Kasım 2026: sömürülen ve yeni ciddi CVE kayıtları

Reset Database <= 1.1.3 - Authenticated (Subscriber+) Privilege Escalation to Missing Capability and Nonce Check in process_reset()

maltesesolutions · reset databaseBugün

WordPress Kit (formerly ConvertKit) plugin <= 3.5.0 - Broken Access Control vulnerability

• Kimlik doğrulamasız
• Erişim denetimi (IDOR)

kit · kit (formerly convertkit)Bugün

WordPress RestroPress plugin <= 3.4.11 - Cross Site Request Forgery (CSRF) vulnerability

• Kimlik doğrulamasız
• CSRF

magnigenie · restropressBugün

Apache Roller: XML external entity processing in AtomPub entry parsing

• XXE

apache software foundation · apache rollerBugün

Apache Roller: Cross-site request forgery through GET requests to administrative actions

• Kimlik doğrulamasız
• CSRF

apache software foundation · apache rollerBugün

WordPress Edwiser Bridge plugin <= 4.3.4 - Cross Site Request Forgery (CSRF) vulnerability

• Kimlik doğrulamasız
• CSRF

wisdmlabs · edwiser bridgeBugün

Ninja Forms - File Uploads <= 3.3.36 - Unauthenticated Arbitrary File Deletion via 'files[].data.file_path' Parameter via 'extra.saveProgress'

• Kimlik doğrulamasız
• Yol geçişi

saturdaydrive · ninja forms - file uploadsBugün

BlueprintUE Self-Hosted Edition 1.0.0 before 4.3.5 Storage Exhaustion via Anonymous Blueprints

• Kimlik doğrulamasız
• Hizmet dışı bırakma

blueprintue · blueprintue-self-hosted-editionBugün

Contao 4.0.0 before 5.3.54, 5.4.0 before 5.7.17, and 6.0.0 before 6.0.6 Filemount Bypass via Edit-Multiple

• Erişim denetimi (IDOR)

contao · contaoBugün

An attacker who gains the ability to execute arbitrary code on a system with TrueConf Server (Linux) versions from 4.7.2 up to, but not incl

• RCE
• Yerel yetki yükseltme

trueconf · trueconf serverBugün

WordPress Quality theme <= 3.3 - Cross Site Request Forgery (CSRF) vulnerability

• Kimlik doğrulamasız
• CSRF

webriti · qualityBugün

WordPress ElitePress theme <= 3.2.1 - Cross Site Request Forgery (CSRF) vulnerability

• Kimlik doğrulamasız
• CSRF

webriti · elitepressBugün

WordPress Rambo theme <= 3.0 - Cross Site Request Forgery (CSRF) vulnerability

• Kimlik doğrulamasız
• CSRF

webriti · ramboBugün

WordPress Heroic theme <= 1.4.2 - Cross Site Request Forgery (CSRF) vulnerability

• Kimlik doğrulamasız
• CSRF

webriti · heroicBugün

WordPress Wallstreet Agency theme <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability

• Kimlik doğrulamasız
• CSRF

webriti · wallstreet agencyBugün

WordPress Spasalon theme <= 3.0 - Cross Site Request Forgery (CSRF) vulnerability

• Kimlik doğrulamasız
• CSRF

webriti · spasalonBugün

WordPress vice theme <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability

• Kimlik doğrulamasız
• CSRF

webriti · viceBugün

WordPress vdequator theme <= 1.2.7 - Cross Site Request Forgery (CSRF) vulnerability

• Kimlik doğrulamasız
• CSRF

webriti · vdequatorBugün

WordPress Mazino theme <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability

• Kimlik doğrulamasız
• CSRF

webriti · mazinoBugün

WordPress vdperanto theme <= 2.2 - Cross Site Request Forgery (CSRF) vulnerability

• Kimlik doğrulamasız
• CSRF

webriti · vdperantoBugün

WordPress Leo theme <= 1.7.4 - Cross Site Request Forgery (CSRF) vulnerability

• Kimlik doğrulamasız
• CSRF

webriti · leoBugün

WordPress Shk Corporate theme <= 2.4.3 - Cross Site Request Forgery (CSRF) vulnerability

• Kimlik doğrulamasız
• CSRF

webriti · shk corporateBugün

WordPress Appointment Dark theme <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerability

• Kimlik doğrulamasız
• CSRF

webriti · appointment darkBugün

Cross-instance user impersonation through image renderer JWTs

• Bilgi sızıntısı

grafana · grafana ossBugün

Privilege escalation through folder move in the folders API

grafana · grafana enterpriseBugün

Folder permission bypass in the Git Sync repository files API

• Bilgi sızıntısı

grafana · grafana enterpriseBugün

Quay: red hat quay: unauthenticated registry signing-key takeover via service key rotation

