Kasım 2026: sömürülen ve yeni ciddi CVE kayıtları

Adobe Connect | Incorrect Authorization (CWE-863)

• Erişim denetimi (IDOR)

adobe · adobe connect1 gün önce

Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)

• XSS

adobe · adobe connect1 gün önce

The request-callout plugin in Kong Gateway Enterprise and Kong AI Gateway omits callout headers not sent by the client from its cache key, a

• Kimlik doğrulamasız

kong inc. · kong gateway enterprise1 gün önce

AsiaInfo Business Support System (BSS) Missing Authentication

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

asiainfo international · business support system1 gün önce

AsiaInfo Business Support System (BSS) Missing JWT Signature Verification

• Kimlik doğrulamasız
• Zayıf kripto

asiainfo international · business support system1 gün önce

Multiple OGNL Injection vulnerabilities

• XSS

n-able · n-central1 gün önce

Local privilege escalation to root via nable-writable syslog-ng config

n-able · n-central1 gün önce

Stored XSS via MMS3 patch metadata (admin context)

• XSS

n-able · n-central1 gün önce

Schema-hint SSRF via service import schema validation

• Kimlik doğrulamasız
• SSRF

n-able · n-central1 gün önce

RCE via file repository upload path traversal

• RCE
• Yol geçişi

n-able · n-central1 gün önce

Multiple XXE Vulnerabilities

• Kimlik doğrulamasız
• XXE

n-able · n-central1 gün önce

Root RCE via unsigned NSP upgrade package upload

• RCE

n-able · n-central1 gün önce

BeeS ERP administrative console IDOR

• Erişim denetimi (IDOR)

bees software solutions · erp1 gün önce

Active Storage: Possible arbitrary file read and remote code execution in Active Storage video previews, analysis and image processing

• RCE

rails · rails1 gün önce

Bluetooth Classic RFCOMM: integer underflow in the MCC TEST command handler leads to out-of-bounds read disclosed to the peer and out-of-bounds write

• Kimlik doğrulamasız
• Bellek hatası

zephyrproject · zephyr1 gün önce

Out-of-bounds write in Zephyr HTTP/2 server static-filesystem handler via corrupted receive-buffer length

• Kimlik doğrulamasız
• Bellek hatası

zephyrproject · zephyr1 gün önce

Basel Post Types <= 1.18 - Unauthenticated Authentication Bypass via Forged Opauth Callback Signature with Hardcoded Fallback Salt

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

xtemos · basel post types1 gün önce

Signed offset bypasses bounds check in simulated EEPROM driver, allowing out-of-bounds kernel memory read and write from user mode

• Bellek hatası

zephyrproject · zephyr1 gün önce

Insecure IPC Channels lead to local privilege escalation

• Kimlik doğrulama atlatma
• Yerel yetki yükseltme

n-able · n-central1 gün önce

The SAML plugin in Kong Gateway Enterprise does not enforce AudienceRestriction, allowing a valid assertion issued for another Service Provi

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

kong inc. · kong gateway enterprise1 gün önce

Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the X-Forwarded-Prefix header on regex

• Kimlik doğrulamasız

kong inc. · kong gateway enterprise1 gün önce

The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise omits the caller's identity from the cache key, allowing a response cache

• Kimlik doğrulamasız

kong inc. · kong gateway enterprise1 gün önce

The caching plugins in Kong Gateway Enterprise and Kong AI Gateway may serve a response cached for a request carrying an Authorization or Pr

• Kimlik doğrulamasız

kong inc. · kong gateway enterprise1 gün önce

The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway omit the request hostname from the cache key

• Kimlik doğrulamasız

kong inc. · kong gateway enterprise1 gün önce

The ai-azure-content-safety plugin in Kong Gateway Enterprise skips inspection of request bodies larger than the in-memory body buffer, allo

• Kimlik doğrulamasız

kong inc. · kong gateway enterprise1 gün önce

Insufficient verification of data authenticity may allow a local attacker to bypass Secure Debug Unlock (SDU), potentially resulting in unau

