İçeriğe atla
Noroxi

Yayın tarihine göre

Kasım 2026: sömürülen ve yeni ciddi CVE kayıtları

3.408 kayıt · 10 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 18 / 35

  • CVE-2026-113363
    37İzleyin

    Improper Input Validation in the network communication processing in NEC Corporation WebSAM WinShare Ver 7.2.0 through 7.5.0, Ver 7.6.0 and

    KritikCVSS 9,3İstismar yokEPSS %1

    nec corporation · websam winshare2 gün önce

  • CVE-2026-113364
    37İzleyin

    Buffer Overflow in the data receiving process in NEC Corporation WebSAM WinShare Ver 7.5.0 and earlier, Ver 7.6.0 and Ver 7.7.0 through 7.7.

    KritikCVSS 9,3İstismar yokEPSS %0

    nec corporation · websam winshare2 gün önce

  • CVE-2026-115204
    35İzleyin

    AZEXO Store Locator <= 1.4 - Subscriber+ Arbitrary File Write via azt_items_import

    YüksekCVSS 8,8İstismar yokEPSS %0

    unknown · azexo store locator2 gün önce

  • CVE-2026-115212
    35İzleyin

    mView <= 1.0.3 - Subscriber+ Arbitrary File Upload

    YüksekCVSS 8,8İstismar yokEPSS %0

    unknown · mview 豆瓣电影2 gün önce

  • CVE-2026-115213
    39İzleyin

    EASY-JS-WPAPI <= 2.0 - Unauthenticated Administrator Password Disclosure and Authentication Bypass

    KritikCVSS 9,8İstismar yokEPSS %0

    unknown · easy-js-wpapi client handle for the wordpress rest-api2 gün önce

  • CVE-2026-115237
    39İzleyin

    Grand Job <= 1.2.1 - Unauthenticated Account Takeover via Empty Password Reset Code

    KritikCVSS 9,8İstismar yokEPSS %0

    unknown · grand job2 gün önce

  • CVE-2026-115256
    30İzleyin

    Mail Debug for WooCommerce <= 1.3.0 - Unauthenticated Sent Email Disclosure Leading to Account Takeover

    YüksekCVSS 7,5İstismar yokEPSS %0

    unknown · mail debug for woocommerce2 gün önce

  • CVE-2026-118201
    30İzleyin

    Limit Login Attempts Reloaded 3.0.0 - 3.4.0 - Two-Factor Authentication Bypass via XML-RPC

    YüksekCVSS 7,5İstismar yokEPSS %0

    unknown · limit login attempts security2 gün önce

  • CVE-2026-118202
    30İzleyin

    Limit Login Attempts Reloaded < 3.4.1 - Two-Factor Authentication Bypass via Malformed X-Forwarded-For Header

    YüksekCVSS 7,5İstismar yokEPSS %0

    unknown · limit login attempts security2 gün önce

  • CVE-2026-121874
    28İzleyin

    Post Duplicator < 3.0.18 - Admin+ Arbitrary Option Update via Unvalidated Option Name

    YüksekCVSS 7,2İstismar yokEPSS %0

    unknown · post duplicator2 gün önce

  • CVE-2026-121875
    28İzleyin

    Post Duplicator < 3.0.18 - Admin+ Privilege Escalation via Unvalidated Capability Assignment

    YüksekCVSS 7,2İstismar yokEPSS %0

    unknown · post duplicator2 gün önce

  • CVE-2026-123064
    35İzleyin

    WP BASE Booking of Appointments, Services and Events 6.5.0 - Subscriber+ Privilege Escalation

    YüksekCVSS 8,8İstismar yokEPSS %0

    unknown · wp base booking of appointments, services and events2 gün önce

  • CVE-2026-123091
    30İzleyin

    Vigilant < 2.11.0 - 2FA Bypass via Third-Party Login Forms

    YüksekCVSS 7,5İstismar yokEPSS %0

    unknown · vigilant2 gün önce

  • CVE-2026-123751
    39İzleyin

    WP Duplicate <= 1.1.11 - Unauthenticated Arbitrary File Upload via Authentication Bypass

