İçeriğe atla
Noroxi

Yayın tarihine göre

Ekim 2026: sömürülen ve yeni ciddi CVE kayıtları

8.599 kayıt · 21 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 86 / 86

  • CVE-2026-40573
    34İzleyin

    NovumOS: Nova Interpreter Privilege Escalation

    YüksekCVSS 8,6İstismar yokEPSS %0

    minecanton209 · novumos5 gün önce

  • CVE-2026-58412
    32İzleyin

    Filecoin Pin: Fork bypass in the privileged GitHub Actions workflow

    YüksekCVSS 8,2İstismar yokEPSS %0

    filecoin-project · filecoin-pin5 gün önce

  • CVE-2026-62297
    30İzleyin

    ag-psd has uncontrolled memory allocation via declared PSD dimensions (DoS)

    YüksekCVSS 7,5İstismar yokEPSS %0

    agamnentzar · ag-psd5 gün önce

  • CVE-2026-62847
    32İzleyin

    Metalama: Local code execution via DLL planting in world-writable temporary directories (Linux/macOS)

    YüksekCVSS 8,2İstismar yokEPSS %0

    metalama · metalama5 gün önce

  • CVE-2026-62848
    29İzleyin

    Metalama's Visual Studio inter-process named pipe allows unsafe deserialization that enables local code execution

    YüksekCVSS 7,3İstismar yokEPSS %0

    metalama · metalama5 gün önce

  • CVE-2026-62849
    36İzleyin

    ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection

    KritikCVSS 9,1İstismar yokEPSS %0

    mqttsnet · thinglinks5 gün önce

  • CVE-2026-62853
    39İzleyin

    ThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks

    KritikCVSS 9,9İstismar yokEPSS %0

    mqttsnet · thinglinks5 gün önce

  • CVE-2026-62863
    38İzleyin

    MoLing: unauthenticated SSE and wildcard CORS expose tool sessions

    KritikCVSS 9,6İstismar yokEPSS %0

    gojue · moling5 gün önce

  • CVE-2026-62864
    30İzleyin

    Ring's nested-params middleware has inefficient regular expression complexity

    YüksekCVSS 7,5İstismar yokEPSS %0

    ring-clojure · ring5 gün önce

  • CVE-2026-62958
    31İzleyin

    libriscv: Out of bounds read vuln in the ELF parser (Denial of service)

    YüksekCVSS 7,9Kavram kanıtıEPSS %0

    libriscv · libriscv5 gün önce

  • CVE-2026-62965
    28İzleyin

    SABnzbd: Orphan-job path traversal permits arbitrary file deletion

    YüksekCVSS 7,0İstismar yokEPSS %0

    sabnzbd · sabnzbd5 gün önce

  • CVE-2026-62966
    30İzleyin

    ESPAsyncWebServer multipart parser has null-pointer write

    YüksekCVSS 7,5İstismar yokEPSS %0

    esp32async · espasyncwebserver5 gün önce

  • CVE-2026-62967
    32İzleyin

    ZTNET privilege bypass: any user can deactivate arbitrary accounts via /api/auth/user/invalidateUser

    YüksekCVSS 8,1İstismar yokEPSS %0

    sinamics · ztnet5 gün önce

  • CVE-2026-62968
    34İzleyin

    Dream Displays has command-line argument injection in yt-dlp invocation

    YüksekCVSS 8,7İstismar yokEPSS %0

    arsmotorin · dreamdisplays5 gün önce

  • CVE-2026-62979
    33İzleyin

    jack: upstream error responses expose backend and peer credentials

    YüksekCVSS 8,4İstismar yokEPSS %0

    roziscoding · jack5 gün önce

  • CVE-2026-62989
    32İzleyin

    Shopper: missing variant-delete authorization permits destructive single and bulk actions

