · w18eBugün
- CVE-2026-10406134İzleyin
Scribus before 1.6.7 Heap Out-of-Bounds Write via PSD Image Loader
YüksekCVSS 8,5İstismar yokscribus · scribusBugün
- CVE-2026-10406234İzleyin
Scribus before 1.6.7 Heap Buffer Overflow via PICT Pixmap Loader
YüksekCVSS 8,5İstismar yokscribus · scribusBugün
- CVE-2026-10406434İzleyin
Scribus before 1.6.7 Heap Overflow via TIFF Tile Buffer Handling
YüksekCVSS 8,5İstismar yokscribus · scribusBugün
- CVE-2026-10406534İzleyin
Scribus before 1.6.7 Heap Out-of-Bounds Write via Micrografx Draw Import
YüksekCVSS 8,5İstismar yokscribus · scribusBugün
- CVE-2026-10406634İzleyin
Scribus before 1.6.7 Heap Buffer Overflow via PICT 4-bit Pixel Unpacking
YüksekCVSS 8,5İstismar yokscribus · scribusBugün
- CVE-2026-10406734İzleyin
Scribus before 1.6.7 Out-of-Bounds Memory Access via SVM Import Plugin
YüksekCVSS 8,5İstismar yokscribus · scribusBugün
- CVE-2026-11970637İzleyin
LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization
KritikCVSS 9,3İstismar yokinternlm · lmdeployBugün
- CVE-2026-11970728İzleyin
SonicJS through 3.0.0 Missing Authorization in Content Write API
YüksekCVSS 7,1İstismar yoksonicjs-org · sonicjsBugün
- CVE-2026-11970828İzleyin
abp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File Disclosure via Blob Download-By-Name
YüksekCVSS 7,1İstismar yokcolinin · abp-next-adminBugün
- CVE-2026-11971028İzleyin
PipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule Route
YüksekCVSS 7,1İstismar yokpipeshub-ai · pipeshub-aiBugün
- CVE-2026-11971334İzleyin
Paperclip 2026.403.0 before 2026.416.0 RCE via Execution Workspace Cleanup Commands
YüksekCVSS 8,7İstismar yokpaperclipai · @paperclipai/serverBugün
- CVE-2026-11971636İzleyin
pybars3 through 0.9.7 Code Injection via Bracketed Path Segments
KritikCVSS 9,2İstismar yokwbond · pybars3Bugün
- CVE-2026-11971736İzleyin
pybars4 through 0.9.13 Code Injection via Bracketed Path Segments
KritikCVSS 9,2İstismar yokup9inc · pybars4Bugün
- CVE-2026-11971834İzleyin
Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Point Cache
YüksekCVSS 8,5İstismar yokblender foundation · blenderBugün
- CVE-2026-11971934İzleyin
Blender before 4.5.15 and 5.x before 5.2.3 Heap Buffer Overflow via Thumbnail Extraction
YüksekCVSS 8,5İstismar yokblender foundation · blenderBugün
- CVE-2026-11972234İzleyin
Blender before 4.5.15 and 5.x before 5.2.3 Heap Out-of-Bounds Access via read_struct()
YüksekCVSS 8,5İstismar yokblender foundation · blenderBugün
- CVE-2026-11928732İzleyin
Zuke: Command-form registry descriptors bypass the MCP launch policy
YüksekCVSS 8,0İstismar yokzuke-build · zukeBugün
- CVE-2026-11928828İzleyin
Zuke: Argument injection on Windows: batch shims are launched through cmd.exe, which re-parses the command line
YüksekCVSS 7,0İstismar yokzuke-build · zukeBugün
- CVE-2026-11928928İzleyin
Zuke: githubWorkflow adopts any workflow run whose title matches its marker, so anyone who can dispatch the workflow can satisfy or block a release gate
YüksekCVSS 7,1İstismar yokzuke-build · zukeBugün
- CVE-2026-10461531İzleyin
Cluster identity takeover in Fleet cluster registration allows access to another cluster's Fleet namespace
YüksekCVSS 7,9İstismar yoksuse · rancherBugün
- CVE-2026-11929030İzleyin
Zuke: Resolved secret() values are written to GITHUB_STEP_SUMMARY in the clear, disclosing them to anyone who can view the workflow run
YüksekCVSS 7,5İstismar yokzuke-build · zukeBugün
- CVE-2026-11911631İzleyin
Use-after-free in the SetClient command handler of kmstool-enclave in AWS aws-nitro-enclaves-sdk-c
YüksekCVSS 7,8İstismar yokaws · kmstool-enclaveBugün
- CVE-2026-10462325İzleyin
Authorization bypass on the local cluster shell endpoint allows an unauthorized Rancher user to obtain a shell pod on the management cluster
OrtaCVSS 6,3Kavram kanıtısuse · rancherBugün
- CVE-2026-6556635İzleyin
WordPress AI Engine plugin <= 3.8.8 - Cross Site Request Forgery (CSRF) vulnerability
YüksekCVSS 8,8İstismar yokmeow apps · ai engineBugün
- CVE-2026-11564233İzleyin
In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-
YüksekCVSS 8,3İstismar yokopenstack · keystonemiddlewareBugün
