Kasım 2026: sömürülen ve yeni ciddi CVE kayıtları

OriginLab Origin Viewer OPJU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

• RCE
• Bellek hatası

originlab · origin viewerBugün

OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

• RCE
• Bellek hatası

originlab · origin viewerBugün

OriginLab Origin Viewer OGWU File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

• RCE
• Bellek hatası

originlab · origin viewerBugün

OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

• RCE
• Bellek hatası

originlab · origin viewerBugün

OriginLab Origin Viewer OGG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

• RCE
• Bellek hatası

originlab · origin viewerBugün

OriginLab Origin Viewer OGM File Parsing Memory Corruption Remote Code Execution Vulnerability

• RCE
• Bellek hatası

originlab · origin viewerBugün

OriginLab Origin Viewer OGWU File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

• RCE
• Bellek hatası

originlab · origin viewerBugün

OriginLab Origin Viewer OPJ File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

• RCE
• Bellek hatası

originlab · origin viewerBugün

OriginLab Origin Viewer OGWU File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

• RCE
• Bellek hatası

originlab · origin viewerBugün

Philips Hue Bridge Pro SQL Injection Remote Code Execution Vulnerability

• RCE
• SQL enjeksiyonu

philips · hue bridge proBugün

Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability

• RCE
• Bellek hatası

trimble · sketchupBugün

Ashlar-Vellum Cobalt XE File Parsing Use-After-Free Remote Code Execution Vulnerability

• RCE
• Bellek hatası

ashlar-vellum · cobaltBugün

Ashlar-Vellum Cobalt AR File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

• RCE
• Bellek hatası

ashlar-vellum · cobaltBugün

Ashlar-Vellum Cobalt XE File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

• RCE
• Bellek hatası

ashlar-vellum · cobaltBugün

Ashlar-Vellum Cobalt LI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

• RCE
• Bellek hatası

ashlar-vellum · cobaltBugün

Ashlar-Vellum Cobalt XE File Parsing Use-After-Free Remote Code Execution Vulnerability

• RCE
• Bellek hatası

ashlar-vellum · cobaltBugün

Philips Hue Bridge Pro Protection Mechanism Failure Authentication Bypass Vulnerability

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

philips · hue bridge proBugün

Quest NetVault Backup StnzCreateKey Numeric Truncation Error Denial-of-Service Vulnerability

• Kimlik doğrulamasız
• Hizmet dışı bırakma

quest · netvault backupBugün

Quest NetVault Backup nvpmgr Integer Underflow Denial-of-Service Vulnerability

• Kimlik doğrulamasız
• Bellek hatası
• Hizmet dışı bırakma

quest · netvault backupBugün

UNIX symbolic link (symlink) following vulnerability in openEuler iSulad on Linux.

• Kimlik doğrulamasız

openeuler · isuladBugün

Relative path traversal vulnerability in openEuler iSulad on Linux.

• Kimlik doğrulamasız
• Yol geçişi

openeuler · isuladBugün

An authorization bypass through user-controlled key vulnerability in the SSOAuth in Synology DiskStation Manager (DSM) before 7.3.2-86009-5

• Erişim denetimi (IDOR)

synology · diskstation manager (dsm)Bugün

An authentication bypass using an alternate path or channel vulnerability in the OTP in Synology DiskStation Manager (DSM) before 7.3.2-8600

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

synology · diskstation manager (dsm)Bugün

An access of uninitialized pointer vulnerability in the nfsd in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 al

• Kimlik doğrulamasız
• Bellek hatası
• Hizmet dışı bırakma

synology · diskstation manager (dsm)Bugün

An improper limitation of a pathname to a restricted directory vulnerability in the Sharing API in Synology DiskStation Manager (DSM) before

• Yol geçişi

synology · diskstation manager (dsm)Bugün

An improper link resolution before file access vulnerability in the thumb in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4

synology · diskstation manager (dsm)Bugün

A missing critical step in authentication vulnerability in the Auth API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1

synology · diskstation manager (dsm)Bugün

An improper neutralization of special elements used in an OS command vulnerability in the VPN API in Synology DiskStation Manager (DSM) befo

• RCE
• Komut enjeksiyonu

synology · diskstation manager (dsm)Bugün

An improper neutralization of special elements used in an SQL command vulnerability in the Auth API in Synology DiskStation Manager (DSM) be

• Kimlik doğrulamasız
• SQL enjeksiyonu

synology · diskstation manager (dsm)Bugün

An improper neutralization of special elements used in an SQL command vulnerability in the User API in Synology DiskStation Manager (DSM) be

• Kimlik doğrulamasız
• SQL enjeksiyonu

synology · diskstation manager (dsm)Bugün

An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager (DSM) before 7.2.1-69

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

synology · diskstation manager (dsm)Bugün

An OS command Injection issue exists in Air Terminal 6 provided by SoftBank Corp.