    KritikCVSS 9,8İstismar yokEPSS %0

    unknown · wp duplicate2 gün önce

  • CVE-2026-124576
    27İzleyin

    BeikeShop Guest Order Lookup OrderRepo.php getOrderByNumber behavioral workflow

    OrtaCVSS 6,9Kavram kanıtıEPSS %0

    2 gün önce

  • CVE-2026-124577
    36İzleyin

    Intelbras SG 2404 PoE L2+ Web Management EXCU_SHELL improper authentication

    YüksekCVSS 8,9İstismar yokEPSS %2

    intelbras · sg 2404 poe l2+2 gün önce

  • CVE-2026-124580
    38İzleyin

    Chengdu Feiyuxing Technology VW2100/VEC10GP Weixin Auth Endpoint webserver handle_wechat_cn_wifi os command injection

    KritikCVSS 9,3İstismar yokEPSS %2

    chengdu feiyuxing technology · vw21002 gün önce

  • CVE-2026-123870
    38İzleyin

    [Eclipse CSI - otterdog] Unauthenticated remote code execution via eval() on format-string-injected webhook body when GITHUB_WEBHOOK_SECRET is unset

    KritikCVSS 9,5İstismar yokEPSS %0

    eclipse foundation · otterdog2 gün önce

  • CVE-2026-124585
    35İzleyin

    Chengdu Feiyuxing Technology VW2100/VEC10GP Web Administration webserver add_expmac os command injection

    YüksekCVSS 8,6İstismar yokEPSS %2

    chengdu feiyuxing technology · vw21002 gün önce

  • CVE-2026-92606
    24İzleyin

    TOCTOU Race Condition in TÜBİTAK BİLGEM's Pardus MyComputer

    OrtaCVSS 6,0Kavram kanıtıEPSS %0

    tübi̇tak bi̇lgem software technologies research institute · pardus mycomputer2 gün önce

  • CVE-2026-94249
    32İzleyin

    Missing Authorization in TÜBİTAK BİLGEM's Liderahenk

    YüksekCVSS 8,1İstismar yokEPSS %0

    tübi̇tak bi̇lgem software technologies research institute · liderahenk2 gün önce

  • CVE-2026-111403
    28İzleyin

    WordPress WP Inventory Manager plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    wp inventory · wp inventory manager2 gün önce

  • CVE-2026-111421
    35İzleyin

    Apache Airflow: Execution API: set_xcom skips the reserved-key check, so task-written XComs instantiate airflow.* classes on the API server

    YüksekCVSS 8,8İstismar yokEPSS %0

    apache software foundation · apache airflow2 gün önce

  • CVE-2026-119483
    28İzleyin

    WordPress Form Maker by 10Web plugin <= 1.15.50 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    10web · form maker by 10web2 gün önce

  • CVE-2026-119504
    28İzleyin

    WordPress Frontend Admin by DynamiApps plugin <= 3.30.1 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    dynamiapps · frontend admin by dynamiapps2 gün önce

  • CVE-2026-119505
    28İzleyin

    WordPress Welcart e-Commerce plugin <= 2.12.6 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    welcart · welcart e-commerce2 gün önce

  • CVE-2026-121760
    30İzleyin

    WordPress weDocs plugin <= 2.6.1 - Broken Access Control vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %0

    wedevs · wedocs2 gün önce

  • CVE-2026-121764
    28İzleyin

    WordPress FV Flowplayer Video Player plugin <= 7.5.56.7212 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    foliovision · fv flowplayer video player2 gün önce

  • CVE-2026-121780
    28İzleyin

    WordPress Flying Images plugin <= 2.4.15 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    gijo varghese · flying images2 gün önce

  • CVE-2026-123463
    28İzleyin

    WordPress Checkout Files Upload for WooCommerce plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    wp wham · checkout files upload for woocommerce2 gün önce

  • CVE-2026-123465
    30İzleyin

    WordPress myCred plugin <= 4.0.2 - Sensitive Data Exposure vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %0

    mycred · mycred2 gün önce

  • CVE-2026-123484
    28İzleyin

    WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    crocoblock · jetformbuilder2 gün önce

