İçeriğe atla
Noroxi

Yayın tarihine göre

Ekim 2026: sömürülen ve yeni ciddi CVE kayıtları

8.744 kayıt · 21 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 88 / 88

  • CVE-2026-116548
    28İzleyin

    VikRentCar Car Rental Management System <= 1.4.10 - Unauthenticated Stored Cross-Site Scripting via 'optionals' Parameter

    YüksekCVSS 7,2Kavram kanıtıEPSS %0

    e4jvikwp · vikrentcar car rental management system6 gün önce

  • CVE-2026-116557
    36İzleyin

    WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action

    KritikCVSS 9,1İstismar yokEPSS %0

    murgroland · wp booking system – booking calendar6 gün önce

  • CVE-2026-118070
    28İzleyin

    Welcart e-Commerce <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter

    YüksekCVSS 7,2İstismar yokEPSS %0

    uscnanbu · welcart e-commerce6 gün önce

  • CVE-2026-119065
    28İzleyin

    Shipping Zones by Drawing for WooCommerce <= 3.3.0 - Unauthenticated Stored Cross-Site Scripting via 'szbd-picked' Checkout Parameter

    YüksekCVSS 7,2İstismar yokEPSS %0

    arosoft · shipping zones by drawing for woocommerce6 gün önce

  • CVE-2026-119089
    28İzleyin

    ThirstyAffiliates <= 3.12.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <ta> Tag

    YüksekCVSS 7,2İstismar yokEPSS %0

    supercleanse · thirstyaffiliates – affiliate links, link branding, link tracking & marketing plugin6 gün önce

  • CVE-2026-119162
    28İzleyin

    User Submitted Posts <= 20260916 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user-submitted-content' Parameter via Block-Comment Shortcode Spli

    YüksekCVSS 7,2İstismar yokEPSS %0

    specialk · user submitted posts – enable users to submit posts from the front end6 gün önce

  • CVE-2026-119163
    30İzleyin

    FunnelKit Automations <= 3.8.5.2 - Unauthenticated SQL Injection via 'bwfan_cart_id' Parameter

    YüksekCVSS 7,5İstismar yokEPSS %0

    teamfunnelkit · funnelkit automations – email marketing automation and crm for wordpress & woocommerce6 gün önce

  • CVE-2026-120019
    21İzleyin

    W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholder

    OrtaCVSS 5,4Kavram kanıtıEPSS %0

    boldgrid · w3 total cache6 gün önce

  • CVE-2026-120040
    30İzleyin

    Mail logging & Catcher <= 2.2.0 - Authenticated (Subscriber+) Sensitive Information Exposure to Privilege Escalation to Mail Log Viewer / Password-Reset Email D

    YüksekCVSS 7,5İstismar yokEPSS %0

    wardee · mail logging & catcher6 gün önce

  • CVE-2026-89270
    36İzleyin

    Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters

    KritikCVSS 9,1İstismar yokEPSS %0

    popupbuilder · popup builder – create highly converting, mobile friendly marketing popups.6 gün önce

  • CVE-2026-103898
    32İzleyin

    Wp Social Login and Register Social Counter <= 3.2.2 - Unauthenticated Authentication Bypass via Insufficient Email Verification in Social Login Callback

    YüksekCVSS 8,1İstismar yokEPSS %0

    roxnor · wp social login and register social counter6 gün önce

  • CVE-2026-104012
    35İzleyin

    Rox Appointment Booking <= 1.3.1 - Unauthenticated Privilege Escalation via Mass Assignment to Mass Assignment via '/public/booking' Endpoint

    YüksekCVSS 8,8İstismar yokEPSS %0

    roxnor · rox appointment booking – event, calendar & appointment scheduling6 gün önce

  • CVE-2026-107759
    28İzleyin

    WPO365 | MICROSOFT 365 GRAPH MAILER <= 6.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject via wp_mail

