Kasım 2026: sömürülen ve yeni ciddi CVE kayıtları
3.744 kayıt · 10 KEV. Yayın sırasıyla.
Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.
Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.
Sayfa 38 / 38
| Aksiyon | CVE | Zafiyet | Ciddiyet | KEV | EPSS | Yayın |
|---|---|---|---|---|---|---|
28İzleyin | CVE-2024-21954İstismar yok | Improper exception handling in IOMMU could allow an invalidate command to be sent to PCIe devices that do not support Address Translation Caamd · amd epyc™ 7003 series processors · CWE-754 | Yüksek7,0 | — | — | Bugün |
27İzleyin | CVE-2026-0101Kavram kanıtı | Improper validation of specified quantities in input within AMD Power Management Firmware (PMFW) could allow a local attacker to pass unsaniamd · amd epyc™ 9005 series processors · CWE-1284 | Orta6,8 | — | — | Bugün |
32İzleyin | CVE-2026-117544İstismar yok | Joomla Extension - jdownloads.com - IDOR allowing restricted file downloads in jDownloads < 4.1.8jdownloads.com · jdownloads extension for joomla · CWE-200 | Yüksek8,2 | — | — | Bugün |
28İzleyin | CVE-2026-120467İstismar yok | Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1datasolution · acymailing extension for joomla and wordpress · CWE-639 | Yüksek7,1 | — | — | Bugün |
35İzleyin | CVE-2026-18379İstismar yok | Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepored hat · red hat enterprise linux 10 · CWE-22 | Yüksek8,8 | — | — | Bugün |
28İzleyin | CVE-2025-0043İstismar yok | Incorrect directory permissions within AMD Vivado™ Lab Solutions could allow a local user-privileged attacker to escalate their privileges, amd · vivado software · CWE-276 | Yüksek7,0 | — | — | Bugün |
28İzleyin | CVE-2026-107152İstismar yok | Rubygem-smart_proxy_dynflow: dynflow console authorizes any client certificate the capsule ca signedred hat · red hat satellite 6 · CWE-287 | Yüksek7,1 | — | — | Bugün |
38İzleyin | CVE-2026-107360İstismar yok | Rubygem-safemode: safemode: jail allow-list bypass via op-assign expressionsred hat · red hat satellite 6 · CWE-183 | Kritik9,6 | — | — | Bugün |
30İzleyin | CVE-2026-107443İstismar yok | Foreman: foreman: api host template render discloses secrets to view_hosts users (incomplete cve-2026-96659 fix)red hat · red hat satellite 6 · CWE-862 | Yüksek7,7 | — | — | Bugün |
28İzleyin | CVE-2026-111456İstismar yok | Candlepin: consumer certificate can register systems in another organizationred hat · red hat satellite 6 · CWE-639 | Yüksek7,1 | — | — | Bugün |
37İzleyin | CVE-2026-124002İstismar yok | Dixell/Copeland XWEB EVO Pre-Auth OS Command Injection via Usernamecopeland · xweb evo · CWE-78 | Kritik9,3 | — | — | Bugün |
34İzleyin | CVE-2026-124003İstismar yok | Dixell/Copeland XWEB Setuid Lua CGI Root Command Injectioncopeland · xweb evo · CWE-250 | Yüksek8,5 | — | — | Bugün |
37İzleyin | CVE-2026-124004İstismar yok | Dixell/Copeland XWEB EVO Hardcoded Administrator Backdoor Passwordcopeland · xweb evo · CWE-798 | Kritik9,3 | — | — | Bugün |
36İzleyin | CVE-2026-124005İstismar yok | Dixell/Copeland XWEB EVO Predictable Administrator Password Generationcopeland · xweb evo · CWE-330 | Kritik9,2 | — | — | Bugün |
36İzleyin | CVE-2026-124006İstismar yok | Dixell/Copeland XWEB EVO Predictable Root Password Generationcopeland · xweb evo · CWE-798 | Kritik9,2 | — | — | Bugün |
36İzleyin | CVE-2026-124007İstismar yok | Dixell/Copeland XWEB EVO Pre-Auth OS Command Injection via Password Fieldcopeland · xweb evo · CWE-78 | Kritik9,2 | — | — | Bugün |