    YüksekCVSS 8,1İstismar yokEPSS %0

    shopperlabs · shopper5 gün önce

  • CVE-2026-62990
    34İzleyin

    Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation

    YüksekCVSS 8,7İstismar yokEPSS %0

    shopperlabs · shopper5 gün önce

  • CVE-2026-111578
    30İzleyin

    PDF Invoices & Packing Slips for WooCommerce 5.16.2 - 5.16.4 - Unauthenticated Stored XSS via Order Address and Customer Note Fields

    YüksekCVSS 7,5İstismar yokEPSS %0

    unknown · pdf invoices & packing slips for woocommerce5 gün önce

  • CVE-2026-118938
    35İzleyin

    Fickling check_safety() bypass: dotted __qualname__ in STACK_GLOBAL resolves a class-method attribute path that evades call analysis

    YüksekCVSS 8,8İstismar yokEPSS %0

    trailofbits · fickling5 gün önce

  • CVE-2026-16760
    35İzleyin

    Fickling check_safety() bypass: likely_safe_imports grants module-origin trust to unvalidated standard library callables

    YüksekCVSS 8,8İstismar yokEPSS %0

    trailofbits · fickling5 gün önce

  • CVE-2026-63182
    32İzleyin

    LightSAML: Signature reference wrapping permits unsigned assertion claims

    YüksekCVSS 8,1İstismar yokEPSS %0

    litesaml · lightsaml5 gün önce

  • CVE-2026-63184
    28İzleyin

    Refitter: Unrestricted OpenAPI references permit build-host SSRF and file inclusion

    YüksekCVSS 7,1İstismar yokEPSS %0

    christianhelle · refitter5 gün önce

  • CVE-2026-63201
    28İzleyin

    netopeer2-server logging has format string vulnerability via subtree filter

    YüksekCVSS 7,1İstismar yokEPSS %0

    cesnet · netopeer25 gün önce

  • CVE-2026-63224
    28İzleyin

    OpenRemote has authenticated SQL injection in crosstab datapoint exports

    YüksekCVSS 7,2İstismar yokEPSS %0

    openremote · openremote5 gün önce

  • GHSA-q5mp-gfjf-cf2j
    28İzleyin

    AdminNeo: RCE via SQLite VACUUM INTO (ATTACH Blocklist Bypass)

    YüksekCVSS 7,2İstismar yok

    5 gün önce

  • GHSA-79wv-8rh2-9vp2
    32İzleyin

    AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers

    YüksekCVSS 8,2İstismar yok

    5 gün önce

  • GHSA-6vfx-w7q3-42gq
    32İzleyin

    AdminNeo SQLite Database-List Drop Arbitrary File Deletion

    YüksekCVSS 8,1İstismar yok

    5 gün önce

  • GHSA-mmq5-xm89-9pfg
    30İzleyin

    imgproxy has unbounded memory allocation in ICO loader that allows unauthenticated memory-exhaustion DoS via crafted data_size field

    YüksekCVSS 7,5İstismar yok

    5 gün önce

  • GHSA-494m-4556-wf5p
    30İzleyin

    imgproxy has out-of-bounds heap read/write in ICO loader BMP header reconstruction that allows unauthenticated remote worker crash

    YüksekCVSS 7,5İstismar yok

    5 gün önce

  • GHSA-hff9-5pqw-6w9f
    39İzleyin

    imgproxy has integer overflow in imgproxy ICO loader that causes denial of service and may permit remote code execution

    KritikCVSS 9,8İstismar yok

    5 gün önce

  • GHSA-4xm8-rg9h-jhq2
    39İzleyin

    Signal K resources API path traversal can disclose the JWT signing secret and enable remote code execution

