İçeriğe atla
Noroxi

Yayın tarihine göre

Kasım 2026: sömürülen ve yeni ciddi CVE kayıtları

784 kayıt · 1 KEV. Yayın sırasıyla.

Listede olanlar: CISA KEV'deki, silahlaştırılmış istismarı olan, EPSS'i %10 ve üstü olan, son 3 yılda yayımlanıp PoC'si bulunan ve son 90 günde yayımlanan CVSS 7 ve üstü kayıtlar. Diğer kayıtlar arama ve üretici sayfalarında.

Ay sınırları UTC'dir; kayıt sayfasındaki yayın tarihiyle aynı kural.

Sayfa 7 / 8

  • CVE-2026-121606
    37İzleyin

    Qihoo 360 D621-2/D603-2/D600-2/D619/D606-6/D706 Firmware Signature Verification iscm verify_sign signature verification

    KritikCVSS 9,3İstismar yokEPSS %0

    qihoo 360 · d621-21 gün önce

  • CVE-2026-112116
    34İzleyin

    An exposed IOCTL with insufficient access control in ASUS System Control Interface allows a local, low-privileged user to read and write arb

    YüksekCVSS 8,5İstismar yokEPSS %0

    asus · system control interface1 gün önce

  • CVE-2026-121607
    38İzleyin

    Qihoo 360 D603-2/D600-2/D606-6/D706 iscm testspeed_command os command injection

    KritikCVSS 9,3İstismar yokEPSS %1

    qihoo 360 · d603-21 gün önce

  • CVE-2026-121609
    37İzleyin

    Qihoo 360 Whole Home Router M5 Boot Script mpt start hard-coded credentials

    KritikCVSS 9,3İstismar yokEPSS %0

    qihoo 360 · whole home router m51 gün önce

  • CVE-2026-84729
    28İzleyin

    Out-of-bounds write in certain ASUS Router firmware allow an unauthenticated nearby attacker to write data beyond the intended buffer or pot

    YüksekCVSS 7,2İstismar yokEPSS %0

    asus · router firmware1 gün önce

  • CVE-2026-84730
    34İzleyin

    Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute arbitrary commands with roo

    YüksekCVSS 8,7İstismar yokEPSS %0

    asus · router firmware1 gün önce

  • CVE-2026-121615
    37İzleyin

    Linksys E5600 Login mesh_login.cgi improper authentication

    KritikCVSS 9,3İstismar yokEPSS %0

    linksys · e56001 gün önce

  • CVE-2026-121617
    30İzleyin

    Linksys E5600 Header upload_fw.cgi init_multipart out-of-bounds write

    YüksekCVSS 7,7İstismar yokEPSS %0

    linksys · e56001 gün önce

  • CVE-2026-121802
    36İzleyin

    @better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any account's email address), bec

    KritikCVSS 9,1İstismar yokEPSS %0

    better-auth · better auth1 gün önce

  • CVE-2026-79405
    30İzleyin

    Improper Input Validation in Modem Firmware

    YüksekCVSS 7,5İstismar yokEPSS %0

    unisoc (shanghai) technologies co., ltd. · modemBugün

  • CVE-2026-80335
    30İzleyin

    Out-of-bounds Write in Bootloader

    YüksekCVSS 7,6İstismar yokEPSS %0

    unisoc (shanghai) technologies co., ltd. · bootloaderBugün

  • CVE-2025-11229
    28İzleyin

    Privilege Escalation via Client Credentials Grant Type in WSO2 Identity Server

    YüksekCVSS 7,2İstismar yokEPSS %0

    wso2 · wso2 identity serverBugün

  • CVE-2026-105413
    30İzleyin

    Form Maker by 10Web < 1.15.51 - Unauthenticated Stored XSS via Submission Field Values