- CVE-2026-11281640Planlayın
Improper certificate validation in the HTTPS listener in LXD
KritikCVSS 10,0İstismar yokcanonical · lxdBugün
- CVE-2026-6180432İzleyin
myTinyWMS has Stored Cross-Site Scripting (XSS) in Product and Category Management
YüksekCVSS 8,1İstismar yokmytinywms · mytinywmsBugün
- CVE-2026-6182640Planlayın
Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery
KritikCVSS 10,0İstismar yokmorpheus65535 · bazarrBugün
- CVE-2025-857434İzleyin
Database Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion
YüksekCVSS 8,7İstismar yoktigroumeow · database cleaner: cleanup, optimization & repairBugün
- CVE-2026-11030530İzleyin
Advanced Custom Fields: Extended <= 0.9.2.7 - Unauthenticated Sensitive Information Exposure in 'acf[<mapped_field>]' Parameter via {get_user} Template Tag Inje
YüksekCVSS 7,5İstismar yokhwk-fr · advanced custom fields: extendedBugün
- CVE-2026-10763030İzleyin
Email Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 - Missing Authorization to Unauthenticated Order PII Disclosure via 'preview_ord
YüksekCVSS 7,5İstismar yoksaadiqbal · email templates customizer and designer for wordpress and woocommerceBugün
- CVE-2026-9763830İzleyin
Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter
YüksekCVSS 7,5İstismar yokwpmudev · forminator forms – contact form, payment form & custom form builderBugün
- CVE-2026-9689428İzleyin
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.10 - Unauthenticated Stored Cross-Site Scripting via Inbound Email Body
YüksekCVSS 7,2İstismar yokwedevs · erp: complete hr, accounting & crm suite built for woocommerceBugün
- CVE-2026-11820529İzleyin
Essential Addons for Elementor <= 6.8.7 - Unauthenticated Privilege Escalation to 'page_id' Parameter via Elementor Revision
YüksekCVSS 7,4İstismar yokwpdevteam · essential addons for elementor – popular elementor templates & widgetsBugün
- CVE-2026-11534632İzleyin
Avada | Website Builder For WordPress & WooCommerce <= 7.16.2 - Unauthenticated Arbitrary File Upload via Avada Form Upload Field
YüksekCVSS 8,1İstismar yokthemefusion · avada | website builder for wordpress & woocommerceBugün
- CVE-2026-11236528İzleyin
easy.jobs <= 2.8.4 - Unauthenticated Stored Cross-Site Scripting via 'cover_letter' Parameter
YüksekCVSS 7,2İstismar yokwpdevteam · easy.jobs – ai powered job listing, job board, career page, recruitment & hiring solutionBugün
- CVE-2026-10474428İzleyin
Independent Analytics Pro <= 2.15.5 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter
YüksekCVSS 7,2İstismar yokindependent analytics · independent analytics proBugün
- CVE-2026-10589435İzleyin
Ak Framework <= 2.9.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Update
YüksekCVSS 8,8İstismar yokakbilisim · ak frameworkBugün
- CVE-2026-7601230İzleyin
Photo Gallery, Sliders, Proofing and Themes <= 4.4.1 - Authenticated (Custom+) Local File Inclusion via Lightroom 'gallery_edit' Task property_list + Image Uplo
YüksekCVSS 7,5İstismar yoksmub · photo gallery, sliders, proofing and themes – nextgen galleryBugün
- CVE-2026-11976034İzleyin
sniproxy through 0.7.0 NULL Pointer Dereference via resolv_cancel()
YüksekCVSS 8,7İstismar yokdlundquist · sniproxyBugün
- CVE-2026-11976234İzleyin
Axigen Mail Server before 10.5.69, 10.6.40, and 10.7.2 Unauthenticated DoS via Nested Requests
YüksekCVSS 8,7İstismar yokaxigen · axigen mail serverBugün
- CVE-2026-11976429İzleyin
Mythic 3.2.16 through 3.4.0.61 Stored XSS via Agent-Downloaded File Preview
YüksekCVSS 7,4İstismar yokits-a-feature · mythicBugün
- CVE-2026-11997836İzleyin
Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore
KritikCVSS 9,0İstismar yokflowiseai · flowiseBugün
- CVE-2026-11869632İzleyin
In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026
YüksekCVSS 8,0İstismar yokjetbrains · intellij ideaBugün
- CVE-2026-11869736İzleyin
In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon trusted compromised interme
KritikCVSS 9,0İstismar yokjetbrains · toolbox appBugün
- CVE-2026-8424328İzleyin
gettext: Directory traversal via the LANGUAGE environment variable