• Zayıf kripto

amd · amd epyc™ 7003 series processors1 gün önce

React: Unauthenticated Remote Code Execution in React Server Components

• Girişsiz RCE
• Deserializasyon

react · react1 gün önce

A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5, F

• Kimlik doğrulamasız
• Erişim denetimi (IDOR)

fortinet · fortimanager1 gün önce

Microsoft Security Advisory CVE-2026-105544 - .NET Elevation of Privilege Vulnerability

• Yerel yetki yükseltme
• Erişim denetimi (IDOR)

1 gün önce

LibreCAD through 2.2.1.6 Heap Out-of-Bounds Write via dwgReader18::parseDataPage

• Bellek hatası

librecad · librecadBugün

Jellyfin before 12.0 Path Traversal via Library VirtualFolders Endpoints

• Kimlik doğrulamasız
• Yol geçişi

jellyfin · jellyfinBugün

Directus before 12.1.0 Authorization Bypass via Public WebSocket REST Interface

• Kimlik doğrulamasız

directus · directusBugün

WWBN AVideo through 29.7.1 Missing Authorization via Live Restream Endpoints

• Erişim denetimi (IDOR)

wwbn · avideoBugün

WWBN AVideo 6.5 through 29.7.1 Authentication Bypass via Hybridauth Social Login

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

wwbn · avideoBugün

WWBN AVideo through 29.7.1 Wallet Credit Manipulation via PayPalYPT ipnV2.php

• Kimlik doğrulamasız

wwbn · avideoBugün

LimeSurvey Community Edition 7.8.0 - SQL injection via Archive Attributes

• SQL enjeksiyonu

limesurvey · limesurvey community editionBugün

Semantic MediaWiki 2.5.0 before 7.4.1 Missing Authorization via Is edit protected Annotation

• Erişim denetimi (IDOR)

semanticmediawiki · semanticmediawikiBugün

Semantic MediaWiki 7.3.1 before 7.4.1 Incorrect Authorization via Edit Protection Annotations

• Erişim denetimi (IDOR)

semanticmediawiki · semanticmediawikiBugün

Padloc 4.0.0 before 4.3.1 Prototype Pollution via SCIM PATCH setPath()

• Prototype pollution

padloc · padlocBugün

Bahmni-Core: Exfiltration of patient data stored in Bahmni through SQL injection through boolean blind and error based exfil

• SQL enjeksiyonu

bahmni · bahmni-coreBugün

Bahmni-Core: Path traversal may lead to arbitrary file write in the admin CSV import

• Kimlik doğrulamasız
• Yol geçişi

bahmni · bahmni-coreBugün

node-fontnik: integer-overflow heap out-of-bounds write in RenderSDF

• Bellek hatası

mapbox · node-fontnikBugün

Akaunting 3.3.0 - Stored XSS through imported item names

• XSS

akaunting · akauntingBugün

pam_usb: getenv() in pusb_local_login bypasses XRDP deny via env-var unset

mcdope · pam_usbBugün

pam_usb: deny_remote bypassed by zone-indexed IPv6 addresses (fe80::1%eth0) in pusb_tmux_has_remote_clients

• Kimlik doğrulamasız
• Erişim denetimi (IDOR)

mcdope · pam_usbBugün

pam_usb: deny_remote bypassed by compressed IPv6 addresses in pusb_tmux_has_remote_clients

• Kimlik doğrulamasız
• Erişim denetimi (IDOR)

mcdope · pam_usbBugün

Stored XSS in @waline/client via the unsanitized markdown preview of a comment's raw body on edit

• Kimlik doğrulamasız
• XSS

walinejs · walineBugün

Stored XSS in the @waline/client UserList widget via an unescaped commenter link field

• Kimlik doğrulamasız
• XSS

walinejs · walineBugün

Nitrite: Unfiltered Java Deserialization in Legacy v1 Database Migration Path

• Kimlik doğrulamasız
• Deserializasyon

nitrite · nitrite-javaBugün

AstroBlocks: Admin session tokens can be forged due to a hard-coded fallback JWT secret and a mismatched environment variable name