    KritikCVSS 9,8İstismar yok

    5 gün önce

  • CVE-2026-63338
    33İzleyin

    IXP Manager has Broken Object-Level Authorization

    YüksekCVSS 8,3İstismar yokEPSS %0

    inex · ixp-manager5 gün önce

  • CVE-2026-63339
    35İzleyin

    IXP Manager has authenticated non-administrator privilege escalation

    YüksekCVSS 8,8İstismar yokEPSS %0

    inex · ixp-manager5 gün önce

  • CVE-2026-63341
    30İzleyin

    Aedes has Uncaught Exception and Uncontrolled Resource Consumption

    YüksekCVSS 7,5İstismar yokEPSS %0

    moscajs · aedes5 gün önce

  • CVE-2026-63344
    34İzleyin

    Refitter: C# source injection through OpenAPI content-type map keys

    YüksekCVSS 8,6İstismar yokEPSS %0

    christianhelle · refitter5 gün önce

  • CVE-2026-63345
    34İzleyin

    Refitter: C# source injection through OpenAPI path keys

    YüksekCVSS 8,6İstismar yokEPSS %0

    christianhelle · refitter5 gün önce

  • CVE-2026-63346
    34İzleyin

    Refitter: C# source injection through OpenAPI header parameter names

    YüksekCVSS 8,6İstismar yokEPSS %0

    christianhelle · refitter5 gün önce

  • CVE-2026-63377
    39İzleyin

    TAKO AI Agent for Okta: Unauthenticated first-run administrator takeover

    KritikCVSS 9,8İstismar yokEPSS %0

    fctr-id · okta-ai-agent5 gün önce

  • CVE-2026-63378
    35İzleyin

    TAKO AI Agent for Okta: Authenticated Python execution through validator bypass

    YüksekCVSS 8,8İstismar yokEPSS %0

    fctr-id · okta-ai-agent5 gün önce

  • CVE-2026-63393
    34İzleyin

    OpenSearch SQL plugin: Unsafe cursor deserialization permits server code execution

    YüksekCVSS 8,7İstismar yokEPSS %0

    opensearch-project · sql5 gün önce

  • CVE-2026-63396
    34İzleyin

    Coop has a data leak via unauthenticated GraphQL Query.allOrgs

    YüksekCVSS 8,7İstismar yokEPSS %0

    roostorg · coop5 gün önce

  • CVE-2026-63398
    29İzleyin

    Coop has SAML cross-tenant authentication bypass

    YüksekCVSS 7,4İstismar yokEPSS %0

    roostorg · coop5 gün önce

  • CVE-2026-63414
    30İzleyin

    Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps

    YüksekCVSS 7,6İstismar yokEPSS %0

    shopify · shopify_app5 gün önce

  • CVE-2026-117656
    37İzleyin

    Acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the Sign in with Apple strategy in pow-auth Assent allows an unau

    KritikCVSS 9,3İstismar yokEPSS %0

    5 gün önce

  • CVE-2026-110176
    34İzleyin

    File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers

    YüksekCVSS 8,7İstismar yokEPSS %0

    drupal · file force download5 gün önce

  • CVE-2026-116755
    29İzleyin

    SoftIron HyperCloud: OS Command Injection in Orchestrator via Virtual Machine Template Fields

    YüksekCVSS 7,4İstismar yokEPSS %0

    softiron · hypercloud5 gün önce

  • CVE-2026-109234
    28İzleyin

    Meow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization

    YüksekCVSS 7,2İstismar yokEPSS %0

    tigroumeow · meow lightbox4 gün önce

  • CVE-2026-109997
    28İzleyin

    Ninja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalization

    YüksekCVSS 7,2İstismar yokEPSS %0

    kstover · ninja forms – contact form builder with calculators, quizzes, signatures & ai form builder4 gün önce

  • CVE-2026-116520
    28İzleyin

    PPWP <= 1.9.26 - Unauthenticated Stored Cross-Site Scripting via '[ppwp]' Shortcode 'desc_below_form' Attribute via Placeholder Marker Collision