• Kimlik doğrulamasız

red hat · red hat quay 3Bugün

Critical Remote Code Execution (RCE) vulnerability reported in Windchill

• Girişsiz RCE
• Deserializasyon

ptc · windchillBugün

Unauthenticated Payment Status Manipulation in Sipay Electronic Money's WordPress (WooCommerce)

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

sipay electronic money and payment services inc. · woocommerce virtual pos moduleBugün

Switch Engine (EXOS) JSON-RPC Authorization Bypass Allows Read-Only Users to Disclose Sensitive Information

• Erişim denetimi (IDOR)

extreme networks · switch engine (exos)Bugün

soapbar: verify_envelope_bsp accepts an unauthenticated embedded certificate (signature forgery / authentication bypass)

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma
• Zayıf kripto

hitoshyamamoto · soapbarBugün

Quay: quay: sql like wildcard injection in robot listing leaks cross-tenant robot tokens

• SQL enjeksiyonu

red hat · red hat openshift update serviceBugün

Cross-Site Scripting in DropDownButton and SplitButton Items in Kendo UI for jQuery

• Kimlik doğrulamasız
• XSS

progress software · kendo ui for jqueryBugün

Cross-Site Scripting via the spriteCssClass Field in Kendo UI for jQuery

• Kimlik doğrulamasız
• XSS

progress software · kendo ui for jqueryBugün

Cross-Site Scripting in Kendo UI for jQuery ActionSheet Header Labels

• Kimlik doğrulamasız
• XSS

progress software · kendo ui for jqueryBugün

Cross-Site Scripting During Kendo UI for jQuery Custom SVG Icon Sanitization

• Kimlik doğrulamasız
• XSS

progress software · kendo ui for jqueryBugün

Cross-Site Scripting in Kendo UI for jQuery Grid and TreeList Column Reordering

• Kimlik doğrulamasız
• XSS

progress software · kendo ui for jqueryBugün

Cross-Site Scripting in Kendo UI for jQuery PivotGrid Axis Chips

• Kimlik doğrulamasız
• XSS

progress software · kendo ui for jqueryBugün

Cross-Site Scripting in Kendo UI for jQuery PropertyGrid Values and Descriptions

• Kimlik doğrulamasız
• XSS

progress software · kendo ui for jqueryBugün

An improper permissions vulnerability was reported in Lenovo System Update that could allow a local authenticated user to execute code with

• Yerel yetki yükseltme

lenovo · system updateBugün

A deserialization of untrusted data vulnerability was discovered in Lenovo System Update that could allow a local authenticated user to exec

• Deserializasyon
• Yerel yetki yükseltme

lenovo · system updateBugün

During an internal security assessment, a potential vulnerability was discovered in Lenovo PC Manager, distributed exclusively in the Chines

• Yerel yetki yükseltme

lenovo · pc managerBugün

ClassFactory Race Condition and Retained Assembly Memory in Telerik UI for ASP.NET MVC

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma
• Yarış durumu

progress software · telerik ui for asp.net mvcBugün

External Control of Configuration Setting in Telerik Report Server

• Kimlik doğrulamasız

progress software · telerik report serverBugün

Uncontrolled Resource Consumption in Telerik UI for ASP.NET Core Server-side Aggregation

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma
• Hizmet dışı bırakma

progress software · telerik ui for asp.net coreBugün

An authorization bypass in Revive Adserver 6.0.0 through 6.0.8 allows an authenticated manager restricted to one agency to access or modify

• Erişim denetimi (IDOR)

revive · adserverBugün

Blind SQL injection in Revive Adserver 6.0.8 and earlier allows an authenticated manager restricted to one agency to extract arbitrary datab

• SQL enjeksiyonu

revive · adserverBugün

OWASP CRS: ReDoS in shared unix-shell-evasion regex-assembly include (12 RCE rules) - PCRE2 backtracking-limit exhaustion causes detection bypass and CPU DoS

• Girişsiz RCE
• Hizmet dışı bırakma

coreruleset · corerulesetBugün

OWASP CRS: XML Attribute Value Bypass

• Girişsiz RCE
• XSS

coreruleset · corerulesetBugün

aeon: Privileged GitHub Actions workflow allowed fork-controlled code execution

• Girişsiz RCE

aeon-toolkit · aeonBugün

Dell Ansible Storage for PowerFlex, versions prior to 3.2.0, contains an Improper Certificate Validation vulnerability in the API client com