    YüksekCVSS 7,2İstismar yokEPSS %0

    wpo365 · wpo365 | microsoft 365 graph mailer6 gün önce

  • CVE-2026-116512
    39İzleyin

    Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection

    KritikCVSS 9,8Kavram kanıtıEPSS %0

    wedevs · project manager – ai powered project management, task management, kanban board & time tracker6 gün önce

  • CVE-2026-118057
    28İzleyin

    Shield Security <= 22.3.2 - Unauthenticated Stored Cross-Site Scripting via Request Path (REQUEST_URI) in Traffic Log

    YüksekCVSS 7,2İstismar yokEPSS %0

    paultgoodchild · shield security – smart bot blocking, brute-force login protection & file scanning6 gün önce

  • CVE-2026-119096
    39İzleyin

    Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter

    KritikCVSS 9,8İstismar yokEPSS %0

    uncannyowl · uncanny toolkit for learndash6 gün önce

  • CVE-2026-120070
    35İzleyin

    User Frontend <= 4.3.13 - Authenticated (Subscriber+) Privilege Escalation via post_content Parameter

    YüksekCVSS 8,8İstismar yokEPSS %0

    wedevs · user frontend – membership, user registration, user profile, user directory & content restriction with frontend post submission6 gün önce

  • CVE-2026-103882
    36İzleyin

    Acadlix LMS <= 1.1.9 - Unauthenticated Arbitrary File Deletion via 'delete_file_data.file_path' Parameter

    KritikCVSS 9,1İstismar yokEPSS %0

    acadlix · acadlix lms – ai quiz maker, online exam & course plugin for wordpress6 gün önce

  • CVE-2026-110530
    28İzleyin

    FeedWordPress <= 2026.0517 - Unauthenticated Stored Cross-Site Scripting via Syndicated Feed Content

    YüksekCVSS 7,2İstismar yokEPSS %0

    radgeek · feedwordpress6 gün önce

  • CVE-2026-114217
    34İzleyin

    Konflux-ci: github token plaintext exposure in ci/cd scripts

    YüksekCVSS 8,6İstismar yokEPSS %0

    6 gün önce

  • CVE-2026-116086
    35İzleyin

    Konflux-ci: jq filter injection in github workflow issue management

    YüksekCVSS 8,8İstismar yokEPSS %0

    6 gün önce

  • CVE-2026-116964
    33İzleyin

    Konflux-ci: remote code execution via eval() in manifest scripts

    YüksekCVSS 8,4İstismar yokEPSS %0

    6 gün önce

  • CVE-2026-117681
    32İzleyin

    Konflux-ci: ui proxy skips backend tls verification on non-openshift clusters, leaking a token that can impersonate anyone

    YüksekCVSS 8,0İstismar yokEPSS %0

    6 gün önce

  • CVE-2026-118235
    39İzleyin

    SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data

    KritikCVSS 9,8İstismar yokEPSS %0

    wpazleen · simpleform – form maker to chat apps with quiz, poll and multi lead notifications6 gün önce

  • CVE-2026-120075
    28İzleyin

    WP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting

    YüksekCVSS 7,2İstismar yokEPSS %0

    melapress · wp activity log6 gün önce

  • CVE-2026-109197
    30İzleyin

    WP Directory Kit <= 1.6.0 - Unauthenticated SQL Injection via 'idfield' Parameter

    YüksekCVSS 7,5İstismar yokEPSS %0

    wpdirectorykit · wp directory kit6 gün önce

  • CVE-2026-120114
    28İzleyin

    Debug Log Manager <= 2.5.2 - Unauthenticated Stored Cross-Site Scripting via 'log_js_errors' AJAX Endpoint

    YüksekCVSS 7,2İstismar yokEPSS %0

    qriouslad · debug log manager – conveniently monitor and inspect errors6 gün önce