• Kimlik doğrulamasız
• Gömülü kimlik bilgisi

nauelg · astro-blocksBugün

User Registration & Membership 5.2.8 - 5.3.1 - Unauthenticated Privilege Escalation via Coupon-Based Payment Bypass

• Kimlik doğrulamasız

unknown · user registration & membershipBugün

Forminator Forms 1.58.0 - 1.58.3 - Unauthenticated Privilege Escalation via Paid Registration Form When Stripe Gateway Unavailable

• Kimlik doğrulamasız

unknown · forminator formsBugün

PrintAura WooCommerce API <= 4.0.2 - Unauthenticated WooCommerce REST API Authentication Bypass

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

unknown · printaura-woocommerceBugün

Pay With a Tweet <= 1.0.5 - Subscriber+ Arbitrary File Deletion via Button Download Path

• Yol geçişi

unknown · pay with a tweetBugün

Somatic Framework <= 1.8.14 - Subscriber+ Arbitrary File Deletion

• Yol geçişi

unknown · somatic frameworkBugün

Contest Gallery < 34.0.3 - Author+ Arbitrary File Upload via Ecommerce Sale File Replacement

• RCE
• Dosya yükleme

unknown · contest galleryBugün

Askany < 2.2.0 - Unauthenticated Arbitrary File Upload

• Girişsiz RCE
• Dosya yükleme

unknown · askanyBugün

Knowledge Building < 0.7.3 - Unauthenticated Stored XSS via knbu_new_reply AJAX Action

• Kimlik doğrulamasız
• XSS

unknown · knowledge buildingBugün

Knowledge Building < 0.7.3 - Reflected XSS via Comment Reply Response

• Kimlik doğrulamasız
• XSS

unknown · knowledge buildingBugün

Simpler Checkout < 1.5.4 - Subscriber+ Privilege Escalation via Forged Auto-Login Token

unknown · simpler checkoutBugün

iChart < 2.2.4 - Subscriber+ Arbitrary Post Read, Update and Deletion via IDOR

• Erişim denetimi (IDOR)

unknown · ichartBugün

Smoove Abandoned Cart Trigger for WooCommerce 4.0.0 - 4.3.5 - Unauthenticated Stored XSS

• Kimlik doğrulamasız
• XSS

unknown · smoove abandoned cart trigger for woocommerceBugün

Security For WooCommerce <= 1.0.16 - Unauthenticated Privilege Escalation via REST API Options Update and User Token Disclosure

• Kimlik doğrulamasız

unknown · security for woocommerceBugün

Security For WooCommerce <= 1.0.16 - Unauthenticated Two-Factor Authentication Reset

• Erişim denetimi (IDOR)

unknown · security for woocommerceBugün

Security For WooCommerce <= 1.0.16 - Unauthenticated Two-Factor Code and Secret Disclosure

• Erişim denetimi (IDOR)

unknown · security for woocommerceBugün

Security For WooCommerce <= 1.0.16 - Unauthenticated Mass Comment Deletion

• Kimlik doğrulamasız
• Erişim denetimi (IDOR)

unknown · security for woocommerceBugün

In affected versions of Octopus Server, insufficient integrity protection of authentication cookies, combined with incorrect validation of p

octopus deploy · octopus serverBugün

In affected versions of Octopus Server, incorrect validation of permissions assigned to a user that would allow them to edit their own login

• Erişim denetimi (IDOR)

octopus deploy · octopus serverBugün

ARForms <= 7.2.4 - Unauthenticated Arbitrary File Upload to Remote Code Execution via X-FILENAME Header

• Girişsiz RCE
• Dosya yükleme

Bugün

Authenticated SQL Injection

• SQL enjeksiyonu

zohocorp · adaudit plusBugün

ARforms <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting via Referer Header

• Kimlik doğrulamasız
• XSS

Bugün

ARforms <= 7.2.4 - Unauthenticated Stored Cross-Site Scripting via 'description' Parameter

• Kimlik doğrulamasız
• Deserializasyon
• XSS

Bugün

Authenticated Second-Order SQL Injection

• SQL enjeksiyonu

zohocorp · adaudit plusBugün

In affected versions of Octopus Server, incorrect validation of the permissions assigned to a user that would allow them to create project t