• Kimlik doğrulamasız
• Zayıf kripto

dell · ansible storage for powerflexBugün

Dell Ansible Storage for PowerStore, versions prior to 3.9.0, contains an Improper Certificate Validation vulnerability in the API client co

• Kimlik doğrulamasız
• Zayıf kripto

dell · ansible storage for powerstoreBugün

Dell Terraform for ObjectScale and Powerstore, versions prior to 1.1.1 (ObjectScale) and versions 1.2.1 through 1.3.0 (PowerStore) contains

• Bilgi sızıntısı

dell · terraform provider for objectscaleBugün

Dell Ansible Storage for Unity , versions prior to 1.2.13 contains an Improper Certificate Validation vulnerability in the UnityRESTConnecto

• Kimlik doğrulamasız
• Zayıf kripto

dell · ansible storage for unityBugün

Xfsprogs: xfsprogs: local privilege escalation via command injection in xfs_admin

• RCE
• Yerel yetki yükseltme
• Komut enjeksiyonu

red hat · red hat enterprise linux 10Bugün

Pappl-retrofit: directory traversal in the add-ppdfiles and delete-ppdfiles actions

• RCE
• Yol geçişi

openprinting · pappl-retrofitBugün

Node.js is vulnerable to a remote HTTP/2 denial of service via a reachable assertion in Http2Session teardown

• Kimlik doğrulamasız

nodejs · nodeBugün

Node.js is vulnerable to cross-connection memory disclosure via TLS write re-entrancy in the HTTPS request parser

• Kimlik doğrulamasız
• Bellek hatası

nodejs · nodeBugün

Node.js is vulnerable to an HTTP/2 memory and file-descriptor leak via a protocol error during session shutdown

• Kimlik doğrulamasız
• Hizmet dışı bırakma

nodejs · nodeBugün

Node.js is vulnerable to HTTP/2 response memory disclosure via a use-after-free during stream teardown

• Kimlik doğrulamasız
• Bellek hatası

nodejs · nodeBugün

Node.js is vulnerable to a client certificate authentication bypass via TLS 1.2 renegotiation servername change

• Kimlik doğrulama atlatma

nodejs · nodeBugün

Node.js is vulnerable to an HTTP/2 use-after-free via respondWithFile() stream reset during a pending write

• Kimlik doğrulamasız
• Bellek hatası
• Hizmet dışı bırakma

nodejs · nodeBugün

Node.js is vulnerable to a remotely triggerable uncaught exception in TLS servers via deferred handshake callbacks

• Kimlik doğrulamasız
• Bellek hatası
• Hizmet dışı bırakma

nodejs · nodeBugün

OpsTree REMS through 1.0.0 Authentication Bypass via is_local_auth Flag

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

opstree solutions · remsBugün

OpsTree REMS through 1.0.0 Missing Authentication via /api/v1/databases Governance API

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

opstree solutions · remsBugün

@tinacms/mdx before 2.4.2 Code Injection via MDX Serializer Rich-Text Values

• RCE

tinacms · @tinacms/mdxBugün

Traccar 3.15 before 6.17.0 Authentication Bypass via Empty LDAP Password

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

traccar · traccarBugün

Spatie Browsershot 2.2.0 before 5.5.0 Local File Read via setHtml()

• Kimlik doğrulamasız
• Yol geçişi

spatie · browsershotBugün

Webmin through 2.670 Privilege Escalation via acl/save_group.cgi

webmin · webminBugün

Webmin through 2.670 Users File Injection via acl/cert_issue.cgi

webmin · webminBugün

geojson-vt: Uncontrolled Recursion in Nested GeoJSON GeometryCollection

• Kimlik doğrulamasız
• Hizmet dışı bırakma

maplibre · geojson-vtBugün

Probo: Cross-tenant IDOR via unvalidated FK references

• Erişim denetimi (IDOR)

getprobo · proboBugün

Fider: Cross-Tenant Authentication Bypass via Missing tenant_id Filter in getVerificationByKey

• Kimlik doğrulama atlatma
• Erişim denetimi (IDOR)

getfider · fiderBugün

sync-rpc: Arbitrary remote code execution vulnerability

• Girişsiz RCE
• Kimlik doğrulama atlatma

forbeslindesay · sync-rpcBugün

Fider: Server-Side Request Forgery (SSRF) via Webhook URL

• SSRF

getfider · fiderBugün

Probo: Vertical privilege escalation

getprobo · proboBugün

Cockpit: cockpit: denial of service via unbounded fragmented websocket messages

• Kimlik doğrulamasız
• Hizmet dışı bırakma

red hat · red hat enterprise linux 10Bugün

Dell OpenManage Ansible Modules, versions 2.1.2 through 10.0.3, contains an Improper Certificate Validation vulnerability in the iDRACRedfis