• RCE
• Komut enjeksiyonu

softbank corp. · air terminal 6Bugün

Descope < 1.2.0 - Unauthenticated Account Takeover

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

unknown · descopeBugün

Akaunting 3.3.0 - Stored XSS in custom invoice payment terms

• XSS

akaunting · akauntingBugün

Defender Security < 6.4.1 - 2FA Bypass via Unthrottled OTP Verification

• Kimlik doğrulama atlatma

unknown · defender securityBugün

Abilities Bridge < 1.4.2 - Administrator Account Creation via CSRF

• Kimlik doğrulamasız
• CSRF

unknown · abilities bridgeBugün

ContentPen < 1.1.1 - Unauthenticated Stored XSS via API Key Disclosure

• Kimlik doğrulamasız
• XSS

unknown · contentpenBugün

WP Remote Users Sync < 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync Action

unknown · wp remote users syncBugün

TI WooCommerce Wishlist < 2.0.7 - Unauthenticated SQLi via tinv_wishlistkey Cookie

• Kimlik doğrulamasız
• SQL enjeksiyonu

unknown · ti woocommerce wishlistBugün

Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticated Arbitrary File Upload via 'type' Parameter

• Girişsiz RCE
• Dosya yükleme

unknown · ultimate addons for elementor formsBugün

Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions

• Kimlik doğrulamasız
• SQL enjeksiyonu

unknown · clockinator liteBugün

User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP Login Verification

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

unknown · user verification by pickpluginsBugün

Authenticated remote code execution

• RCE
• SQL enjeksiyonu

zohocorp · assetexplorerBugün

Privilege Escalation

• RCE
• Erişim denetimi (IDOR)

zohocorp · m365 manager plusBugün

Unauthenticated Polkit Privilege Escalation in TÜBİTAK BİLGEM's Pardus About

• Yerel yetki yükseltme
• Erişim denetimi (IDOR)

tübi̇tak bi̇lgem software technologies research institute · pardus aboutBugün

TimePictra ermote code execution via file upload

• RCE
• Dosya yükleme

microchip · timepictraBugün

TimePictra root password hardcoded in installation files

• Gömülü kimlik bilgisi

microchip · timepictraBugün

TimePictra Stored Cross-site Scripting

• XSS

microchip · timepictraBugün

Akaunting 3.3.0 - Stored XSS in invoice edit form through imported status

• XSS

akaunting · akauntingBugün

WordPress Simple JWT Login plugin <= 3.6.8 - Cross Site Request Forgery (CSRF) vulnerability

• Kimlik doğrulamasız
• CSRF

nicu micle · simple jwt loginBugün

OpenStack Application Credentials Logged in Cleartext to BOSH Debug Logs

• Bilgi sızıntısı

cloudfoundry foundation · bosh-openstack-cpi-releaseBugün

Azul Payara Administration REST Interface Authentication Bypass via X-GlassFish-authToken Header Leading to Remote Code Execution

• Girişsiz RCE
• Kimlik doğrulama atlatma

azul payara · payara serverBugün

Azul Payara JMX/RMI Remote Authentication Bypass Leading to Remote Code Execution via GenericAdminAuthenticator

• Girişsiz RCE
• Kimlik doğrulama atlatma

azul payara · payara serverBugün

Deserialization of Untrusted Data in Telerik Reporting Report Designers

• RCE
• Deserializasyon
• Yerel yetki yükseltme

progress software · telerik reportingBugün

Improper Control of Generation of Code in Progress Telerik UI for WinForms

• RCE

progress software · telerik ui for winformsBugün

MISP Modules Website: Missing Authorization on External Tool Management Endpoints

• Kimlik doğrulamasız
• Erişim denetimi (IDOR)

misp · misp-modulesBugün

SQL Injection in WhatsApp for Dolibarr by Sgestion / EasySoft

• Kimlik doğrulamasız
• SQL enjeksiyonu

sgestion / easysoft · whatsapp for dolibarrBugün

Deserialization of Untrusted Data in Progress Telerik UI for WinForms

• Deserializasyon

progress software · telerik ui for winformsBugün

Improper Control of Generation of Code in Progress Telerik UI for WPF

• RCE

progress software · telerik ui for wpfBugün

Deserialization of Untrusted Data in Progress Telerik UI for WPF

• Deserializasyon

progress software · telerik ui for wpfBugün

Shamir backup recovery accepts a share at x = 0, so a supplied share can substitute the recovered private key

• Kimlik doğrulamasız

Bugün

URL Redirection to Untrusted Site in Progress Telerik UI for .NET MAUI

• Açık yönlendirme

progress software · telerik ui for .net mauiBugün

ibi WebFOCUS - OS Command Injection Vulnerability

• RCE
• Komut enjeksiyonu

ibi · webfocusBugün

MISP Modules Website Exposes External Tool API Keys in /external_tools/list Response

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma
• Bilgi sızıntısı

misp · misp-modulesBugün

Masterstudy - Education WordPress Theme <= 4.8.151 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation

• Erişim denetimi (IDOR)

stylemixthemes · masterstudy - education wordpress themeBugün

CourseCure Courses <= 1.5.1 - Authenticated (Subscriber+) Privilege Escalation to 'ajax_save_settings' Endpoint

wishlist member · coursecure coursesBugün

VibeBP <= 1.9.9.8.1 - Authenticated (Subscriber+) Privilege Escalation in set_email_notification_settings()

vibethemes · vibebpBugün

Authenticated Injection

• RCE
• Komut enjeksiyonu

zohocorp · ddi centralBugün

Password Reset via Unverified Email Leading to Account Takeover in Hyper Technology's Hyper E-Commerce Infrastructure

hyper teknoloji ltd. şti. · hyper e-commerce infrastructureBugün

Multi-Factor Authentication Bypass in Hyper Technology's Hyper E-Commerce Infrastructure

• Kimlik doğrulama atlatma

hyper teknoloji ltd. şti. · hyper e-commerce infrastructureBugün

TIBCO Platform’s Self-Hosted Control Plane - Authentication Bypass Vulnerability

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

tibco · tibco platform’s self-hosted control planeBugün

Backup Migration before 2.1.8 Path Traversal via PclZip Restore Fallback

• RCE
• Yol geçişi

inisev · backup migrationBugün

PapaParse before 5.7.1 Quadratic-Time Parsing DoS via indexOf Scan

• Kimlik doğrulamasız

mholt · papaparseBugün

Authentication Bypass

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

zohocorp · ddi centralBugün

Broken Access Control

• Erişim denetimi (IDOR)

zohocorp · ddi centralBugün

Broken Access Control

• Erişim denetimi (IDOR)

zohocorp · ddi centralBugün

Broken Access Control

• Erişim denetimi (IDOR)

zohocorp · ddi centralBugün

Authenticated command injection

• RCE
• Komut enjeksiyonu

zohocorp · ddi centralBugün

Input Validation Vulnerability in Gaia Portal backend handlers allows privilege escalation by an authenticated user

checkpoint · quantum security gatewayBugün

In affected versions of Octopus Server, insufficient validation of custom claims on OIDC accounts allowed a user with permission to edit acc

octopus deploy · octopus serverBugün

An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

citrix netscaler · consoleBugün

Local privilege escalation to root in the DynamicCLI daemon via local world-writable control socket

• Yerel yetki yükseltme

checkpoint · quantum security gatewayBugün

In affected versions of Octopus Server, incorrect validation of the external identity linked to a newly registered user could result in that

• Erişim denetimi (IDOR)

octopus deploy · octopus serverBugün

In affected versions of Octopus Server, incorrect validation of changes a user made to their own LDAP identity allowed them to edit that ide

• Erişim denetimi (IDOR)

octopus deploy · octopus serverBugün

Pardus Image Writer Local Privilege Escalation via Polkit Misconfiguration in TÜBİTAK BİLGEM's pardus-image-writer

• Yerel yetki yükseltme
• Erişim denetimi (IDOR)

tübi̇tak bi̇lgem yazılım teknolojileri araştırma enstitüsü · pardus-image-writerBugün

PostgreSQL parallel RECORD typmod use-after-free executes arbitrary code

• RCE
• Bellek hatası

Bugün

PostgreSQL composite-type change during field assignment executes arbitrary code

• RCE

Bugün

PostgreSQL plperl prepared-query use-after-free executes arbitrary code

• RCE
• Bellek hatası

Bugün

PostgreSQL plperl blessed-reference type confusion may execute arbitrary code

• RCE

Bugün

PostgreSQL "vacuumdb --missing-stats-only" lets a database owner execute code as the vacuumdb user

• RCE

Bugün

PostgreSQL pg_restore executes arbitrary code due to missing non-plain archive validation

• Girişsiz RCE

Bugün

PostgreSQL tsvector_delete() heap buffer overflow executes arbitrary code

• RCE
• Bellek hatası

Bugün

PostgreSQL security-restricted operations can create types in pg_temp, which later queries of the session find

• RCE

Bugün

PostgreSQL ts_rank_cd() heap buffer overflow may execute arbitrary code

• RCE
• Bellek hatası

Bugün

PostgreSQL pg_dump not-null constraint name allows SQL injection

• RCE
• SQL enjeksiyonu

Bugün

PostgreSQL plperl reentrant return_next() use-after-free executes arbitrary code

• RCE
• Bellek hatası

Bugün

PostgreSQL plperl array and hash conversion use-after-free executes arbitrary code

• RCE
• Bellek hatası

Bugün

PostgreSQL pltcl reentrant result conversion use-after-free executes arbitrary code

• RCE
• Bellek hatası

Bugün

PostgreSQL reindexdb index name quoting allows SQL injection

• RCE
• SQL enjeksiyonu

Bugün

PostgreSQL plperl tied-object exceptions follow stale sigjmp_buf

• RCE

Bugün