  • CVE-2026-54863
    28İzleyin

    WordPress Review Schema plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    mamunur rashid · review schema2 gün önce

  • CVE-2026-86829
    0İzleyin

    Apache Airflow: Deserialization of task-controlled XCom values in the Scheduler during dependency evaluation

    Kavram kanıtıEPSS %0

    apache software foundation · apache airflow2 gün önce

  • CVE-2026-92683
    34İzleyin

    Incomplete evaluation of multi-condition JWT where filter in @authentication in @neo4j/graphql

    YüksekCVSS 8,6İstismar yokEPSS %0

    neo4j · @neo4j/graphql2 gün önce

  • CVE-2026-106466
    30İzleyin

    JWT Auth <= 3.0.2 - Unauthenticated Account Access Persistence via Insufficient Refresh Token Revocation

    YüksekCVSS 7,5İstismar yokEPSS %0

    unknown · jwt auth2 gün önce

  • CVE-2026-115252
    40Planlayın

    Confection 0.4.0 - 0.4.7 - Unauthenticated RCE via Write Key Option

    KritikCVSS 10,0İstismar yokEPSS %0

    unknown · confection wordpress cable2 gün önce

  • CVE-2026-120367
    30İzleyin

    Apache Axis2/Java: unbounded JSON request body buffering

    YüksekCVSS 7,5İstismar yokEPSS %0

    apache software foundation · apache axis2/java2 gün önce

  • CVE-2026-121570
    28İzleyin

    WordPress RSVP and Event Management plugin <= 2.7.17 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    wp chill · rsvp and event management2 gün önce

  • CVE-2026-121722
    30İzleyin

    WordPress Formidable Forms Signature Online Contract Automation plugin <= 2.0.5 - Broken Access Control vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %0

    wp e-signature · formidable forms signature online contract automation2 gün önce

  • CVE-2026-121782
    28İzleyin

    WordPress If-So Dynamic Content Personalization plugin <= 1.10.3 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    if-so dynamic content · if-so dynamic content personalization2 gün önce

  • CVE-2026-122666
    28İzleyin

    WordPress Mang Board WP plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    kitae park · mang board wp2 gün önce

  • CVE-2026-123460
    28İzleyin

    WordPress WordPress File Upload plugin <= 5.2.2 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    nickboss · wordpress file upload2 gün önce

  • CVE-2026-123475
    30İzleyin

    WordPress MapSVG plugin <= 8.16.3 - Broken Access Control vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %0

    pt norther lights production · mapsvg2 gün önce

  • CVE-2026-123476
    28İzleyin

    WordPress Featured Image from URL plugin <= 6.1.4 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    fifu.app · featured image from url2 gün önce

  • CVE-2026-123753
    0İzleyin

    Apache Axis2/Java: SSRF via WS-Addressing ReplyTo and FaultTo endpoints

    Kavram kanıtıEPSS %0

    apache software foundation · apache axis2/java2 gün önce

  • CVE-2026-112172
    32İzleyin

    Unauthenticated SQL Execution in XDent/XMedical Synchronization Infrastructure

    YüksekCVSS 8,1İstismar yokEPSS %0

    compugroup medical · xdent2 gün önce

  • CVE-2026-118458
    32İzleyin

    AIS shared test login provider contains fixed administrative credentials

    YüksekCVSS 8,1İstismar yokEPSS %0

    compugroup medical · phronesis2 gün önce

  • CVE-2026-118460
    32İzleyin

    AIS embedded private keys enable practitioner impersonation

    YüksekCVSS 8,0İstismar yokEPSS %0

    compugroup medical · infantia2 gün önce

  • CVE-2026-118461
    32İzleyin

    AIS PersonnelService client performs unauthenticated doctor-specific operations

    YüksekCVSS 8,0İstismar yokEPSS %0

    compugroup medical · infantia2 gün önce

  • CVE-2026-118462
    36İzleyin

    AIS update mechanism executes unverified code

    KritikCVSS 9,2İstismar yokEPSS %0

    compugroup medical · infantia2 gün önce

  • CVE-2026-118468
    28İzleyin

    AIS XML parsers allow external entity resolution

    YüksekCVSS 7,2İstismar yokEPSS %0

    compugroup medical · infantia2 gün önce

  • CVE-2026-121629
    30İzleyin

    Gst-plugins-good: gst-plugins-good: local file disclosure via unvalidated file:// uris in adaptivedemux2 manifest handling