    YüksekCVSS 7,2İstismar yokEPSS %0

    buildwps · ppwp – password protect pages4 gün önce

  • CVE-2026-118043
    28İzleyin

    Bulk Media Register < 2.01 - Author+ Arbitrary File Move via Path Traversal

    YüksekCVSS 7,2İstismar yokEPSS %0

    unknown · bulk media register4 gün önce

  • CVE-2026-118185
    30İzleyin

    Security Optimizer < 1.6.9 - 2FA Bypass via Missing Rate Limiting

    YüksekCVSS 7,5İstismar yokEPSS %0

    unknown · security optimizer4 gün önce

  • CVE-2026-118638
    30İzleyin

    Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST Route

    YüksekCVSS 7,5İstismar yokEPSS %0

    unknown · mapster wp maps4 gün önce

  • CVE-2026-119977
    62Bu hafta

    WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution

    YüksekCVSS 8,1KEVSilahlaştırılmışEPSS %0

    wordpress · wordpress4 gün önce

  • CVE-2026-107653
    28İzleyin

    SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of sc-order-manual-instructions in Comments

    YüksekCVSS 7,2İstismar yokEPSS %0

    surecart · surecart – ecommerce made easy for selling physical products, digital downloads, subscriptions, donations, & payments4 gün önce

  • CVE-2026-107750
    28İzleyin

    PDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company / Customer Not

    YüksekCVSS 7,2İstismar yokEPSS %0

    wpovernight · pdf invoices & packing slips for woocommerce4 gün önce

  • CVE-2026-109220
    39İzleyin

    PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via 'customer_note' Checko

    KritikCVSS 9,8İstismar yokEPSS %0

    addonsorg · pdf invoice for woocommerce + drag and drop template builder4 gün önce

  • CVE-2026-111254
    28İzleyin

    W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry

    YüksekCVSS 7,2İstismar yokEPSS %0

    boldgrid · w3 total cache4 gün önce

  • CVE-2026-115840
    28İzleyin

    VikRentCar Car Rental Management System <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via 'poplink' Parameter

    YüksekCVSS 7,2İstismar yokEPSS %0

    e4jvikwp · vikrentcar car rental management system4 gün önce

  • CVE-2026-116522
    28İzleyin

    Relevanssi <= 4.28.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Late Entity Decode

    YüksekCVSS 7,2İstismar yokEPSS %0

    comesio · relevanssi – a better search4 gün önce

  • CVE-2026-116548
    28İzleyin

    VikRentCar Car Rental Management System <= 1.4.10 - Unauthenticated Stored Cross-Site Scripting via 'optionals' Parameter

    YüksekCVSS 7,2İstismar yokEPSS %0

    e4jvikwp · vikrentcar car rental management system4 gün önce

  • CVE-2026-116557
    36İzleyin

    WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action

    KritikCVSS 9,1İstismar yokEPSS %0

    murgroland · wp booking system – booking calendar4 gün önce

  • CVE-2026-118070
    28İzleyin

    Welcart e-Commerce <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter

    YüksekCVSS 7,2İstismar yokEPSS %0

    uscnanbu · welcart e-commerce4 gün önce

  • CVE-2026-119065
    28İzleyin

    Shipping Zones by Drawing for WooCommerce <= 3.3.0 - Unauthenticated Stored Cross-Site Scripting via 'szbd-picked' Checkout Parameter

    YüksekCVSS 7,2İstismar yokEPSS %0

    arosoft · shipping zones by drawing for woocommerce4 gün önce

  • CVE-2026-119089
    28İzleyin

    ThirstyAffiliates <= 3.12.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <ta> Tag

    YüksekCVSS 7,2İstismar yokEPSS %0

    supercleanse · thirstyaffiliates – affiliate links, link branding, link tracking & marketing plugin4 gün önce

  • CVE-2026-119162
    28İzleyin

    User Submitted Posts <= 20260916 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user-submitted-content' Parameter via Block-Comment Shortcode Spli

    YüksekCVSS 7,2İstismar yokEPSS %0

    specialk · user submitted posts – enable users to submit posts from the front end4 gün önce

  • CVE-2026-119163
    30İzleyin

    FunnelKit Automations <= 3.8.5.2 - Unauthenticated SQL Injection via 'bwfan_cart_id' Parameter