• Erişim denetimi (IDOR)

octopus deploy · octopus serverBugün

Uncontrolled Search Path Element in hMailServer

progressive robot ltd · hmailserverBugün

Improper Certificate Validation in hMailServer

• Zayıf kripto

progressive robot ltd · hmailserverBugün

Improper Certificate Validation in hMailServer

• Kimlik doğrulamasız
• Zayıf kripto

progressive robot ltd · hmailserverBugün

Improper Certificate Validation in hMailServer

• Zayıf kripto

progressive robot ltd · hmailserverBugün

Improper Link Resolution Before File Access ('Link Following') in hMailServer

progressive robot ltd · hmailserverBugün

Allocation of Resources Without Limits or Throttling in hMailServer

• Kimlik doğrulamasız
• Hizmet dışı bırakma

progressive robot ltd · hmailserverBugün

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in hMailServer

• SQL enjeksiyonu

progressive robot ltd · hmailserverBugün

Improper Certificate Validation in hMailServer

• Zayıf kripto

progressive robot ltd · hmailserverBugün

Incorrect Default Permissions in hMailServer

progressive robot ltd · hmailserverBugün

Inefficient Algorithmic Complexity in hMailServer

• Kimlik doğrulamasız
• Hizmet dışı bırakma

progressive robot ltd · hmailserverBugün

Unverified Ownership in hMailServer

progressive robot ltd · hmailserverBugün

Insufficient IOCTL access control allows local access to I/O ports

• Yerel yetki yükseltme

beckhoff automation · tcrouter.sys for windows on x64 3.1.0.2364Bugün

Insufficient IOCTL access control allows local access to arbitrary physical memory

• Yerel yetki yükseltme

beckhoff automation · tcrouter.sys for windows on x64 3.1.0.2364Bugün

Insufficient IOCTL access control allows local relocation of arbitrary physical memory

• Yerel yetki yükseltme

beckhoff automation · tcrouter.sys for windows on x64 3.1.0.2364Bugün

Privilege escalation in Enter’s Iperius Backup

• Yerel yetki yükseltme

enter · iperius backupBugün

WordPress GeoDirectory plugin <= 2.8.202 - Cross Site Scripting (XSS) vulnerability

• Kimlik doğrulamasız
• XSS

ayecode ltd · geodirectoryBugün

Busybox: heap buffer overflow in the tftp client on fallback to the default block size

• Girişsiz RCE
• Bellek hatası

red hat · red hat enterprise linux 6Bugün

Path traversal in host label synchronization allows code execution on the central site from a remote site

• Yol geçişi

checkmk gmbh · checkmkBugün

Arbitrary file write and code execution via crafted Synthetic Monitoring agent data

• Yol geçişi

checkmk gmbh · checkmkBugün

Arbitrary file write and code execution via excluded node roles in Kubernetes special agent

checkmk gmbh · checkmkBugün

WordPress AI Engine plugin <= 3.9.1 - Cross Site Scripting (XSS) vulnerability

• Kimlik doğrulamasız
• XSS

meow apps · ai engineBugün

WordPress Calculated Fields Form plugin <= 5.5.2.8 - Cross Site Scripting (XSS) vulnerability

• Kimlik doğrulamasız
• XSS

codepeople · calculated fields formBugün

Busybox: httpd stack buffer overflow via an "i:" rule in a subdirectory httpd.conf

• RCE
• Bellek hatası

red hat · red hat enterprise linux 6Bugün

Busybox: stack buffer overflow in udhcpc6 send_d6_renew() and send_d6_release()

• Girişsiz RCE
• Bellek hatası

red hat · red hat enterprise linux 6Bugün

WordPress STAGGS plugin <= 3.3.0 - Remote Code Execution (RCE) vulnerability

• Girişsiz RCE

staggs · staggsBugün

6Storage Rentals <= 2.31.0 - Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'six_storage_online_api_url' Option Poisoni

• Kimlik doğrulama atlatma

sixstorage · 6storage rentalsBugün