    YüksekCVSS 7,5İstismar yokEPSS %0

    red hat · red hat enterprise linux 102 gün önce

  • CVE-2026-110468
    40Planlayın

    Remote Code Execution via Unrestricted File Upload in WidzialniCMS

    KritikCVSS 10,0Kavram kanıtıEPSS %0

    fundacja widzialni · widzialnicms2 gün önce

  • CVE-2026-110469
    40Planlayın

    Remote Code Execution via Unrestricted File Upload in WidzialniCMS

    KritikCVSS 10,0İstismar yokEPSS %0

    fundacja widzialni · widzialnicms2 gün önce

  • CVE-2026-118790
    28İzleyin

    Multiple Hardcoded Credentials

    YüksekCVSS 7,2İstismar yokEPSS %0

    compugroup medical · wingesfar2 gün önce

  • CVE-2026-118791
    28İzleyin

    Insecure software update mechanism

    YüksekCVSS 7,2İstismar yokEPSS %0

    compugroup medical · wingesfar2 gün önce

  • CVE-2026-119610
    32İzleyin

    Gstreamer1-plugins-good: gstreamer1-plugins-good: out-of-bounds heap read in mtap16/mtap24 h.264 rtp depayloader via signed/unsigned underflow

    YüksekCVSS 8,2İstismar yokEPSS %0

    red hat · red hat enterprise linux 102 gün önce

  • CVE-2026-120854
    30İzleyin

    WordPress iubenda plugin <= 3.13.6 - Denial of Service Attack vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %0

    iubenda · iubenda2 gün önce

  • CVE-2026-120856
    28İzleyin

    WordPress Invoice Gateway for WooCommerce – Invoice Payment Gateway plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    rymera web co · invoice gateway for woocommerce – invoice payment gateway2 gün önce

  • CVE-2026-124079
    37İzleyin

    rConfig Core 8.0.0 before 8.2.19 and rConfig Pro before 8.4.1 RCE via Unauthenticated Redis Queue Poisoning

    KritikCVSS 9,3İstismar yokEPSS %0

    rconfig · rconfig core2 gün önce

  • CVE-2026-94434
    35İzleyin

    OS Command Injection Leading to Root Code Execution in TÜBİTAK BİLGEM's Pardus Boot Repair

    YüksekCVSS 8,8Kavram kanıtıEPSS %1

    tübi̇tak bi̇lgem software technologies research institute · pardus boot repair2 gün önce

  • CVE-2026-95648
    32İzleyin

    Privilege Escalation in C-Prot's C-Prot AppDefense

    YüksekCVSS 8,1İstismar yokEPSS %0

    c-prot inc. · c-prot appdefense2 gün önce

  • CVE-2026-121842
    35İzleyin

    Privilege escalation in the Reader View component in Firefox for iOS

    YüksekCVSS 8,8İstismar yokEPSS %0

    mozilla · firefox for ios2 gün önce

  • CVE-2026-121843
    35İzleyin

    Privilege escalation in Firefox for iOS

    YüksekCVSS 8,8İstismar yokEPSS %0

    mozilla · firefox for ios2 gün önce

  • CVE-2026-16283
    35İzleyin

    Command Injection in Osbil Technology's Ltd's oPanel

    YüksekCVSS 8,8İstismar yokEPSS %0

    osbil technology ltd.osbil technology ltd. · opanel2 gün önce

  • CVE-2026-95778
    35İzleyin

    A remote code execution vulnerability exists in HPE Morpheus Software.

    YüksekCVSS 8,8İstismar yokEPSS %0

    hewlett packard enterprise (hpe) · hpe morpheus software2 gün önce

  • CVE-2026-95779
    35İzleyin

    An exposure of the appliance’s confidential certificate information  vulnerability exists in HPE Morpheus manager software.