  • CVE-2026-120194
    30İzleyin

    Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step

    YüksekCVSS 7,5İstismar yokEPSS %0

    red hat · red hat enterprise linux 106 gün önce

  • CVE-2026-76010
    35İzleyin

    Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.4.1 - Authenticated (Custom+) Remote Code Execution via XML-RPC 'meta_data' Mass Assignment a

    YüksekCVSS 8,8İstismar yokEPSS %0

    smub · photo gallery, sliders, proofing and themes – nextgen gallery6 gün önce

  • RUSTSEC-2026-0434
    32İzleyin

    `ant-releases`: extracting a release archive can write files outside the destination directory (path traversal / zip-slip)

    YüksekCVSS 8,2İstismar yok

    6 gün önce

  • CVE-2026-78189
    39İzleyin

    WebDyne versions from 3.007 before 3.022 for Perl execute .psp files outside the document root via path traversal in the PSGI API route fallback

    KritikCVSS 9,8İstismar yokEPSS %0

    6 gün önce

  • CVE-2026-78191
    39İzleyin

    WebDyne versions from 2.031 before 3.022 for Perl execute files with .psp anywhere in the name as Perl pages

    KritikCVSS 9,8İstismar yokEPSS %0

    6 gün önce

  • CVE-2026-78192
    30İzleyin

    WebDyne versions from 2.022 before 3.022 for Perl disclose application source to unauthenticated clients via the viewer in the default index page

    YüksekCVSS 7,5İstismar yokEPSS %0

    6 gün önce

  • CVE-2026-102212
    33İzleyin

    Pre-Auth Heap Buffer Overflow in the Multipart Request

    YüksekCVSS 8,4İstismar yokEPSS %0

    opengear · im72006 gün önce

  • CVE-2026-120201
    38İzleyin

    Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header

    KritikCVSS 9,3Kavram kanıtıEPSS %2

    dromara · jpom6 gün önce

  • CVE-2026-120202
    28İzleyin

    Highflame ramparts 0.8.1 through 0.8.10 Skill Bundle Scan Bypass via Nested .pyc

    YüksekCVSS 7,1İstismar yokEPSS %0

    highflame-ai · ramparts6 gün önce

  • CVE-2026-120203
    34İzleyin

    ShowDoc 2.8.14 before 3.9.6 Code Injection via Mock Templates

    YüksekCVSS 8,7İstismar yokEPSS %0

    showdoc · showdoc6 gün önce

  • CVE-2026-120205
    29İzleyin

    Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name

    YüksekCVSS 7,4İstismar yokEPSS %0

    thelia · thelia6 gün önce

  • CVE-2026-120207
    28İzleyin

    Thelia Page Module before 2.0.4 CSRF via Page Tag, Document and Image Delete Routes

    YüksekCVSS 7,0İstismar yokEPSS %0

    thelia · thelia page module6 gün önce

  • CVE-2026-120208
    30İzleyin

    libheif 1.18.0 before 1.23.3 Heap Buffer Overflow via unci Mixed-Interleave Decoder

    YüksekCVSS 7,7İstismar yokEPSS %0

    strukturag · libheif6 gün önce

  • CVE-2026-120209
    37İzleyin

    AJ-Report through 1.7.1 Authentication Bypass leading to RCE via Share-Token

    KritikCVSS 9,3Kavram kanıtıEPSS %0

    anji-plus · aj-report6 gün önce

  • CVE-2026-118147
    29İzleyin

    Visual Studio Spoofing Vulnerability

    YüksekCVSS 7,4İstismar yokEPSS %0

    microsoft · microsoft visual studio 2017 version 15.96 gün önce

  • CVE-2026-118636
    39İzleyin

    Apache MINA: Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder

    KritikCVSS 9,8İstismar yokEPSS %0

    apache software foundation · apache mina6 gün önce

  • CVE-2026-120135
    32İzleyin

    Apache Thrift: Java TProtocolUtil.skip() does not limit the recursion depth by default

    YüksekCVSS 8,2İstismar yokEPSS %0

    apache software foundation · apache thrift6 gün önce