    YüksekCVSS 7,5İstismar yokEPSS %0

    unknown · form maker by 10webBugün

  • CVE-2026-108041
    28İzleyin

    SEOPress < 10.4 - Authenticated Stored XSS via Analytics Tracking Settings

    YüksekCVSS 7,1İstismar yokEPSS %0

    unknown · seopressBugün

  • CVE-2026-118422
    28İzleyin

    Stape Conversion Tracking 2.3.0 - 2.3.10 - Unauthenticated SSRF and Same-Origin XSS via Proxy Sub-Path

    YüksekCVSS 7,1İstismar yokEPSS %0

    unknown · stape conversion trackingBugün

  • CVE-2026-11749
    30İzleyin

    A vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for one-time use, allowing rep

    YüksekCVSS 7,6İstismar yokEPSS %0

    ly corporation · armeriaBugün

  • CVE-2026-16511
    35İzleyin

    Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory

    YüksekCVSS 8,8İstismar yokEPSS %0

    zephyrproject · zephyrBugün

  • CVE-2026-77690
    40Planlayın

    Command injection vulnerability

    YüksekCVSS 8,8İstismar yokEPSS %15

    zohocorp · manageengine key manager plusBugün

  • CVE-2026-77779
    30İzleyin

    Improper access control vulnerability

    YüksekCVSS 7,7İstismar yokEPSS %0

    zohocorp · manageengine key manager plusBugün

  • CVE-2026-87038
    28İzleyin

    Time-of-check/time-of-use double fetch in the Zephyr i3c_transfer() syscall handler allows kernel-mode control-flow hijack from user mode

    YüksekCVSS 7,0İstismar yokEPSS %0

    zephyrproject · zephyrBugün

  • CVE-2026-87039
    31İzleyin

    I2S configure syscall handler passes an unvalidated user-supplied kernel object pointer to drivers

    YüksekCVSS 7,8İstismar yokEPSS %0

    zephyrproject · zephyrBugün

  • CVE-2026-87040
    33İzleyin

    Bluetooth LE Controller accepts received PDUs whose length field exceeds the configured maximum receive length, causing out-of-bounds read and write

    YüksekCVSS 8,3İstismar yokEPSS %0

    zephyrproject · zephyrBugün

  • CVE-2026-87041
    31İzleyin

    Inverted memory-permission check in the RTIO syscall verifier allows a user-mode thread to read and write arbitrary kernel memory

    YüksekCVSS 7,8İstismar yokEPSS %0

    zephyrproject · zephyrBugün

  • CVE-2026-121816
    34İzleyin

    About Time Technologies｜Herowatch Mini - Missing Authentication

    YüksekCVSS 8,7İstismar yokEPSS %0

    about time technologies · herowatch miniBugün

  • CVE-2026-121817
    34İzleyin

    About Time Technologies｜Herowatch Go Server - Insecure Direct Object Reference

    YüksekCVSS 8,7İstismar yokEPSS %0

    about time technologies · herowatch go serverBugün

  • CVE-2026-121818
    34İzleyin

    About Time Technologies｜Herowatch Go - Security Misconfiguration

    YüksekCVSS 8,5İstismar yokEPSS %0

    about time technologies · herowatch goBugün

  • CVE-2026-54851
    28İzleyin

    WordPress Contact Form by WPForms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    awesomemotive · contact form by wpformsBugün

  • CVE-2026-62000
    30İzleyin

    WordPress WCFM Marketplace plugin <= 3.8.2 - Broken Access Control vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %0

    wc lovers · wcfm marketplaceBugün

  • CVE-2026-119366
    28İzleyin

    WordPress wpDiscuz plugin <= 7.6.73 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    advancedcoding · wpdiscuzBugün

  • CVE-2026-119477
    28İzleyin

    WordPress WP Photo Album Plus plugin <= 9.3.05.003 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    jacob n. breetvelt · wp photo album plusBugün

  • CVE-2026-54861
    28İzleyin

    WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    aguila technologies · wp customer areaBugün