    YüksekCVSS 8,8İstismar yokEPSS %0

    hewlett packard enterprise (hpe) · hpe morpheus software2 gün önce

  • CVE-2026-104620
    34İzleyin

    PackageKit/ZYpp local privilege escalation using InstallFiles(SIMULATE)

    YüksekCVSS 8,5İstismar yokEPSS %0

    packagekit · packagekit2 gün önce

  • CVE-2026-119474
    31İzleyin

    Privilege Escalation in HAVELSAN's Liman Render Engine

    YüksekCVSS 7,8İstismar yokEPSS %0

    havelsan inc. · liman render engine2 gün önce

  • CVE-2026-124850
    29İzleyin

    SQL Injection in Database Migration via Stored Connector Identifiers in flowintel

    YüksekCVSS 7,3İstismar yokEPSS %0

    flowintel · flowintel2 gün önce

  • CVE-2025-10248
    28İzleyin

    XSS vulnerability in OpenText Filr

    YüksekCVSS 7,2İstismar yokEPSS %0

    opentext · filr2 gün önce

  • CVE-2026-103906
    31İzleyin

    Disabled TLS Certificate Validation Enables MITM Attacks

    YüksekCVSS 7,8İstismar yokEPSS %0

    am_automatic_machines · am_club2 gün önce

  • CVE-2026-104989
    37İzleyin

    Pre-authentication remote code execution in Chaos V-Ray Swarm

    KritikCVSS 9,3İstismar yokEPSS %0

    chaos software · v-ray swarm2 gün önce

  • CVE-2026-115338
    32İzleyin

    Insecure XFT Transport in Progress WS_FTP Server

    YüksekCVSS 8,1İstismar yokEPSS %0

    progress software · ws_ftp server2 gün önce

  • CVE-2026-115339
    30İzleyin

    Unauthenticated XFT Memory Exhaustion in Progress WS_FTP Server

    YüksekCVSS 7,5İstismar yokEPSS %0

    progress software · ws_ftp server2 gün önce

  • CVE-2026-115340
    28İzleyin

    Insecure Storage of Web Transfer Credentials in Progress WS_FTP Server

    YüksekCVSS 7,1İstismar yokEPSS %0

    progress software · ws_ftp server2 gün önce

  • CVE-2026-115341
    30İzleyin

    Unauthorized File Disclosure via Path Traversal in Thin Client Web Transfer in Progress WS_FTP Server

    YüksekCVSS 7,7İstismar yokEPSS %0

    progress software · ws_ftp server2 gün önce

  • CVE-2026-121576
    35İzleyin

    WordPress MCP Server for WordPress plugin <= 2.0.1 - Privilege Escalation vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %0

    atlasaidev · mcp server for wordpress2 gün önce

  • CVE-2026-122664
    28İzleyin

    WordPress Broadcast Live Video plugin <= 7.3.14 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    videowhisper.com · broadcast live video2 gün önce

  • CVE-2026-123482
    28İzleyin

    WordPress JetFormBuilder plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    crocoblock · jetformbuilder2 gün önce

  • CVE-2026-124683
    34İzleyin

    Eclipse Langium versions 3.2.0 through 4.4.0 contain an inefficient algorithmic complexity issue (CWE-407) in the opt-in IndentationAwareTok

    YüksekCVSS 8,7İstismar yokEPSS %0

    eclipse foundation · eclipse langium2 gün önce

  • CVE-2026-119755
    30İzleyin

    Tasmota 16.0.0 CSRF via Referer Header Validation Bypass

    YüksekCVSS 7,5İstismar yokEPSS %0

    arendst · tasmota2 gün önce

  • CVE-2026-119756
    37İzleyin

    Tasmota 16.0.0 Heap Out-of-Bounds Write via Device Groups UDP

    KritikCVSS 9,3İstismar yokEPSS %0

    arendst · tasmota2 gün önce

  • CVE-2026-123270
    39İzleyin

    Redpanda Connect versions 4.39 to 4.110 contain a missing authentication vulnerability that enables unauthenticated remote code execution (R