34İzleyin | CVE-2026-124008İstismar yok | Dixell/Copeland XWEB EVO OS Command Injection via devices.luacopeland · xweb evo · CWE-78 | Yüksek8,6 | — | — | Bugün |
34İzleyin | CVE-2026-124009İstismar yok | Dixell/Copeland XWEB EVO OS Command Injection via backup.luacopeland · xweb evo · CWE-78 | Yüksek8,6 | — | — | Bugün |
37İzleyin | CVE-2026-124010İstismar yok | Dixell/Copeland XWEB EVO Unauthenticated Command Injection via xwconsole.cgicopeland · xweb evo · CWE-78 | Kritik9,3 | — | — | Bugün |
36İzleyin | CVE-2026-124012İstismar yok | Dixell/Copeland XWEB EVO Hardcoded Administrator Daily Password Authentication Bypasscopeland · xweb evo · CWE-798 | Kritik9,2 | — | — | Bugün |
34İzleyin | CVE-2026-124013İstismar yok | Dixell/Copeland XWEB EVO OS Command Injection via api.luacopeland · xweb evo · CWE-78 | Yüksek8,7 | — | — | Bugün |
35İzleyin | CVE-2026-124014İstismar yok | Dixell/Copeland XWEB EVO Unauthenticated Configuration Write via config.luacopeland · xweb evo · CWE-306 | Yüksek8,8 | — | — | Bugün |
32İzleyin | CVE-2026-124015İstismar yok | Dixell/Copeland XWEB EVO Authentication Bypass via users.luacopeland · xweb evo · CWE-306 | Yüksek8,2 | — | — | Bugün |
32İzleyin | CVE-2026-45265İstismar yok | Atomic-Read-File RecordCount Stack-Based Out-of-Bounds Write in bacnet-stackbacnet-stack · bacnet-stack · CWE-121 | Yüksek8,2 | — | — | Bugün |
30İzleyin | CVE-2026-45341İstismar yok | BACnet Stack: NULL pointer dereference in bacnet_device_object_reference_decode() when WriteProperty updates Structured View subordinate-listbacnet-stack · bacnet-stack · CWE-476 | Yüksek7,5 | — | — | Bugün |
30İzleyin | CVE-2026-46674İstismar yok | BACnet Stack: Out-of-Bounds Read in AtomicWriteFile Record Decoder via Unbounded returnedRecordCountbacnet-stack · bacnet-stack · CWE-121 | Yüksek7,5 | — | — | Bugün |
30İzleyin | CVE-2026-47217İstismar yok | BACnet Stack: Channel member self-reference causes uncontrolled recursion and stack overflow in default BACnet/IP serverbacnet-stack · bacnet-stack · CWE-20 | Yüksek7,5 | — | — | Bugün |
32İzleyin | CVE-2026-47257İstismar yok | BACnet Stack: ReinitializeDevice ENDRESTORE can delete existing objects on an empty restore file and still return successbacnet-stack · bacnet-stack · CWE-670 | Yüksek8,1 | — | — | Bugün |
32İzleyin | CVE-2026-47258İstismar yok | BACnet Stack: Stack-based buffer overflow in Notification Class AddListElement recipient-list decodingbacnet-stack · bacnet-stack · CWE-20 | Yüksek8,2 | — | — | Bugün |
32İzleyin | CVE-2026-47259İstismar yok | BACnet Stack: Stack-based buffer overflow in Notification Class RemoveListElement recipient-list decodingbacnet-stack · bacnet-stack · CWE-121 | Yüksek8,2 | — | — | Bugün |
32İzleyin | CVE-2026-47710İstismar yok | BACnet Stack: Loop reference to long Structured View description causes stack-buffer-overflowbacnet-stack · bacnet-stack · CWE-121 | Yüksek8,2 | — | — | Bugün |
34İzleyin | CVE-2026-47711İstismar yok | BACnet Stack: Stack buffer overflow in Loop internal ReadProperty path via Life_Safety_Zone.accepted-modes on the default BACnet/IP serverbacnet-stack · bacnet-stack · CWE-121 | Yüksek8,6 | — | — | Bugün |
28İzleyin | CVE-2026-52786İstismar yok | BACnet Stack: malicious ReadPropertyMultiple-ACK with excessive properties causes global-buffer-overflow in ProcessRPMData()bacnet-stack · bacnet-stack · CWE-129 | Yüksek7,1 | — | — | Bugün |
