Kasım 2026: sömürülen ve yeni ciddi CVE kayıtları

PostgreSQL generation memory context integer wraparound executes arbitrary code

• RCE
• Bellek hatası

Bugün

PostgreSQL statistics import type confusion executes arbitrary code

• RCE

Bugün

PostgreSQL pg_dump tar restore.sql fails to block psql command injection

• Girişsiz RCE
• Komut enjeksiyonu

Bugün

PostgreSQL min/max aggregate type confusion executes arbitrary code

• RCE

Bugün

PostgreSQL portal setup use-after-free executes arbitrary code

• RCE
• Bellek hatası

Bugün

PostgreSQL commutator or negator result-type confusion executes arbitrary code

• RCE

Bugün

PostgreSQL REINDEX CONCURRENTLY does not block DROP INDEX during index functions

• RCE

Bugün

PostgreSQL tuple-size integer wraparound executes arbitrary code

• RCE
• Bellek hatası

Bugün

PostgreSQL materialized set-returning function type confusion executes arbitrary code

• RCE

Bugün

PostgreSQL dropped-column type confusion executes arbitrary code

• RCE

Bugün

PostgreSQL transition-table cursor use-after-free executes arbitrary code

• RCE
• Bellek hatası

Bugün

PostgreSQL type-cache invalidation gap executes arbitrary code

• RCE

Bugün

PostgreSQL logical replication can write to subscriber system catalogs, executing arbitrary code

• Girişsiz RCE
• Erişim denetimi (IDOR)

Bugün

PostgreSQL dblink reentrant disconnect use-after-free executes arbitrary code

• RCE
• Bellek hatası

Bugün

PostgreSQL extended-statistics pseudo-type confusion executes arbitrary code

• RCE

Bugün

PostgreSQL FDW batch-insert mismatch executes arbitrary code

• RCE
• Bellek hatası

Bugün

PostgreSQL expanded-record domain-check use-after-free executes arbitrary code

• RCE
• Bellek hatası

Bugün

PostgreSQL plpgsql record-field type confusion executes arbitrary code

• RCE

Bugün

PostgreSQL extension-script substitutions allow SQL injection through object names

• RCE
• SQL enjeksiyonu

Bugün

PostgreSQL dblink and subscriptions can append to arbitrary files

• Yol geçişi

Bugün

PostgreSQL output parameter type confusion executes arbitrary code

• RCE

Bugün

PostgreSQL type confusion after ALTER ... SET DATA TYPE executes arbitrary code

• RCE

Bugün

PostgreSQL extension script schema mishandling executes arbitrary SQL

• RCE

Bugün

Docker Sandboxes privilege escalation through untrusted state directories

• Yerel yetki yükseltme

docker · docker sandboxesBugün

SOGo before 5.12.13 Unauthenticated Password Recovery Brute Force

• Kimlik doğrulamasız

alinto · sogoBugün

SOGo before 5.12.13 S/MIME Certificate Spoofing via UIxMailView

• Kimlik doğrulamasız
• Zayıf kripto

alinto · sogoBugün

SOGo before 5.12.13 Missing Rate Limiting on TOTP Verification

• Kimlik doğrulamasız

alinto · sogoBugün

SOGo before 5.12.13 Denial of Service via Auxiliary IMAP Account Greeting Wait

alinto · sogoBugün

Arbitrary supervisor-mode function pointer injection via charger_set_prop() syscall in the charger driver API

zephyrproject · zephyrBugün

Sandboxed-containers: kernel: systemd-gpt-auto-generator: guest data leakage in confidential computing (sandboxed containers)

• Bilgi sızıntısı

red hat · red hat enterprise linux 10Bugün

Cross-Site Scripting in Kendo UI for jQuery Gantt Parent Dropdown

• Kimlik doğrulamasız
• XSS

progress software · kendo ui for jqueryBugün

Cross-Site Scripting in Kendo UI for jQuery Form Item Hints

• Kimlik doğrulamasız
• XSS

progress software · kendo ui for jqueryBugün

Cross-Site Scripting in Kendo UI for jQuery Spreadsheet Sheet Names

• Kimlik doğrulamasız
• XSS

progress software · kendo ui for jqueryBugün

Cross-Site Scripting in Kendo UI for jQuery Chart Shared Tooltip

• Kimlik doğrulamasız
• XSS

progress software · kendo ui for jqueryBugün

Cross-Site Scripting in Kendo UI for jQuery Chart Shared Tooltip

• Kimlik doğrulamasız
• XSS

progress software · kendo ui for jqueryBugün

Soup Sieve: Polynomial-time denial of service in the descendant combinator

• Kimlik doğrulamasız
• Hizmet dışı bırakma

facelessuser · soupsieveBugün

Soup Sieve: Exponential ReDoS in selector compilation via \9-run in CSS_ESCAPES/IDENTIFIER