    YüksekCVSS 7,5İstismar yokEPSS %0

    teamfunnelkit · funnelkit automations – email marketing automation and crm for wordpress & woocommerce4 gün önce

  • CVE-2026-120040
    30İzleyin

    Mail logging & Catcher <= 2.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure to Privilege Escalation to Mail Log Viewer / Password-Reset Email D

    YüksekCVSS 7,5İstismar yokEPSS %0

    wardee · mail logging & catcher4 gün önce

  • CVE-2026-89270
    36İzleyin

    Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters

    KritikCVSS 9,1İstismar yokEPSS %0

    popupbuilder · popup builder – create highly converting, mobile friendly marketing popups.4 gün önce

  • CVE-2026-103898
    32İzleyin

    Wp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callback

    YüksekCVSS 8,1İstismar yokEPSS %0

    roxnor · wp social login and register social counter4 gün önce

  • CVE-2026-104012
    35İzleyin

    Rox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpoint

    YüksekCVSS 8,8İstismar yokEPSS %0

    roxnor · rox appointment booking – event, calendar & appointment scheduling4 gün önce

  • CVE-2026-107759
    28İzleyin

    WPO365 | MICROSOFT 365 GRAPH MAILER <= 6.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject via wp_mail

    YüksekCVSS 7,2İstismar yokEPSS %0

    wpo365 · wpo365 | microsoft 365 graph mailer4 gün önce

  • CVE-2026-116512
    39İzleyin

    Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    wedevs · project manager – ai powered project management, task management, kanban board & time tracker4 gün önce

  • CVE-2026-118057
    28İzleyin

    Shield Security <= 22.3.2 - Unauthenticated Stored Cross-Site Scripting via Request Path (REQUEST_URI) in Traffic Log

    YüksekCVSS 7,2İstismar yokEPSS %0

    paultgoodchild · shield security – smart bot blocking, brute-force login protection & file scanning4 gün önce

  • CVE-2026-119096
    39İzleyin

    Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter

    KritikCVSS 9,8İstismar yokEPSS %0

    uncannyowl · uncanny toolkit for learndash4 gün önce

  • CVE-2026-120070
    35İzleyin

    User Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameter

    YüksekCVSS 8,8İstismar yokEPSS %0

    wedevs · user frontend – membership, user registration, user profile, user directory & content restriction with frontend post submission4 gün önce

  • CVE-2026-103882
    36İzleyin

    Acadlix LMS <= 1.1.9 - Unauthenticated Arbitrary File Deletion via 'delete_file_data.file_path' Parameter

    KritikCVSS 9,1İstismar yokEPSS %0

    acadlix · acadlix lms – ai quiz maker, online exam & course plugin for wordpress4 gün önce

  • CVE-2026-110530
    28İzleyin

    FeedWordPress <= 2026.0517 - Unauthenticated Stored Cross-Site Scripting via Syndicated Feed Content

    YüksekCVSS 7,2İstismar yokEPSS %0

    radgeek · feedwordpress4 gün önce

  • CVE-2026-114217
    34İzleyin

    Konflux-ci: github token plaintext exposure in ci/cd scripts

    YüksekCVSS 8,6İstismar yokEPSS %0

    4 gün önce

  • CVE-2026-116086
    35İzleyin

    Konflux-ci: jq filter injection in github workflow issue management

    YüksekCVSS 8,8İstismar yokEPSS %0

    4 gün önce

  • CVE-2026-116964
    33İzleyin

    Konflux-ci: remote code execution via eval() in manifest scripts

    YüksekCVSS 8,4İstismar yokEPSS %0

    4 gün önce

  • CVE-2026-117681
    32İzleyin

    Konflux-ci: ui proxy skips backend tls verification on non-openshift clusters, leaking a token that can impersonate anyone