YüksekCVSS 7,0İstismar yokthe gnu c library · glibcBugün
- CVE-2026-11997934İzleyin
LM Studio before 0.4.22+1 Path Traversal via Model Downloader
YüksekCVSS 8,7İstismar yokelement labs · lm studioBugün
- CVE-2026-11977731İzleyin
Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: stack buffer overflow in h.266/vvc parser
YüksekCVSS 7,8İstismar yokred hat · red hat enterprise linux 10Bugün
- CVE-2026-6185432İzleyin
VoiceSentinel: Race condition in report buffer cleanup can corrupt transcript data and cause unbounded disk growth
YüksekCVSS 8,2İstismar yokjackh54 · voicesentinelBugün
- CVE-2026-6216034İzleyin
Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware
YüksekCVSS 8,7İstismar yokdaptin · daptinBugün
- CVE-2026-6216232İzleyin
Hydra: Deposit Claim omits Head state-token spending requirement
YüksekCVSS 8,2İstismar yokcardano-scaling · hydraBugün
- CVE-2026-11952639İzleyin
WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability
KritikCVSS 9,8İstismar yokthemerex · royal eventBugün
- CVE-2026-2816028İzleyin
WordPress VikRentCar plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yoke4jvikwp · vikrentcarBugün
- CVE-2026-3973237İzleyin
WordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerability
KritikCVSS 9,3İstismar yokivijan-stefan stipic · transliteratorBugün
- CVE-2026-3973430İzleyin
WordPress WP EasyPay plugin <= 4.5.4 - Path Traversal vulnerability
YüksekCVSS 7,5İstismar yoksaad iqbal · wp easypayBugün
- CVE-2026-3973839İzleyin
WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability
KritikCVSS 9,8İstismar yokfunnelkit · funnelkit automationsBugün
- CVE-2026-3978628İzleyin
WordPress BA Book Everything plugin <= 1.8.33 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokbookingalgorithms · ba book everythingBugün
- CVE-2026-4820128İzleyin
WordPress Fast Velocity Minify plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokraul p. · fast velocity minifyBugün
- CVE-2026-5485528İzleyin
WordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokcozmoslabs · profile builderBugün
- CVE-2026-7318635İzleyin
WordPress Enable Media Replace plugin <= 4.2.2 - PHP Object Injection vulnerability
YüksekCVSS 8,8İstismar yokshortpixel · enable media replaceBugün
- CVE-2026-7852735İzleyin
WordPress GS Testimonial Slider plugin <= 3.3.10 - PHP Object Injection vulnerability
YüksekCVSS 8,8İstismar yokgs plugins · gs testimonial sliderBugün
- CVE-2026-9088839İzleyin
WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerability
KritikCVSS 9,8İstismar yokleadsnap · leadsnapBugün
- CVE-2026-9417528İzleyin
WordPress All In One Login plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yoksaad iqbal · all in one loginBugün
- CVE-2026-10507728İzleyin
WordPress Ad Inserter plugin <= 2.8.19 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokspacetime · ad inserterBugün
- CVE-2026-11638639İzleyin
WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerability
KritikCVSS 9,8İstismar yokcozy vision technologies pvt. ltd. · sms alert order notificationsBugün
- CVE-2026-11640130İzleyin
WordPress HUSKY plugin <= 1.4.6 - Broken Access Control vulnerability
YüksekCVSS 7,5İstismar yokrealmag777 · huskyBugün
- CVE-2026-11640528İzleyin
WordPress VikRentCar plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yoke4jvikwp · vikrentcarBugün
- CVE-2026-11684728İzleyin
WordPress Mang Board WP plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokkitae park · mang board wpBugün
- CVE-2026-11685128İzleyin
WordPress eCommerce Product Catalog plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerability
YüksekCVSS 7,1İstismar yokimplecode · ecommerce product catalogBugün
- CVE-2026-11685236İzleyin
WordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerability
KritikCVSS 9,1İstismar yokmarketing fire · widget optionsBugün
- CVE-2026-11686130İzleyin
WordPress Flexible Chat plugin <= 1.1.0 - Sensitive Data Exposure vulnerability
YüksekCVSS 7,5İstismar yokwpdesk · flexible chatBugün
- CVE-2026-11686230İzleyin
WordPress WP REST Cache plugin <= 2026.3.1 - Broken Access Control vulnerability
