Kasım 2026: sömürülen ve yeni ciddi CVE kayıtları

SharpEmu: Cross-site request forgery in the debugger frontend leads to arbitrary process execution

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma
• CSRF

sharpemu · sharpemuBugün

GetPaid WordPress Plugin < 2.8.63 Incorrect Authorization via REST API

• Erişim denetimi (IDOR)

ayecode ltd · payment forms, buy now buttons, and invoicing system | getpaidBugün

GetPaid WordPress Plugin < 2.8.63 Negative Quantity Payment Bypass

• Kimlik doğrulamasız

ayecode ltd · payment forms, buy now buttons, and invoicing system | getpaidBugün

Cisco Unified Computing System Central Remote Code Execution Vulnerability

• RCE
• Yol geçişi

cisco · cisco unified computing system central softwareBugün

Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References

• Kimlik doğrulamasız
• Bilgi sızıntısı

sensiolabs · symfonyBugün

In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient streng

• Kimlik doğrulamasız

yealink · avhubBugün

DataGerry < 3.3.0 SSTI via DocAPI Template Rendering

• RCE
• XSS
• SSTI

datagerry · datagerryBugün

bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list

• Kimlik doğrulamasız

bitcoinjs · bitcoinjs-libBugün

ESF-IDF: Unvalidated Stack Pointer at the ESP-TEE Privilege-Switch Boundary

• Yerel yetki yükseltme
• Bellek hatası

espressif · esp-idfBugün

ESP-IDF: Stack-Based Out-of-Bounds Write in Thread Border Router ND6 Option Parsing

• Kimlik doğrulamasız
• Bellek hatası

espressif · esp-idfBugün

ESP-IDF: Stack-based memory corruption in lwIP DNS/SNTP handling for multi-IP DNS responses

• Kimlik doğrulamasız
• Bellek hatası

espressif · esp-idfBugün

Linksys WRT54GL Ping Diagnostic apply.cgi system os command injection

• RCE
• Komut enjeksiyonu

linksys · wrt54glBugün

Linksys WRT54GL Traceroute Diagnostic Function apply.cgi system os command injection

• RCE
• Komut enjeksiyonu

linksys · wrt54glBugün

Linksys E5350 apply.cgi system os command injection

• Girişsiz RCE
• Komut enjeksiyonu

linksys · e5350Bugün

In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exp

• Girişsiz RCE
• Dosya yükleme

yealink · plug-in softwaresBugün

In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass vulnerability.

yealink · meetingboard proBugün

Invoice Ninja < 5.13.28 Broken Access Control via Vendor Portal

• Erişim denetimi (IDOR)

invoiceninja · invoiceninjaBugün

DeepSeek Harness Unauthenticated RPC Command Execution

• RCE
• Kimlik doğrulama atlatma

deepseek-ai · deepseek-harnessBugün

Nexus Repository 3 - SQL Injection in Reindex Search by Pattern Task

• SQL enjeksiyonu

sonatype · nexus repository 3Bugün

Nexus Repository 3 - Insufficiently Protected Credentials in Repository Signing Passphrase

• Bilgi sızıntısı

sonatype · nexus repository 3Bugün

Nexus Repository 3 - Insufficiently Protected Credentials in YUM Repository Signing Key

• Bilgi sızıntısı

sonatype · nexus repository 3Bugün

Nexus Repository 3 - Disabled or Locked Single Sign-On Users Can Sign In Again

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

sonatype · nexus repository 3Bugün

Nexus Repository 3 - Privilege Escalation via Rut Auth Capability Creation

• Erişim denetimi (IDOR)

sonatype · nexus repository 3Bugün

Linksys E5350 Setup Wizard apply.cgi save_settings missing authentication

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

linksys · e5350Bugün

Guest access to Firecracker process memory after a failed memory discard

• Yerel yetki yükseltme

aws · firecrackerBugün

WPO365 LOGIN before 45.2 SAML Replay Protection Bypass

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

wpo365 · wpo365 | seamless wordpress + microsoft integration (wpo365 | login)Bugün

Moleculer: Unauthenticated Denial of Service via negative length field in the TCP transporter packet parser

• Kimlik doğrulamasız
• Hizmet dışı bırakma

moleculerjs · moleculerBugün

vtenext before 25.02.2 SQL Injection via fieldname in Fax EditView

• SQL enjeksiyonu

vtenext · vtenextBugün

vtenext 25.02 before 25.02.1 Unverified Password Change via hub/rpwd.php

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

vtenext · vtenextBugün

Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackable

• Erişim denetimi (IDOR)

telepresenceio · telepresenceBugün

Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment secrets

• Kimlik doğrulama atlatma

telepresenceio · telepresenceBugün

ProxySQL: Uninitialized heap read in MySQL compressed packet decompression via zlib path

• Bellek hatası

sysown · proxysqlBugün

Traccar: Authentication bypass via path parameters exposes protected device media

