İçeriğe atla
Noroxi

Yayın tarihine göre

Ekim 2026: sömürülen ve yeni ciddi CVE kayıtları

8.335 kayıt · 20 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 84 / 84

  • CVE-2026-115840
    28İzleyin

    VikRentCar Car Rental Management System <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via 'poplink' Parameter

    YüksekCVSS 7,2İstismar yok

    e4jvikwp · vikrentcar car rental management systemBugün

  • CVE-2026-118070
    28İzleyin

    Welcart e-Commerce <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter

    YüksekCVSS 7,2İstismar yok

    uscnanbu · welcart e-commerceBugün

  • CVE-2026-116557
    36İzleyin

    WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action

    KritikCVSS 9,1İstismar yok

    murgroland · wp booking system – booking calendarBugün

  • CVE-2026-116548
    28İzleyin

    VikRentCar Car Rental Management System <= 1.4.10 - Unauthenticated Stored Cross-Site Scripting via 'optionals' Parameter

    YüksekCVSS 7,2İstismar yok

    e4jvikwp · vikrentcar car rental management systemBugün

  • CVE-2026-119065
    28İzleyin

    Shipping Zones by Drawing for WooCommerce <= 3.3.0 - Unauthenticated Stored Cross-Site Scripting via 'szbd-picked' Checkout Parameter

    YüksekCVSS 7,2İstismar yok

    arosoft · shipping zones by drawing for woocommerceBugün

  • CVE-2026-104012
    35İzleyin

    Rox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpoint

    YüksekCVSS 8,8İstismar yok

    roxnor · rox appointment booking – event, calendar & appointment schedulingBugün

  • CVE-2026-118057
    28İzleyin

    Shield Security <= 22.3.2 - Unauthenticated Stored Cross-Site Scripting via Request Path (REQUEST_URI) in Traffic Log

    YüksekCVSS 7,2İstismar yok

    paultgoodchild · shield security – smart bot blocking, brute-force login protection & file scanningBugün

  • CVE-2026-119096
    39İzleyin

    Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter

    KritikCVSS 9,8İstismar yok

    uncannyowl · uncanny toolkit for learndashBugün

  • CVE-2026-116512
    39İzleyin

    Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection

    KritikCVSS 9,8İstismar yok

    wedevs · project manager – ai powered project management, task management, kanban board & time trackerBugün

  • CVE-2026-107759
    28İzleyin

    WPO365 | MICROSOFT 365 GRAPH MAILER <= 6.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject via wp_mail

    YüksekCVSS 7,2İstismar yok

    wpo365 · wpo365 | microsoft 365 graph mailerBugün

  • CVE-2026-103898
    32İzleyin

    Wp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callback

    YüksekCVSS 8,1İstismar yok

    roxnor · wp social login and register social counterBugün

  • CVE-2026-120070
    35İzleyin

    User Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameter

    YüksekCVSS 8,8İstismar yok

    wedevs · user frontend – membership, user registration, user profile, user directory & content restriction with frontend post submissionBugün

  • CVE-2026-118235
    39İzleyin

    SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data

    KritikCVSS 9,8İstismar yok

    wpazleen · simpleform – form maker to chat apps with quiz, poll and multi lead notificationsBugün

  • CVE-2026-103882
    36İzleyin

    Acadlix LMS <= 1.1.9 - Unauthenticated Arbitrary File Deletion via 'delete_file_data.file_path' Parameter

    KritikCVSS 9,1İstismar yok

    acadlix · acadlix lms – ai quiz maker, online exam & course plugin for wordpressBugün

  • CVE-2026-120075
    28İzleyin

    WP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting

    YüksekCVSS 7,2İstismar yok

    melapress · wp activity logBugün

  • CVE-2026-110530
    28İzleyin

    FeedWordPress <= 2026.0517 - Unauthenticated Stored Cross-Site Scripting via Syndicated Feed Content

