Kasım 2026: sömürülen ve yeni ciddi CVE kayıtları

A vulnerability in OpenText OpenText Directory Services (OTDS) allows Black Box Reverse Engineering.

opentext · opentext directory services (otds)6 gün önce

In HPE Cray Programming Environment versions 25.03 and 25.09, prior to 26.03, the method that CPE is deployed on HPCM potentially allows ele

• Yerel yetki yükseltme

hewlett packard enterprise (hpe) · hpe cray programming environment6 gün önce

OpenEMR FaxSMS module: insecure staging of decrypted patient documents in webroot

• Kimlik doğrulamasız
• Bilgi sızıntısı

open-emr · openemr6 gün önce

Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read

• Kimlik doğrulamasız
• Yol geçişi

vitali87 · code-graph-rag6 gün önce

Pillow: Memory disclosure and segfault in libtiff encoder via crafted TIFF tags

• Kimlik doğrulamasız

python · pillow6 gün önce

Black: GitHub Action installs unvalidated required-version from pyproject.toml

psf · black6 gün önce

GraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments

• Kimlik doğrulamasız
• Prototype pollution

ardatan · graphql-tools6 gün önce

Wails: wildcardPatternToRegex allows Origin bypass via suffix match in BindingsAllowedOrigins

• Kimlik doğrulamasız

wailsapp · wails6 gün önce

dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS

• Kimlik doğrulamasız

dcmjs-org · dcmjs6 gün önce

MONAI: MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)

• Kimlik doğrulamasız

project-monai · monai6 gün önce

OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow

• Kimlik doğrulama atlatma

oauthlib · oauthlib6 gün önce

Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder

• Kimlik doğrulamasız
• Hizmet dışı bırakma

bishopfox · sliver6 gün önce

Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401)

• RCE

jhuckaby · cronicle6 gün önce

Code Graph RAG structural tools follow out-of-root symlinks

• Yol geçişi

vitali87 · code-graph-rag6 gün önce

A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma
• Gömülü kimlik bilgisi

tpc software · matchpoint6 gün önce

Insecure direct object reference (IDOR) vulnerability in the MatchPoint API

• Kimlik doğrulamasız
• Erişim denetimi (IDOR)

tpc software · matchpoint6 gün önce

SQL injection in the push notification handler of the MatchPoint Android app

• SQL enjeksiyonu

tpc software · matchpoint6 gün önce

Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

tpc software · matchpoint6 gün önce

Incorrect validation of TLS certificates in the MatchPoint Android app

• Kimlik doğrulamasız
• Zayıf kripto

tpc software · matchpoint6 gün önce

Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation

• Kimlik doğrulamasız
• Hizmet dışı bırakma

modelcontextprotocol · typescript-sdk6 gün önce

Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another

• Kimlik doğrulamasız
• Yarış durumu

modelcontextprotocol · typescript-sdk6 gün önce

BTCPay Server < 2.4.2 LND Macaroon Credential File Disclosure

• Kimlik doğrulamasız
• Bilgi sızıntısı

btcpay server · btcpay server6 gün önce

MinIO Signature V4 verification before RELEASE.2026-09-22T19-25-18Z accepts unsigned x-amz-* headers, letting a presigned PUT URL be escalat

• Kimlik doğrulamasız
• Zayıf kripto

chainguard · minio6 gün önce

Dolibarr: SQL Injection in societe/class/societe.class.php via localtax1_value parameter

• SQL enjeksiyonu

dolibarr · dolibarr6 gün önce

Rucio: Authorisation Bypass on REST API endpoint for signing URLs

• Erişim denetimi (IDOR)

rucio · rucio6 gün önce

AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command execution

• RCE
• Komut enjeksiyonu

ag2ai · ag26 gün önce

Kubeflow Pipelines API server lacks authorization for shared pipeline uploads

• Erişim denetimi (IDOR)

kubeflow · pipelines6 gün önce

Kubeflow Pipelines: Unauthenticated server-side request forgery in the frontend http/https artifact source via decimal-IP bypass of the bucket validator