    YüksekCVSS 8,0İstismar yokEPSS %0

    4 gün önce

  • CVE-2026-118235
    39İzleyin

    SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data

    KritikCVSS 9,8İstismar yokEPSS %0

    wpazleen · simpleform – form maker to chat apps with quiz, poll and multi lead notifications4 gün önce

  • CVE-2026-120075
    28İzleyin

    WP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting

    YüksekCVSS 7,2İstismar yokEPSS %0

    melapress · wp activity log4 gün önce

  • CVE-2026-109197
    30İzleyin

    WP Directory Kit <= 1.6.0 - Unauthenticated SQL Injection via 'idfield' Parameter

    YüksekCVSS 7,5İstismar yokEPSS %0

    wpdirectorykit · wp directory kit4 gün önce

  • CVE-2026-120114
    28İzleyin

    Debug Log Manager <= 2.5.2 - Unauthenticated Stored Cross-Site Scripting via 'log_js_errors' AJAX Endpoint

    YüksekCVSS 7,2İstismar yokEPSS %0

    qriouslad · debug log manager – conveniently monitor and inspect errors4 gün önce

  • CVE-2026-120194
    30İzleyin

    Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step

    YüksekCVSS 7,5İstismar yokEPSS %0

    red hat · red hat enterprise linux 104 gün önce

  • CVE-2026-76010
    35İzleyin

    Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment a

    YüksekCVSS 8,8İstismar yokEPSS %0

    smub · photo gallery, sliders, proofing and themes – nextgen gallery4 gün önce

  • RUSTSEC-2026-0434
    32İzleyin

    `ant-releases`: extracting a release archive can write files outside the destination directory (path traversal / zip-slip)

    YüksekCVSS 8,2İstismar yok

    4 gün önce

  • CVE-2026-102212
    33İzleyin

    Pre-Auth Heap Buffer Overflow in the Multipart Request

    YüksekCVSS 8,4İstismar yokEPSS %0

    opengear · im72004 gün önce

  • CVE-2026-120201
    37İzleyin

    Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header

    KritikCVSS 9,3İstismar yokEPSS %0

    dromara · jpom4 gün önce

  • CVE-2026-120202
    28İzleyin

    Highflame ramparts 0.8.1 through 0.8.10 Skill Bundle Scan Bypass via Nested .pyc

    YüksekCVSS 7,1İstismar yokEPSS %0

    highflame-ai · ramparts4 gün önce

  • CVE-2026-120203
    34İzleyin

    ShowDoc 2.8.14 before 3.9.6 Code Injection via Mock Templates

    YüksekCVSS 8,7İstismar yokEPSS %0

    showdoc · showdoc4 gün önce

  • CVE-2026-120205
    29İzleyin

    Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name

    YüksekCVSS 7,4İstismar yokEPSS %0

    thelia · thelia4 gün önce

  • CVE-2026-120207
    28İzleyin

    Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routes

    YüksekCVSS 7,0İstismar yokEPSS %0

    thelia · thelia page module4 gün önce

  • CVE-2026-120208
    30İzleyin

    libheif 1.18.0 before 1.23.3 Heap Buffer Overflow via unci Mixed-Interleave Decoder

    YüksekCVSS 7,7İstismar yokEPSS %0

    strukturag · libheif4 gün önce

  • CVE-2026-120209
    37İzleyin

    AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token

    KritikCVSS 9,3İstismar yokEPSS %0

    anji-plus · aj-report4 gün önce

  • CVE-2026-118147
    29İzleyin

    Visual Studio Spoofing Vulnerability

    YüksekCVSS 7,4İstismar yokEPSS %0

    microsoft · microsoft visual studio 2017 version 15.94 gün önce

  • CVE-2026-118636
    39İzleyin

    Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder

    KritikCVSS 9,8İstismar yokEPSS %0

    apache software foundation · apache mina4 gün önce

  • CVE-2026-120135
    32İzleyin

    Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default

    YüksekCVSS 8,2İstismar yokEPSS %0

    apache software foundation · apache thrift4 gün önce