  • CVE-2026-56065
    30İzleyin

    WordPress Doofinder for WooCommerce plugin <= 2.17.2 - Sensitive Data Exposure vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %0

    doofinder · doofinder for woocommerceBugün

  • CVE-2026-57639
    28İzleyin

    WordPress WP Booking System plugin <= 2.1.0.6 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    roland murg · wp booking systemBugün

  • CVE-2026-57666
    28İzleyin

    WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    aguila technologies · wp customer areaBugün

  • CVE-2026-62007
    28İzleyin

    WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yokEPSS %0

    unlimited elements · unlimited elements for elementor (free widgets, addons, templates)Bugün

  • CVE-2026-62126
    30İzleyin

    WordPress SAML SP Single Sign On plugin <= 6.1.0 - Denial of Service Attack vulnerability

    YüksekCVSS 7,5İstismar yokEPSS %0

    miniorange · saml sp single sign onBugün

  • CVE-2026-114421
    33İzleyin

    Empty initial password permits GINA account takeover

    YüksekCVSS 8,3İstismar yokEPSS %0

    seppmail ag · seppmail secure email gateway (seg)Bugün

  • CVE-2026-114424
    36İzleyin

    Code execution through double evaluation in address replacement rules

    KritikCVSS 9,2İstismar yokEPSS %0

    seppmail ag · seppmail secure email gateway (seg)Bugün

  • CVE-2026-114425
    36İzleyin

    Forged LFT metadata permits arbitrary file read and deletion

    KritikCVSS 9,2İstismar yokEPSS %0

    seppmail ag · seppmail secure email gateway (seg)Bugün

  • CVE-2026-114426
    34İzleyin

    Pre-authentication upload parsing permits resource exhaustion

    YüksekCVSS 8,7İstismar yokEPSS %0

    seppmail ag · seppmail secure email gateway (seg)Bugün

  • CVE-2026-110022
    34İzleyin

    Signed plug-in validation bypass

    YüksekCVSS 8,6İstismar yokEPSS %0

    phoenix contact · plcnext engineerBugün

  • CVE-2026-110935
    34İzleyin

    Path traversal in plug-in deployment

    YüksekCVSS 8,6İstismar yokEPSS %0

    phoenix contact · plcnext engineerBugün

  • CVE-2026-111036
    33İzleyin

    Multiple vulnerabilities in Coupa’s Total Spend Management Platform

    YüksekCVSS 8,4İstismar yokEPSS %0

    coupa · coupa total spend management platformBugün

  • CVE-2026-111038
    29İzleyin

    Multiple vulnerabilities in Coupa’s Total Spend Management Platform

    YüksekCVSS 7,3İstismar yokEPSS %0

    coupa · coupa total spend management platformBugün

  • CVE-2026-115498
    28İzleyin

    Slim Jetpack <= 2.7.0.1 - Unauthenticated Stored Cross-Site Scripting via Contact Form 'Website' Field

    YüksekCVSS 7,2İstismar yokEPSS %0

    wingerspeed · slim jetpackBugün

  • CVE-2026-120422
    35İzleyin

    Insecure HTTP configuration retrieval in Sogou Input Method allows arbitrary code execution

    YüksekCVSS 8,9İstismar yok

    sogou · sogou input methodBugün

  • CVE-2026-120554
    35İzleyin

    Import and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save

    YüksekCVSS 8,8İstismar yokEPSS %0

    carazo · import and export users and customersBugün

  • CVE-2026-94459
    28İzleyin

    IRISPowerscan Default accounts with predictable credentials

    YüksekCVSS 7,2İstismar yokEPSS %0

    i.r.i.s s.a. · irispowerscanBugün

  • CVE-2026-94460
    28İzleyin

    IRISPowerscan Insecure default privilege assignment for installation account

    YüksekCVSS 7,2İstismar yokEPSS %0

    i.r.i.s s.a. · irispowerscanBugün

  • CVE-2026-100252
    34İzleyin

    Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID

    YüksekCVSS 8,6İstismar yok

    apache software foundation · apache zookeeperBugün

  • CVE-2026-100300
    34İzleyin

    Apache ZooKeeper: Unauthenticated persistent denial of service via unvalidated quota-node data and paths crashing the transaction-apply thread