• Kimlik doğrulamasız
• SSRF

kubeflow · pipelines6 gün önce

Kubeflow Pipelines: Unauthenticated SSRF through artifact provider endpoints

• Kimlik doğrulamasız
• SSRF

kubeflow · pipelines6 gün önce

Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines

• Erişim denetimi (IDOR)

kubeflow · pipelines6 gün önce

FastNetMon: IPv6 Fragment header dereferenced without bounds check in shared packet parser

• Kimlik doğrulamasız
• Bellek hatası

pavel-odintsov · fastnetmon6 gün önce

FastNetMon: Legacy pcap parse_packet() has no bounds checking, causing out-of-bounds read on truncated frames

• Kimlik doğrulamasız
• Bellek hatası

pavel-odintsov · fastnetmon6 gün önce

FastNetMon: NetFlow v9 unbounded strlen() on interface-description field causes remote out-of-bounds read

• Kimlik doğrulamasız
• Bellek hatası
• Hizmet dışı bırakma

pavel-odintsov · fastnetmon6 gün önce

FastNetMon: sFlow header_size field trusted as parser capture length causes remote out-of-bounds read

• Kimlik doğrulamasız
• Bellek hatası

pavel-odintsov · fastnetmon6 gün önce

FastNetMon: NetFlow/IPFIX template cache returns unlocked pointers, causing heap-use-after-free on multi-port deployments

• Kimlik doğrulamasız
• Bellek hatası
• Hizmet dışı bırakma

pavel-odintsov · fastnetmon6 gün önce

FTS3 Web Monitoring 3.12.0 through 3.13.2 and 3.14.0 SQL Injection via /linkinfo

• Kimlik doğrulamasız
• SQL enjeksiyonu

cern-fts · fts-monitoring5 gün önce

Subnet Solutions PowerSYSTEM Center Incorrect Authorization

• Erişim denetimi (IDOR)

subnet solutions · powersystem center 20205 gün önce

Subnet Solutions PowerSYSTEM Center SQL Injection

• SQL enjeksiyonu

subnet solutions · powersystem center 20245 gün önce

Regexp2: Unbounded memory amplification via large `{m}` quantifier on a zero-width subexpression

• Kimlik doğrulamasız
• Hizmet dışı bırakma

dlclark · regexp25 gün önce

Server-Side Request Forgery in Foxit Workspace File Upload

• SSRF

foxit software inc. · foxit workspace5 gün önce

Foxit Workspace Stored XSS in shared artifacts

• XSS

foxit software inc. · foxit workspace5 gün önce

Server-Side Request Forgery in Foxit Workspace PDF Export

• SSRF

foxit software inc. · foxit workspace5 gün önce

MCB Stats <= 1.0.0 - Unauthenticated Stored XSS via User-Agent

• Kimlik doğrulamasız
• XSS

unknown · mcb5 gün önce

Mail Mage <= 0.0.25 - Unauthenticated SQLi via 'ewp_unsubscribe' Parameter

• Kimlik doğrulamasız
• SQL enjeksiyonu

unknown · mail mage5 gün önce

Advanced Custom Fields (ACF®) < 6.8.11 - Unauthenticated Stored XSS via HTML Attribute Name Injection

• Kimlik doğrulamasız
• XSS

unknown · advanced custom fields (acf®)5 gün önce

Wurdey <= 1.0.0 - Unauthenticated Administrator Authentication Bypass

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

unknown · wurdey5 gün önce

Real Estate Website Builder <= 1.4.3 - Unauthenticated Account Takeover via User Email Update

• Kimlik doğrulamasız

unknown · placester5 gün önce

GS JWT Authentication <= 1.0.0 - Unauthenticated Privilege Escalation via SQLi

• Kimlik doğrulamasız
• SQL enjeksiyonu

unknown · gs jwt authentication for wp rest api5 gün önce

WHIZZ <= 1.1.8 - Unauthenticated Arbitrary User Password Reset

• Kimlik doğrulamasız

unknown · whizz5 gün önce

Anti-Spam by CleanTalk < 6.91 - Unauthenticated Stored XSS via Comment Author Email