    YüksekCVSS 7,2İstismar yok

    radgeek · feedwordpressBugün

  • CVE-2026-114217
    34İzleyin

    Konflux-ci: github token plaintext exposure in ci/cd scripts

    YüksekCVSS 8,6İstismar yok

    Bugün

  • CVE-2026-116086
    35İzleyin

    Konflux-ci: jq filter injection in github workflow issue management

    YüksekCVSS 8,8İstismar yok

    Bugün

  • CVE-2026-116964
    33İzleyin

    Konflux-ci: remote code execution via eval() in manifest scripts

    YüksekCVSS 8,4İstismar yok

    Bugün

  • CVE-2026-117681
    32İzleyin

    Konflux-ci: ui proxy skips backend tls verification on non-openshift clusters, leaking a token that can impersonate anyone

    YüksekCVSS 8,0İstismar yok

    Bugün

  • CVE-2026-76010
    35İzleyin

    Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment a

    YüksekCVSS 8,8İstismar yok

    smub · photo gallery, sliders, proofing and themes – nextgen galleryBugün

  • CVE-2026-109197
    30İzleyin

    WP Directory Kit <= 1.6.0 - Unauthenticated SQL Injection via 'idfield' Parameter

    YüksekCVSS 7,5İstismar yok

    wpdirectorykit · wp directory kitBugün

  • CVE-2026-120114
    28İzleyin

    Debug Log Manager <= 2.5.2 - Unauthenticated Stored Cross-Site Scripting via 'log_js_errors' AJAX Endpoint

    YüksekCVSS 7,2İstismar yok

    qriouslad · debug log manager – conveniently monitor and inspect errorsBugün

  • CVE-2026-120194
    30İzleyin

    Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step

    YüksekCVSS 7,5İstismar yok

    red hat · red hat enterprise linux 10Bugün

  • CVE-2026-102212
    33İzleyin

    Pre-Auth Heap Buffer Overflow in the Multipart Request

    YüksekCVSS 8,4İstismar yok

    opengear · im7200Bugün

  • CVE-2026-120201
    37İzleyin

    Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header

    KritikCVSS 9,3İstismar yok

    dromara · jpomBugün

  • CVE-2026-120202
    28İzleyin

    Highflame ramparts 0.8.1 through 0.8.10 Skill Bundle Scan Bypass via Nested .pyc

    YüksekCVSS 7,1İstismar yok

    highflame-ai · rampartsBugün

  • CVE-2026-120203
    34İzleyin

    ShowDoc 2.8.14 before 3.9.6 Code Injection via Mock Templates

    YüksekCVSS 8,7İstismar yok

    showdoc · showdocBugün

  • CVE-2026-120205
    29İzleyin

    Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name

    YüksekCVSS 7,4İstismar yok

    thelia · theliaBugün

  • CVE-2026-120207
    28İzleyin

    Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routes

    YüksekCVSS 7,0İstismar yok

    thelia · thelia page moduleBugün

  • CVE-2026-120208
    30İzleyin

    libheif 1.18.0 before 1.23.3 Heap Buffer Overflow via unci Mixed-Interleave Decoder

    YüksekCVSS 7,7İstismar yok

    strukturag · libheifBugün

  • CVE-2026-120209
    37İzleyin

    AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token

    KritikCVSS 9,3İstismar yok

    anji-plus · aj-reportBugün

  • CVE-2026-118147
    29İzleyin

    Visual Studio Spoofing Vulnerability

    YüksekCVSS 7,4İstismar yok

    microsoft · microsoft visual studio 2017 version 15.9Bugün

  • CVE-2026-118636
    39İzleyin

    Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder

    KritikCVSS 9,8İstismar yok

    apache software foundation · apache minaBugün

  • CVE-2026-120135
    32İzleyin

    Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default

    YüksekCVSS 8,2İstismar yok

    apache software foundation · apache thriftBugün