    YüksekCVSS 8,7İstismar yok

    apache software foundation · apache zookeeperBugün

  • CVE-2026-100302
    28İzleyin

    Apache ZooKeeper: Denial of service through unbounded memory allocation in multiRead request handling

    YüksekCVSS 7,1İstismar yok

    apache software foundation · apache zookeeperBugün

  • CVE-2026-115448
    34İzleyin

    Apache ZooKeeper: Unbounded recursion in snapshot serialization allows a client to render the server unrecoverable

    YüksekCVSS 8,7İstismar yok

    apache software foundation · apache zookeeperBugün

  • CVE-2026-59264
    31İzleyin

    Apache OpenOffice: Uncontrolled search path element vulnerability in Windows installer

    YüksekCVSS 7,8İstismar yok

    apache software foundation · apache openofficeBugün

  • CVE-2026-59268
    29İzleyin

    Apache OpenOffice: Heap out-of-bounds write in WW8 PLCF reader

    YüksekCVSS 7,3İstismar yok

    apache software foundation · apache openofficeBugün

  • CVE-2026-90624
    29İzleyin

    Apache OpenOffice: PDF File Parsing Heap based Buffer-Overflow-Remote Code Execution Vulnerability

    YüksekCVSS 7,3İstismar yok

    apache software foundation · apache openofficeBugün

  • CVE-2026-90626
    29İzleyin

    Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files

    YüksekCVSS 7,3İstismar yok

    apache software foundation · apache openofficeBugün

  • CVE-2026-90628
    29İzleyin

    Apache OpenOffice: Stack overflow in CFF hint handling

    YüksekCVSS 7,3İstismar yok

    apache · openofficeBugün

  • CVE-2026-90629
    29İzleyin

    Apache OpenOffice: Out of bounds memory access during WMF import

    YüksekCVSS 7,3İstismar yok

    apache · openofficeBugün

  • CVE-2026-90634
    29İzleyin

    Apache OpenOffice: Out-of-bounds write when importing encrypted PDF files

    YüksekCVSS 7,3İstismar yok

    apache · openofficeBugün

  • CVE-2026-104799
    35İzleyin

    Mobile builder <= 1.4.2 - Authenticated (Subscriber+) Privilege Escalation to wcfm-profile-settings REST Route 'key'/'data' Parameters

    YüksekCVSS 8,8İstismar yok

    rnlab · mobile builderBugün

  • CVE-2026-97397
    28İzleyin

    Remove Google Fonts <= 1.7 - Unauthenticated Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output Buffer

    YüksekCVSS 7,2İstismar yok

    easywpstuff · remove google fonts – disable, block, or replace with bunny fonts for gdpr complianceBugün

  • CVE-2026-118513
    30İzleyin

    Symfony: X.509 Authentication Impersonation via DN Value Injection (incomplete fix for CVE-2026-45063)

    YüksekCVSS 7,7İstismar yok

    sensiolabs · symfonyBugün

  • CVE-2026-119468
    28İzleyin

    WordPress Noptin plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerability

    YüksekCVSS 7,1İstismar yok

    noptin newsletter team · noptinBugün

  • CVE-2026-119481
    39İzleyin

    WordPress JetFormBuilder plugin <= 3.6.7.1 - Privilege Escalation vulnerability

    KritikCVSS 9,8İstismar yok

    crocoblock · jetformbuilderBugün

  • CVE-2026-121144
    35İzleyin

    Hardcoded Credentials Vulnerability in Tata Motors iRA and iRA.ev mobile application

    YüksekCVSS 8,8İstismar yok

    tata motors · tata motors ira 2.0Bugün

  • CVE-2026-121145
    28İzleyin

    Insecure Configuration Vulnerability in Tata Motors iRA and iRA.ev mobile application