• Kimlik doğrulamasız
• XSS

unknown · anti-spam, spam firewall by cleantalk5 gün önce

Static Snapshot <= 0.2.1 - Unauthenticated RCE via 'name' Parameter

• Girişsiz RCE

unknown · static snapshot5 gün önce

Ever Accounting < 2.3.3 - Accounting Manager+ Arbitrary File Deletion via CSV Import

• Yol geçişi

unknown · ever accounting5 gün önce

All-in-One Video Gallery < 5.1.0 - Subscriber+ Stored XSS via 'image' Post Meta

• XSS

unknown · all-in-one video gallery5 gün önce

iubenda < 3.13.7 - Unauthenticated Stored XSS via Cookie Block HTML Parser

• Kimlik doğrulamasız
• XSS

unknown · iubenda | all-in-one compliance for gdpr / ccpa cookie consent + more5 gün önce

Cool Media Filter <= 1.0.1 - Subscriber+ Privilege Escalation via role_permission

unknown · cool media filter5 gün önce

Distributed-workloads: github actions pinned by mutable tag/branch, including third-party snyk/actions/setup@master

• Kimlik doğrulamasız

red hat · red hat openshift ai (rhoai)5 gün önce

WP Libre Form 1.5.0.1 - Unauthenticated RCE via Arbitrary File Upload

• Girişsiz RCE
• Dosya yükleme

unknown · wp libre form5 gün önce

WordPress Pie Register plugin <= 3.8.4.15 - Cross Site Scripting (XSS) vulnerability

• Kimlik doğrulamasız
• XSS

shamim rajani · pie register5 gün önce

WordPress FloristPress plugin <= 7.8.4 - Sensitive Data Exposure vulnerability

• Kimlik doğrulamasız

bakkbone australia · floristpress5 gün önce

WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - PHP Object Injection vulnerability

• Kimlik doğrulamasız
• Deserializasyon

mamunur rashid · radius booking — booking calendar for appointments &amp; services5 gün önce

WordPress OAuth Single Sign On – SSO (OAuth Client) plugin <= 7.1.3 - Privilege Escalation vulnerability

• Kimlik doğrulamasız

miniorange · oauth single sign on – sso (oauth client)5 gün önce

HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic time

• Kimlik doğrulamasız
• Hizmet dışı bırakma

5 gün önce

A vulnerability has been identified in armeria-saml versions prior to 1.43.0, where the HTTP-Redirect binding decoder decompresses attacker-

• Kimlik doğrulamasız

ly corporation · armeria5 gün önce

A vulnerability has been identified in armeria versions prior to 1.43.0, where inconsistent request path normalization can allow unauthentic

• Kimlik doğrulamasız

ly corporation · armeria5 gün önce

A vulnerability has been identified in armeria versions prior to 1.43.0, where processing malformed Thrift messages can cause excessive memo

• Kimlik doğrulamasız

ly corporation · armeria5 gün önce

WordPress WCFM Membership plugin <= 2.12.0 - Cross Site Scripting (XSS) vulnerability

• Kimlik doğrulamasız
• XSS

wc lovers · wcfm membership5 gün önce

MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Account Takeover via IDOR

• Erişim denetimi (IDOR)

unknown · mdjm event management5 gün önce

MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Role Deletion

• Kimlik doğrulamasız
• Erişim denetimi (IDOR)

unknown · mdjm event management5 gün önce

MDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Subscriber+ Stored XSS via Role Creation

• XSS

unknown · mdjm event management5 gün önce

Graphina <= 3.1.13 - Unauthenticated Stored Cross-Site Scripting via Tree Chart Widget Settings

• Kimlik doğrulamasız
• XSS

iqonicdesign · graphina – charts and graphs for elementor5 gün önce

Brute-forceable image-share link password in INFINITT ULite

• Kimlik doğrulamasız

infinitt healthcare · infinitt ulite5 gün önce

MDTF <= 1.4.1 - Unauthenticated Stored Cross-Site Scripting via 'vars' Parameter

• Kimlik doğrulamasız
• XSS

realmag777 · mdtf – meta data and taxonomies filter5 gün önce

undici vulnerable to cache poisoning and cross-user disclosure via intermediate redirect hops