37İzleyin | CVE-2026-68548İstismar yok | Algernon: Case-insensitive filesystem lets unauthenticated requests bypass /admin,/repo,/data permission-prefix gatexyproto · algernon · CWE-178 | Kritik9,4 | — | — | Bugün |
34İzleyin | CVE-2026-106018İstismar yok | Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO FW allows Authentication Bypass.johnson controls · easyio fw · CWE-288 | Yüksek8,7 | — | — | Bugün |
34İzleyin | CVE-2026-126793İstismar yok | Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapperaws · aws-advanced-go-wrapper · CWE-426 | Yüksek8,6 | — | — | Bugün |
34İzleyin | CVE-2026-127208İstismar yok | datamodel-code-generator < 0.84.0 Code Injection via x-python-type Annotationdatamodel-code-generator · datamodel-code-generator · CWE-94 | Yüksek8,6 | — | — | Bugün |
35İzleyin | CVE-2026-86322İstismar yok | Foreman: authorization flaw in the foreman::controller::useraware#find_user handling used by api::v2::personalaccesstokenscontrollerred hat · red hat satellite 6 · CWE-639 | Yüksek8,8 | — | — | Bugün |
29İzleyin | CVE-2026-126823İstismar yok | Atlas SQL JDBC driver loads a native library it did not write: NativeLoader tolerates a pre-existing libmongosqltranslate.so in a shared temp dirmongodb · atlas sql jdbc driver · CWE-377 | Yüksek7,3 | — | — | Bugün |
28İzleyin | CVE-2026-127211İstismar yok | MultiVendorX WordPress Plugin < 5.0.22 Broken Access Control via stores REST Routemultivendorx · multivendorx – woocommerce multivendor marketplace ai powered solutions · CWE-862 | Yüksek7,1 | — | — | Bugün |
30İzleyin | CVE-2026-126366İstismar yok | msgpack-java JRuby decoder allocates from declared header counts with no cap: 5-byte message forces multi-GiB OOMmsgpack · msgpack-ruby · CWE-770 | Yüksek7,5 | — | — | Bugün |
34İzleyin | CVE-2026-128066İstismar yok | Pillow: Memory DoS in TIFF and EXIF IFD parsing via overlapping tag datapython-pillow · pillow · CWE-770 | Yüksek8,7 | — | — | Bugün |
33İzleyin | CVE-2026-128067İstismar yok | Pillow: Heap buffer overflow saving TIFF with libtiff when tags override image sizepython-pillow · pillow · CWE-787 | Yüksek8,4 | — | — | Bugün |
30İzleyin | GHSA-73v3-wf97-vpgjİstismar yok | msgpack-ruby JRuby decoder makes uncapped header-count allocations; a 5-byte message forces multi-GiB OOMCWE-1325 | Yüksek7,5 | — | — | Bugün |
- CVE-2024-2195428İzleyin
Improper exception handling in IOMMU could allow an invalidate command to be sent to PCIe devices that do not support Address Translation Ca
YüksekCVSS 7,0İstismar yokamd · amd epyc™ 7003 series processorsBugün
- CVE-2026-010127İzleyin
Improper validation of specified quantities in input within AMD Power Management Firmware (PMFW) could allow a local attacker to pass unsani
OrtaCVSS 6,8Kavram kanıtıamd · amd epyc™ 9005 series processorsBugün
- CVE-2026-11754432İzleyin
Joomla Extension - jdownloads.com - IDOR allowing restricted file downloads in jDownloads < 4.1.8
YüksekCVSS 8,2İstismar yokjdownloads.com · jdownloads extension for joomlaBugün
- CVE-2026-12046728İzleyin
Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing 1.0.0 - 11.1.1
YüksekCVSS 7,1İstismar yokdatasolution · acymailing extension for joomla and wordpressBugün
- CVE-2026-1837935İzleyin
Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: path traversal via unsanitized repo name in addrepo/removerepo
YüksekCVSS 8,8İstismar yokred hat · red hat enterprise linux 10Bugün
- CVE-2025-004328İzleyin