    YüksekCVSS 7,1İstismar yok

    tata motors · tata motors ira 2.0Bugün

  • CVE-2026-121147
    34İzleyin

    Security Misconfiguration Vulnerability in Tata Motors iRA and iRA.ev mobile application

    YüksekCVSS 8,5İstismar yok

    tata motors · tata motors ira 2.0Bugün

  • CVE-2026-121620
    33İzleyin

    CoopCycle coopcycle-web 5.6.0 before 6.20.0 Missing Zelty Webhook Signature Verification

    YüksekCVSS 8,3İstismar yok

    coopcycle · coopcycle-webBugün

  • CVE-2026-121939
    36İzleyin

    Databasement before 1.10.9 Account Takeover via OIDC Email Auto-Linking

    KritikCVSS 9,2İstismar yok

    david-crty · databasementBugün

  • CVE-2026-121940
    34İzleyin

    Stonewuu ai-fusion-video before 1.3.0 IDOR via Project, Asset and Script Controllers

    YüksekCVSS 8,7İstismar yok

    stonewuu · ai-fusion-videoBugün

  • CVE-2026-121941
    34İzleyin

    libmt32emu before 2.8.4 Heap Buffer Overflow via MidiStreamParserImpl::parseSysex

    YüksekCVSS 8,5İstismar yok

    munt · libmt32emuBugün

  • CVE-2026-121945
    28İzleyin

    CoopCycle coopcycle-web before 6.20.1 IDOR via Incident Resource and Action Endpoint

    YüksekCVSS 7,2İstismar yok

    coopcycle · coopcycle-webBugün

  • CVE-2026-65555
    39İzleyin

    WordPress Uncanny Toolkit for LearnDash plugin <= 3.8.2 - Privilege Escalation vulnerability

    KritikCVSS 9,8İstismar yok

    uncanny owl · uncanny toolkit for learndashBugün

  • CVE-2026-118391
    35İzleyin

    Unbounded query cache growth from interpolated JSON paths and splice lists in Ecto

    YüksekCVSS 8,9İstismar yok

    elixir-ecto · ectoBugün

  • CVE-2026-121637
    35İzleyin

    WatchGuard AuthPoint Gateway Improper HMAC Validation in LDAP Authentication Callback Allows Forged Authentication Results

    YüksekCVSS 8,9İstismar yok

    watchguard · authpoint authentication gatewayBugün

  • CVE-2026-121638
    36İzleyin

    WatchGuard AuthPoint Gateway Improper Certificate Validation Allows Man-in-the-Middle Attacks

    KritikCVSS 9,1İstismar yok

    watchguard · authpoint authentication gatewayBugün

  • CVE-2026-121639
    36İzleyin

    WatchGuard AuthPoint Gateway Improper Authentication Allows Unauthenticated Denial of Service

    KritikCVSS 9,2İstismar yok

    watchguard · authpoint authentication gatewayBugün

  • CVE-2026-121640
    36İzleyin

    WatchGuard AuthPoint Gateway Capture-replay Allows Unauthorized Administrative Actions