• Kimlik doğrulamasız
• Zayıf kripto

dell · openmanage ansible modulesBugün

Dell OpenManage Ansible Modules, versions 5.0.0 through 10.0.3, contains an Improper Certificate Validation vulnerability in the iDRACConnec

• Kimlik doğrulamasız
• Zayıf kripto

dell · openmanage ansible modulesBugün

Dell OpenManage Ansible Modules, versions 9.2.0 through 10.0.3, contains an Improper Certificate Validation vulnerability in the SessionAPI

• Kimlik doğrulamasız
• Zayıf kripto

dell · openmanage ansible modulesBugün

Dell OpenManage Ansible Modules, versions 2.0.2 through 10.0.3, contains an Improper Neutralization of Special Elements in Data Query Logic

• SQL enjeksiyonu

dell · openmanage ansible modulesBugün

Dell OpenManage Ansible Modules, versions 6.0.0 through 10.0.3, contains an Improper Neutralization of Special Elements in Output Used by a

dell · openmanage ansible modulesBugün

Dell Terraform Provider for PowerFlex, versions 1.5.0 through 1.8.0, contains an Improper Certificate Validation vulnerability in the SSH cl

• Kimlik doğrulamasız
• Zayıf kripto

dell · terraform provider for powerflexBugün

Dell Terraform Provider for PowerStore, versions prior to 1.3.1 , contains a  vulnerability that may cause sensitive authentication data to

• Kimlik doğrulamasız
• Bilgi sızıntısı

dell · terraform provider for powerstoreBugün

AsiaInfo BSS Platform 9.2 before 9.2.38 has a stored cross-site scripting (XSS) vulnerability in the menu icon upload function.

• XSS

asiainfo · bss platformBugün

Pre-account hijacking via planted password

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

xauendevs · lagarto chivatoBugün

Cockpit: cockpit: local privilege escalation via insecure symlink handling in public key addition helper

• Yerel yetki yükseltme

red hat · red hat enterprise linux 10Bugün

Missing authorization on the external management API in mcp-gateway-registry enables privilege escalation to registry administrator

aws · mcp-gateway-registryBugün

ideon: SSRF protection bypass via IPv6 transition addresses (NAT64 / 6to4 / IPv4-mapped) in link preview

• SSRF

3xpyth0n · ideonBugün

NextScan 1.1.0 through 1.2.0 Hardcoded JWT Key Authentication Bypass in ns-admin

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma
• Gömülü kimlik bilgisi

tongcheng-security-team · nextscanBugün

Hydro @hydrooj/ui-default before 4.59.1 Stored XSS via Markdown language- Class

• XSS

hydro-dev · @hydrooj/ui-defaultBugün

Rote 1.2.0 through 2.6.0 Account Takeover via OAuth Account Merge Endpoint

• Erişim denetimi (IDOR)

rabithua · roteBugün

NextScan 1.1.0 through 1.2.0 Hardcoded Credentials in ns-admin Agent and External APIs

• Kimlik doğrulamasız
• Gömülü kimlik bilgisi

tongcheng-security-team · nextscanBugün

Rote through 2.6.0 Privilege Escalation via Admin Settings API JWT Secret Exposure

rabithua · roteBugün

WWBN AVideo 12.4 through 29.7.1 Path Traversal File Deletion via deleteImage.json.php

• Yol geçişi

wwbn · avideoBugün

WWBN AVideo through 29.7.1 Privilege Escalation via Encoder video_id_hash

• Erişim denetimi (IDOR)

wwbn · avideoBugün

WWBN AVideo 14.3 through 29.7.1 Stored XSS via Video Source Tag

• XSS

wwbn · avideoBugün

blueprintUE Self-Hosted Edition before 4.3.7 Empty MariaDB Root Password via Docker Compose

• Kimlik doğrulamasız

blueprintue · blueprintue-self-hosted-editionBugün

Roundcube Webmail before 1.6.21 and 1.7.6 IMAP Command Injection via _uid

• Girişsiz RCE
• Komut enjeksiyonu

roundcube · webmailBugün

ideon: Read-only project viewers can wipe and rewrite the canvas and tamper with blocks/files via role-unchecked project endpoints

• Kimlik doğrulamasız
• Erişim denetimi (IDOR)

3xpyth0n · ideonBugün