YüksekCVSS 7,5İstismar yokacato · wp rest cacheBugün
- CVE-2026-11808635İzleyin
WordPress WP BASE Booking plugin <= 6.5.2 - Privilege Escalation vulnerability
YüksekCVSS 8,8İstismar yokhakan ozevin · wp base bookingBugün
- CVE-2026-11808928İzleyin
WordPress Product Feed Manager plugin <= 7.14.1 - PHP Object Injection vulnerability
YüksekCVSS 7,2İstismar yokrextheme · product feed managerBugün
- CVE-2026-11809035İzleyin
WordPress MasterStudy LMS plugin <= 3.7.55 - PHP Object Injection vulnerability
YüksekCVSS 8,8İstismar yokstylemix · masterstudy lmsBugün
- CVE-2026-6226430İzleyin
PDF Reader MCP: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY
YüksekCVSS 7,5İstismar yoksylphxai · pdf-reader-mcpBugün
- CVE-2026-4656030İzleyin
OpenAM Authentication Bypass via RADIUS Spoofing
YüksekCVSS 7,5İstismar yokopenidentityplatform · openamBugün
- CVE-2026-6184535İzleyin
Crass: Large numeric exponents cause CPU and memory denial of service
YüksekCVSS 8,9İstismar yokrgrove · crassBugün
- CVE-2026-5997830İzleyin
AdminNeo: version-cache array injection causes persistent denial of service
YüksekCVSS 7,5İstismar yokadminneo-org · adminneoBugün
- CVE-2026-6158632İzleyin
Copernik XML Factory: Improper restriction of XInclude resource resolution in Copernik XML Factory (stock JDK provider)
YüksekCVSS 8,2İstismar yokcopernik-eu · copernik-xml-factoryBugün
- CVE-2026-6233132İzleyin
praktor: Telegram upload traversal permits persistent agent instruction injection
YüksekCVSS 8,2İstismar yokmtzanidakis · praktorBugün
- CVE-2026-7840229İzleyin
Stack Buffer Overflow in Sentinel Keys Server
YüksekCVSS 7,3İstismar yokthalesgroup · sentinel keys serverBugün
- CVE-2026-7840337İzleyin
Unauthenticated Stack Buffer Overflow in Sentinel Keys Server
KritikCVSS 9,3İstismar yokthalesgroup · sentinel keys serverBugün
- CVE-2026-6228434İzleyin
OSAC operator: Kubeconfig credential-plugin execution and SSRF in console proxy
YüksekCVSS 8,6İstismar yokosac-project · osac-operatorBugün
- CVE-2026-6230128İzleyin
MyTube: Visitor Can Access Hidden Video Metadata and Content
YüksekCVSS 7,1İstismar yokfranklioxygen · mytubeBugün
- CVE-2026-6230234İzleyin
MyTube: Unauthenticated Media Access via Static Routes Bypassing Login
YüksekCVSS 8,7İstismar yokfranklioxygen · mytubeBugün
- CVE-2026-5559836İzleyin
PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation)
KritikCVSS 9,1İstismar yokmadeofpendletonwool · pinepodsBugün
- CVE-2026-6185037İzleyin
Kargo: Privilege escalation via Project RBAC management in the Kargo API
KritikCVSS 9,3İstismar yokakuity · kargoBugün
- CVE-2026-11583034İzleyin
Secret Server JWT issuance error
YüksekCVSS 8,7İstismar yokdelinea · secret serverBugün
- CVE-2026-11582934İzleyin
Secret Server partial login bypass
YüksekCVSS 8,7İstismar yokdelinea · secret serverBugün
- CVE-2026-11623832İzleyin
pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks
YüksekCVSS 8,1İstismar yokpgadmin.org · pgadmin 4Bugün
- CVE-2026-11623934İzleyin
pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same username
YüksekCVSS 8,5İstismar yokpgadmin.org · pgadmin 4Bugün
- CVE-2026-11624139İzleyin
pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier
KritikCVSS 9,9İstismar yokpgadmin.org · pgadmin 4Bugün
- CVE-2026-11624232İzleyin
pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity
YüksekCVSS 8,2İstismar yokpgadmin.org · pgadmin 4Bugün
- CVE-2026-11624330İzleyin
pgAdmin 4: Utility binary path can point at a shared storage directory
YüksekCVSS 7,5İstismar yokpgadmin.org · pgadmin 4Bugün
- CVE-2026-11624432İzleyin
pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials
YüksekCVSS 8,2İstismar yokpgadmin.org · pgadmin 4Bugün
- CVE-2026-11624532İzleyin
pgAdmin 4: Connection services are not restricted in server mode
YüksekCVSS 8,2İstismar yokpgadmin.org · pgadmin 4Bugün
- CVE-2026-11624732İzleyin
pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificate
YüksekCVSS 8,2İstismar yokpgadmin.org · pgadmin 4Bugün
- CVE-2026-11624933İzleyin
pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory
YüksekCVSS 8,4İstismar yokpgadmin.org · pgadmin 4Bugün