    KritikCVSS 9,1İstismar yok

    watchguard · authpoint authentication gatewayBugün

  • CVE-2026-122006
    39İzleyin

    The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write opera

    KritikCVSS 9,8İstismar yok

    rubyonrails · active storageBugün

  • CVE-2026-122007
    29İzleyin

    Oqtane Framework before 10.3.0 Broken Access Control via SettingController

    YüksekCVSS 7,4İstismar yok

    oqtane · oqtane.frameworkBugün

  • CVE-2026-109518
    30İzleyin

    APT RCE via hard link reuse

    YüksekCVSS 7,7Kavram kanıtı

    debian · aptBugün

  • CVE-2026-119746
    32İzleyin

    ProSoft ICX35 Login Lockout Bypass via Client-Side Cookies

    YüksekCVSS 8,2İstismar yok

    prosoft technology · x35-hwc-aBugün

  • CVE-2026-121950
    28İzleyin

    FreeRDP before 3.32.2 Heap Overflow via RDPGFX CREATE_SURFACE Integer Wrap

    YüksekCVSS 7,1İstismar yok

    freerdp · freerdpBugün

  • CVE-2026-121951
    34İzleyin

    FreeRDP 3.0.0 before 3.32.2 Denial of Service via Slow-Path Input Event

    YüksekCVSS 8,7İstismar yok

    freerdp · freerdpBugün

  • CVE-2026-121952
    37İzleyin

    FreeRDP before 3.32.2 Proxy Out-of-Bounds Write via Bitmap Cache v2 Capability

    KritikCVSS 9,3İstismar yok

    freerdp · freerdpBugün

  • CVE-2026-121953
    37İzleyin

    FreeRDP before 3.32.2 Use-After-Free via rdpgfx Dynamic Virtual Channel Close

    KritikCVSS 9,3İstismar yok

    freerdp · freerdpBugün

  • CVE-2026-121954
    28İzleyin

    FreeRDP before 3.32.2 Heap Out-of-Bounds Write in Planar Codec

    YüksekCVSS 7,1İstismar yok

    freerdp · freerdpBugün

  • CVE-2026-121955
    34İzleyin

    FreeRDP before 3.32.2 Use-After-Free in Smartcard Emulation ReleaseContext

    YüksekCVSS 8,7İstismar yok

    freerdp · freerdpBugün

  • CVE-2026-121956
    34İzleyin

    FreeRDP before 3.32.2 Double Free in WinPR Kerberos retrieveSomeTgt

    YüksekCVSS 8,7İstismar yok

    freerdp · freerdpBugün

  • CVE-2026-121957
    34İzleyin

    FreeRDP before 3.32.2 Use-After-Free via RDPGFX ResetGraphics Race

    YüksekCVSS 8,7İstismar yok

    freerdp · freerdpBugün

  • CVE-2026-121958
    34İzleyin

    FreeRDP through 3.32.1 Heap Out-of-Bounds Write via RDPGFX HashTable_GetKeys

    YüksekCVSS 8,7İstismar yok

    freerdp · freerdpBugün

  • CVE-2026-121959
    28İzleyin

    FreeRDP before 3.32.2 Infinite Loop via Truncated WebSocket Frame

    YüksekCVSS 7,1İstismar yok

    freerdp · freerdpBugün

  • CVE-2026-121960
    34İzleyin

    FreeRDP before 3.32.2 Unauthenticated Denial of Service via CredSSP TSRequest

    YüksekCVSS 8,7İstismar yok

    freerdp · freerdpBugün

  • CVE-2026-121961
    32İzleyin

    FreeRDP before 3.32.2 Use-After-Free via DRDYNVC Tracker Race

    YüksekCVSS 8,2İstismar yok

    freerdp · freerdpBugün

  • CVE-2026-121962
    28İzleyin

    FreeRDP before 3.32.2 Heap Buffer Overflow via Early User Authorization Read

    YüksekCVSS 7,2İstismar yok

    freerdp · freerdpBugün

  • CVE-2026-121963
    32İzleyin

    FreeRDP before 3.32.2 Use-After-Free via Dynamic rdpsnd Channel Close

    YüksekCVSS 8,2İstismar yok

    freerdp · freerdpBugün

  • CVE-2026-121964
    34İzleyin

    FreeRDP before 3.32.2 Heap Buffer Overflow via rpc_client_recv_fragment

    YüksekCVSS 8,7İstismar yok

    freerdp · freerdpBugün

  • CVE-2026-121966
    28İzleyin

    Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak

    YüksekCVSS 7,0İstismar yok

    traefik · traefikBugün

  • CVE-2026-122032
    28İzleyin

    SPIP before 4.4.29 Authenticated SQL Injection via where Parameter

    YüksekCVSS 7,1İstismar yok

    spip · spipBugün