• Kimlik doğrulamasız

undici · undici5 gün önce

SQL injection in Atmira’s SIREC

• SQL enjeksiyonu

atmira · sirec5 gün önce

Dashboard snapshot permission bypass

• Erişim denetimi (IDOR)

grafana · grafana oss5 gün önce

Product Feed Manager for WooCommerce <= 8.0.26 - Authenticated (Shop Manager+) PHP Code Injection via eval() via 'feedConfigCustom2' Parameter

• RCE

wahid0003 · product feed manager for woocommerce – ctx feed – support 220+ shopping, ai & social channels5 gün önce

Unbounded decoded HTTP/2 header-list size in cowlib cow_http2_machine enables HPACK amplification memory exhaustion

• Kimlik doğrulamasız
• Hizmet dışı bırakma

ninenines · cowlib5 gün önce

Cowboy HTTP/1.1 Unbounded Buffering of Pipelined Data During Request Handling Enables Memory Exhaustion

• Kimlik doğrulamasız
• Hizmet dışı bırakma

ninenines · cowboy5 gün önce

In JetBrains CLion before 2026.3, 2026.2.4.1 code execution was possible in Safe Mode via a crafted GDB server debug profile

jetbrains · clion5 gün önce

In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators

• Erişim denetimi (IDOR)

jetbrains · datalore5 gün önce

In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports

• Kimlik doğrulamasız
• Erişim denetimi (IDOR)

jetbrains · datalore5 gün önce

In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker

jetbrains · datalore5 gün önce

In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session

• Kimlik doğrulamasız

jetbrains · datalore5 gün önce

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 code execution was possible in untrusted projects via the Terraform tool path setting

jetbrains · intellij idea5 gün önce

In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow

jetbrains · hub5 gün önce

In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint

• Erişim denetimi (IDOR)

jetbrains · hub5 gün önce

In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible

• Erişim denetimi (IDOR)

jetbrains · hub5 gün önce

In JetBrains IntelliJ IDEA before 2026.3 dOM-based XSS in the OpenAPI preview error view was possible

• Kimlik doğrulamasız
• XSS

jetbrains · intellij idea5 gün önce

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4, 2026.1.5.1, 2025.3.6.2 code execution was possible in untrusted projects via script e

jetbrains · intellij idea5 gün önce

In JetBrains IntelliJ IDEA before 2026.3 code execution in untrusted projects via a configured ShellCheck path

jetbrains · intellij idea5 gün önce

In JetBrains IntelliJ IDEA before 2026.3 path traversal was possible via unpacking Dev Container archives from a remote host

• Kimlik doğrulamasız
• Yol geçişi

jetbrains · intellij idea5 gün önce

In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runs

• Kimlik doğrulamasız
• Zayıf kripto

jetbrains · intellij idea5 gün önce

In JetBrains Junie CLI before 26.8.24 command execution was possible via the Allow Similar Commands option

• RCE

jetbrains · junie cli5 gün önce

In JetBrains Ktor before 3.6.1 session forgery was possible via tampered encrypted session cookies

jetbrains · ktor5 gün önce

In JetBrains WebStorm before 2026.3, 2026.2.3 code execution via Grunt and Gulp task loading was possible in untrusted projects

jetbrains · webstorm5 gün önce

In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation in the app widget host allowed apps to send

• Erişim denetimi (IDOR)

jetbrains · youtrack5 gün önce

In JetBrains YouTrack before 2026.2.19562 information disclosure via shared mailbox message history was possible

• Erişim denetimi (IDOR)

jetbrains · youtrack5 gün önce

In JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 inclusion of untrusted remote code was possible via the plugin sand

• Kimlik doğrulamasız

jetbrains · youtrack5 gün önce

In JetBrains YouTrack before 2026.2.19197 incorrect authorisation in the scripts debugger allowed workflow script disclosure and suspension

• Erişim denetimi (IDOR)

jetbrains · youtrack5 gün önce

In JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint allowed disclosure of issue descriptions

• Kimlik doğrulamasız
• Erişim denetimi (IDOR)

jetbrains · youtrack5 gün önce