    KritikCVSS 9,8İstismar yokEPSS %0

    redpanda data · connect2 gün önce

  • CVE-2026-123367
    29İzleyin

    ThorVG: Heap buffer overflow (OOB write) in bundled jpgd JPEG decoder

    YüksekCVSS 7,4İstismar yokEPSS %0

    thorvg · thorvg2 gün önce

  • CVE-2026-123797
    30İzleyin

    SuperTokens Core: Unknown tenant path bypasses API key and public-tenant enforcement

    YüksekCVSS 7,5İstismar yokEPSS %0

    supertokens · supertokens-core2 gün önce

  • CVE-2026-19706
    33İzleyin

    Openshift/installer: openshift installer: unconditional csr approval during agent-based installation (abi) bootstrap

    YüksekCVSS 8,3İstismar yokEPSS %0

    red hat · assisted installer for red hat openshift container platform 22 gün önce

  • CVE-2026-112314
    30İzleyin

    Krb5: mit krb5 gss-rpc client memory leak on xid mismatch retries

    YüksekCVSS 7,5İstismar yokEPSS %0

    red hat · red hat enterprise linux 102 gün önce

  • CVE-2026-112320
    30İzleyin

    Krb5: mit krb5 kadmind unauthenticated memory leak dos via gss-rpc auth flavor switching

    YüksekCVSS 7,5İstismar yokEPSS %0

    red hat · red hat enterprise linux 102 gün önce

  • CVE-2026-112321
    30İzleyin

    Krb5: mit krb5 kadmind unauthenticated memory leak dos via auth_gssapi_init error paths

    YüksekCVSS 7,5İstismar yokEPSS %0

    red hat · red hat enterprise linux 102 gün önce

  • CVE-2026-112322
    30İzleyin

    Krb5: mit krb5 kadmind unauthenticated cpu dos via auth_gssapi client states cleanup

    YüksekCVSS 7,5İstismar yokEPSS %0

    red hat · red hat enterprise linux 102 gün önce

  • CVE-2026-112323
    30İzleyin

    Krb5: mit krb5 kadmind unauthenticated memory exhaustion via failed auth_gssapi_init requests

    YüksekCVSS 7,5İstismar yokEPSS %0

    red hat · red hat enterprise linux 102 gün önce

  • CVE-2026-119079
    30İzleyin

    Krb5: mit krb5 kdc unauthenticated cpu dos via quadratic asn.1 sequence of decoding

    YüksekCVSS 7,5İstismar yokEPSS %0

    red hat · red hat enterprise linux 102 gün önce

  • CVE-2026-120834
    29İzleyin

    WordPress WP2LEADS plugin <= 3.5.17 - Privilege Escalation vulnerability

    YüksekCVSS 7,3İstismar yokEPSS %0

    tobias · wp2leads2 gün önce

  • CVE-2026-121769
    34İzleyin

    WordPress WP w3all phpBB plugin <= 3.1.9 - SQL Injection vulnerability

    YüksekCVSS 8,5İstismar yokEPSS %0

    axew3.com · wp w3all phpbb2 gün önce

  • CVE-2026-123798
    32İzleyin

    SuperTokens Core: SAML XML Signature Wrapping authentication bypass — any IdP user can authenticate as any other user

    YüksekCVSS 8,1İstismar yokEPSS %0

    supertokens · supertokens-core2 gün önce

  • CVE-2026-123799
    29İzleyin

    SuperTokens Core: Dashboard session tokens are never checked for expiry: `isValidUserSession` ignores the stored `expiry`, so a long-expired admin session still

    YüksekCVSS 7,4İstismar yokEPSS %0

    supertokens · supertokens-core2 gün önce

  • CVE-2026-123800
    39İzleyin

    SuperTokens Core: App-scoped API key can overwrite the parent connection URI domain's credentials and take over sibling applications

    KritikCVSS 9,9İstismar yokEPSS %0

    supertokens · supertokens-core2 gün önce

  • CVE-2026-123801
    29İzleyin

    SuperTokens Core: SAML callback accepts a replayed RelayState + SAMLResponse, minting a fresh authorization code on each replay

    YüksekCVSS 7,4İstismar yokEPSS %0

    supertokens · supertokens-core2 gün önce