Incorrect directory permissions within AMD Vivado™ Lab Solutions could allow a local user-privileged attacker to escalate their privileges,
YüksekCVSS 7,0İstismar yokamd · vivado softwareBugün
- CVE-2026-10715228İzleyin
Rubygem-smart_proxy_dynflow: dynflow console authorizes any client certificate the capsule ca signed
YüksekCVSS 7,1İstismar yokred hat · red hat satellite 6Bugün
- CVE-2026-10736038İzleyin
Rubygem-safemode: safemode: jail allow-list bypass via op-assign expressions
KritikCVSS 9,6İstismar yokred hat · red hat satellite 6Bugün
- CVE-2026-10744330İzleyin
Foreman: foreman: api host template render discloses secrets to view_hosts users (incomplete cve-2026-96659 fix)
YüksekCVSS 7,7İstismar yokred hat · red hat satellite 6Bugün
- CVE-2026-11145628İzleyin
Candlepin: consumer certificate can register systems in another organization
YüksekCVSS 7,1İstismar yokred hat · red hat satellite 6Bugün
- CVE-2026-12400237İzleyin
Dixell/Copeland XWEB EVO Pre-Auth OS Command Injection via Username
KritikCVSS 9,3İstismar yokcopeland · xweb evoBugün
- CVE-2026-12400334İzleyin
Dixell/Copeland XWEB Setuid Lua CGI Root Command Injection
YüksekCVSS 8,5İstismar yokcopeland · xweb evoBugün
- CVE-2026-12400437İzleyin
Dixell/Copeland XWEB EVO Hardcoded Administrator Backdoor Password
KritikCVSS 9,3İstismar yokcopeland · xweb evoBugün
- CVE-2026-12400536İzleyin
Dixell/Copeland XWEB EVO Predictable Administrator Password Generation
KritikCVSS 9,2İstismar yokcopeland · xweb evoBugün
- CVE-2026-12400636İzleyin
Dixell/Copeland XWEB EVO Predictable Root Password Generation
KritikCVSS 9,2İstismar yokcopeland · xweb evoBugün
- CVE-2026-12400736İzleyin
Dixell/Copeland XWEB EVO Pre-Auth OS Command Injection via Password Field
KritikCVSS 9,2İstismar yokcopeland · xweb evoBugün
- CVE-2026-12400834İzleyin
Dixell/Copeland XWEB EVO OS Command Injection via devices.lua
YüksekCVSS 8,6İstismar yokcopeland · xweb evoBugün
- CVE-2026-12400934İzleyin
Dixell/Copeland XWEB EVO OS Command Injection via backup.lua
YüksekCVSS 8,6İstismar yokcopeland · xweb evoBugün
- CVE-2026-12401037İzleyin
Dixell/Copeland XWEB EVO Unauthenticated Command Injection via xwconsole.cgi
KritikCVSS 9,3İstismar yokcopeland · xweb evoBugün
- CVE-2026-12401236İzleyin
Dixell/Copeland XWEB EVO Hardcoded Administrator Daily Password Authentication Bypass
KritikCVSS 9,2İstismar yokcopeland · xweb evoBugün
- CVE-2026-12401334İzleyin
Dixell/Copeland XWEB EVO OS Command Injection via api.lua
YüksekCVSS 8,7İstismar yokcopeland · xweb evoBugün
- CVE-2026-12401435İzleyin
Dixell/Copeland XWEB EVO Unauthenticated Configuration Write via config.lua
YüksekCVSS 8,8İstismar yokcopeland · xweb evoBugün
- CVE-2026-12401532İzleyin
Dixell/Copeland XWEB EVO Authentication Bypass via users.lua
YüksekCVSS 8,2İstismar yokcopeland · xweb evoBugün
- CVE-2026-4526532İzleyin
Atomic-Read-File RecordCount Stack-Based Out-of-Bounds Write in bacnet-stack
YüksekCVSS 8,2İstismar yokbacnet-stack · bacnet-stackBugün
- CVE-2026-4534130İzleyin
BACnet Stack: NULL pointer dereference in bacnet_device_object_reference_decode() when WriteProperty updates Structured View subordinate-list
YüksekCVSS 7,5İstismar yokbacnet-stack · bacnet-stackBugün
- CVE-2026-4667430İzleyin
BACnet Stack: Out-of-Bounds Read in AtomicWriteFile Record Decoder via Unbounded returnedRecordCount
YüksekCVSS 7,5İstismar yokbacnet-stack · bacnet-stackBugün
- CVE-2026-4721730İzleyin