• Kimlik doğrulamasız
• Hizmet dışı bırakma

facelessuser · soupsieveBugün

Attacker able to redirect a client's database traffic to a host they control via special characters in an SRV target, bypassing the SRV parent-domain guard

• Kimlik doğrulamasız

mongodb · node.js driverBugün

Freeradius: stack-based buffer overflow via unbounded eap-sim identity length

• Kimlik doğrulamasız
• Bellek hatası
• Hizmet dışı bırakma

red hat · red hat enterprise linux 10Bugün

Freeradius: stack buffer overflow via unchecked eap-fast sessionticket length

• Kimlik doğrulamasız
• Bellek hatası
• Hizmet dışı bırakma

red hat · red hat enterprise linux 10Bugün

The Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions 18.0.77 to 18.0.81.7, 18.0.82 to 18.0.82.2, allows cross-sub

webpros · pleskBugün

Uncaught Exceptions in Telerik UI for ASP.NET MVC Filter Processing

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma
• Hizmet dışı bırakma

progress software · telerik ui for asp.net mvcBugün

Uncontrolled Recursion in Telerik UI for ASP.NET Core FilterParser

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma
• Hizmet dışı bırakma

progress software · telerik ui for asp.net coreBugün

Elasticsearch data source resource proxy allows arbitrary methods and paths with the data source's credentials

• Yol geçişi

grafana · elasticsearch datasourceBugün

Joomla Extension - jdownloads.com - SSRF via external download URL field jDownloads < 4.1.8

• SSRF

jdownloads.com · jdownloads extension for joomlaBugün

Joomla Extension - jdownloads.com - Publishing of files without approval in jDownloads < 4.1.8

• Erişim denetimi (IDOR)

jdownloads.com · jdownloads extension for joomlaBugün

Joomla Extension - jdownloads.com - RCE through file upload in jDownloads < 4.1.8

• Girişsiz RCE
• Dosya yükleme

jdownloads.com · jdownloads extension for joomlaBugün

Joomla / WordPress Extension - acymailing.com - Exposure of sensitive information to an unauthorized actor in AcyMailing 6.0.0 - 11.1.1

• Kimlik doğrulamasız
• Bilgi sızıntısı

datasolution · acymailing extension for joomla and wordpressBugün

Akaunting 3.3.0 - Stored XSS through imported invoice numbers

• XSS

akaunting · akauntingBugün

Joomla / WordPress Extension - acymailing.com - Missing authorization on subscription changes in AcyMailing 1.0.0 - 11.1.1

• Kimlik doğrulamasız
• Erişim denetimi (IDOR)

datasolution · acymailing extension for joomla and wordpressBugün

URL Redirection to Untrusted Site in Progress Telerik UI for WinForms

• Açık yönlendirme

progress software · telerik ui for winformsBugün

URL Redirection to Untrusted Site in Progress Telerik UI for WPF

• Açık yönlendirme

progress software · telerik ui for wpfBugün

pgEdge Postgres MCP Server read-only mode can be bypassed by SQL statement smuggling through query_database

• SQL enjeksiyonu

pgedge · pgedge-postgres-mcpBugün

pgEdge Postgres MCP Server SQL injection through custom pl-do tool parameters

• SQL enjeksiyonu

pgedge · pgedge-postgres-mcpBugün

The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default.

• Kimlik doğrulamasız
• Gömülü kimlik bilgisi

datacomm · rmm+Bugün

WooCommerce PayPal Pro Payment Gateway < 4.1.1 Payment Bypass via pp_capture_order

• Kimlik doğrulamasız

wp.insider · payment gateway for paypal pro, paypal checkout & subscriptions for woocommerceBugün