BACnet Stack: Channel member self-reference causes uncontrolled recursion and stack overflow in default BACnet/IP server
YüksekCVSS 7,5İstismar yokbacnet-stack · bacnet-stackBugün
- CVE-2026-4725732İzleyin
BACnet Stack: ReinitializeDevice ENDRESTORE can delete existing objects on an empty restore file and still return success
YüksekCVSS 8,1İstismar yokbacnet-stack · bacnet-stackBugün
- CVE-2026-4725832İzleyin
BACnet Stack: Stack-based buffer overflow in Notification Class AddListElement recipient-list decoding
YüksekCVSS 8,2İstismar yokbacnet-stack · bacnet-stackBugün
- CVE-2026-4725932İzleyin
BACnet Stack: Stack-based buffer overflow in Notification Class RemoveListElement recipient-list decoding
YüksekCVSS 8,2İstismar yokbacnet-stack · bacnet-stackBugün
- CVE-2026-4771032İzleyin
BACnet Stack: Loop reference to long Structured View description causes stack-buffer-overflow
YüksekCVSS 8,2İstismar yokbacnet-stack · bacnet-stackBugün
- CVE-2026-4771134İzleyin
BACnet Stack: Stack buffer overflow in Loop internal ReadProperty path via Life_Safety_Zone.accepted-modes on the default BACnet/IP server
YüksekCVSS 8,6İstismar yokbacnet-stack · bacnet-stackBugün
- CVE-2026-5278628İzleyin
BACnet Stack: malicious ReadPropertyMultiple-ACK with excessive properties causes global-buffer-overflow in ProcessRPMData()
YüksekCVSS 7,1İstismar yokbacnet-stack · bacnet-stackBugün
- CVE-2026-6854837İzleyin
Algernon: Case-insensitive filesystem lets unauthenticated requests bypass /admin,/repo,/data permission-prefix gate
KritikCVSS 9,4İstismar yokxyproto · algernonBugün
- CVE-2026-10601834İzleyin
Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO FW allows Authentication Bypass.
YüksekCVSS 8,7İstismar yokjohnson controls · easyio fwBugün
- CVE-2026-12679334İzleyin
Privilege escalation in Aurora PostgreSQL dialect detection in AWS Advanced Go Wrapper
YüksekCVSS 8,6İstismar yokaws · aws-advanced-go-wrapperBugün
- CVE-2026-12720834İzleyin
datamodel-code-generator < 0.84.0 Code Injection via x-python-type Annotation
YüksekCVSS 8,6İstismar yokdatamodel-code-generator · datamodel-code-generatorBugün
- CVE-2026-8632235İzleyin
Foreman: authorization flaw in the foreman::controller::useraware#find_user handling used by api::v2::personalaccesstokenscontroller
YüksekCVSS 8,8İstismar yokred hat · red hat satellite 6Bugün
- CVE-2026-12682329İzleyin
Atlas SQL JDBC driver loads a native library it did not write: NativeLoader tolerates a pre-existing libmongosqltranslate.so in a shared temp dir
YüksekCVSS 7,3İstismar yokmongodb · atlas sql jdbc driverBugün
- CVE-2026-12721128İzleyin
MultiVendorX WordPress Plugin < 5.0.22 Broken Access Control via stores REST Route
YüksekCVSS 7,1İstismar yokmultivendorx · multivendorx – woocommerce multivendor marketplace ai powered solutionsBugün
- CVE-2026-12636630İzleyin
msgpack-java JRuby decoder allocates from declared header counts with no cap: 5-byte message forces multi-GiB OOM
YüksekCVSS 7,5İstismar yokmsgpack · msgpack-rubyBugün
- CVE-2026-12806634İzleyin
Pillow: Memory DoS in TIFF and EXIF IFD parsing via overlapping tag data
YüksekCVSS 8,7İstismar yokpython-pillow · pillowBugün
- CVE-2026-12806733İzleyin
Pillow: Heap buffer overflow saving TIFF with libtiff when tags override image size
YüksekCVSS 8,4İstismar yokpython-pillow · pillowBugün
- GHSA-73v3-wf97-vpgj30İzleyin
msgpack-ruby JRuby decoder makes uncapped header-count allocations; a 5-byte message forces multi-GiB OOM
YüksekCVSS 7,5İstismar yokBugün