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma
• Bilgi sızıntısı

traccar · traccarBugün

IBM MQ XMS .NET client is affected by an arbitrary code execution vulnerability

• RCE
• Deserializasyon

ibm · mqBugün

SumatraPDF: TLS hostname validation disabled in `HttpGet()`

• Kimlik doğrulamasız
• Zayıf kripto

sumatrapdfreader · sumatrapdfBugün

IBM MQ is affected by a denial of service vulnerability

• RCE
• Bellek hatası

ibm · mqBugün

IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability

• RCE

ibm · mqBugün

Netrek-client-cow through 3.3.3 Out-of-Bounds Read via SP_S_MESSAGE Packets

• Kimlik doğrulamasız

quozl · netrek-client-cowBugün

netrek-client-cow through 3.3.3 Stack Buffer Overflow via handleSMessage

• Kimlik doğrulamasız
• Bellek hatası

quozl · netrek-client-cowBugün

Comfast CF-WR632AX Multipart webmgnt path traversal

• Kimlik doğrulamasız
• Yol geçişi

comfast · cf-wr632axBugün

reSIProcate reTurn client through 1.14.0 Heap Buffer Overflow via TurnTcpSocket

• Kimlik doğrulamasız
• Bellek hatası

resiprocate · resiprocateBugün

CESNET ipfixcol2 2.7.1 before 2.9.0 Heap Buffer Overflow via TCP LZ4 Decoder

• Kimlik doğrulamasız
• Bellek hatası

cesnet · ipfixcol2Bugün

CESNET ipfixcol2 2.3.0 before 2.9.0 Buffer Overflow via Forwarder Output Plugin

• Kimlik doğrulamasız
• Bellek hatası

cesnet · ipfixcol2Bugün

Mistral Vibe before 2.25.5 on Windows Untrusted Search Path RCE via git.exe

• Girişsiz RCE

mistralai · mistral-vibeBugün

Mistral Vibe before 2.25.7 Code Execution via Git Filter Drivers

• Girişsiz RCE

mistralai · mistral-vibeBugün

Mistral Vibe before 3.0.3 RCE via Repository-Configured gpg.program

• Girişsiz RCE

mistralai · mistral-vibeBugün

WebVirtCloud through commit bb920b0 Missing Authorization in REST API Migrate and Create Endpoints

• Erişim denetimi (IDOR)

retspen · webvirtcloudBugün

IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability

• RCE

ibm · mqBugün

IBM MQ Managed File Transfer is affected by a denial of service vulnerability

• XXE

ibm · mqBugün

IBM MQ Managed File Transfer is vulnerable to XML external entity injection

• XXE

ibm · mqBugün

IBM MQ Managed File Transfer is vulnerable to XML external entity injection

• XXE

ibm · mqBugün

IBM MQ Managed File Transfer is affected by an arbitrary code execution vulnerability

• RCE

ibm · mqBugün

IBM Watson Speech Services Cartridge is vulnerable to a D.O.S. in Unpacker.

• Kimlik doğrulamasız
• Bellek hatası
• Hizmet dışı bırakma

ibm · watson speech services cartridgeBugün

IBM MQ is affected by a denial of service vulnerability

• Bellek hatası

ibm · mqBugün

IBM Watson Speech Services Cartridge is vulnerable to a Use After Free condition in cryptography wheels OpenSSL

• Girişsiz RCE
• Bellek hatası

ibm · watson speech services cartridgeBugün

GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

gpustack · gpustackBugün

GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP header) grants unauthenticated admin

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

gpustack · gpustackBugün

GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover

• Erişim denetimi (IDOR)

gpustack · gpustackBugün

VitaFit Android < 2.8.1.0 Insecure TLS Certificate Validation

• Kimlik doğrulamasız
• Zayıf kripto

shenzhen shine industrial co., ltd. · vitafitBugün

VitaFit Android < 2.8.1.0 Hardcoded Credentials Disclosure

• Kimlik doğrulamasız
• Gömülü kimlik bilgisi

shenzhen shine industrial co., ltd. · vitafitBugün

VitaFit Android < 2.8.1.0 Long-Lived Session Token Exposure

shenzhen shine industrial co., ltd. · vitafitBugün

VitaFit Android < 2.8.1.0 Custom URI Scheme Token Hijacking

shenzhen shine industrial co., ltd. · vitafitBugün

VitaFit Cloud API Broken Access Control via S3 Token Endpoint

• Erişim denetimi (IDOR)
• Bilgi sızıntısı

shenzhen shine industrial co., ltd. · vitafitBugün

h2o: heap exhaustion using capsules

• Kimlik doğrulamasız
• Hizmet dışı bırakma

h2o · h2oBugün

h2o: buffer overflow when using the %{error}x log directive

• Kimlik doğrulamasız
• Bellek hatası

h2o · h2oBugün

Readest: Unauthenticated SSRF / open request proxy in /api/opds/proxy

• Kimlik doğrulamasız
• SSRF

readest · readestBugün

Readest: Unscoped Tauri IPC download_file/upload_file allow arbitrary local file write and read from the webview

• Yol geçişi
• Yerel yetki yükseltme

readest · readestBugün

tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS

• Kimlik doğrulamasız
• Hizmet dışı bırakma

tsparticles · tsparticlesBugün

Yuxi sandbox isolation failure allows cross-tenant access and internal service compromise

• RCE
• Komut enjeksiyonu

xerrors · yuxiBugün

radare2: Remote code execution when loading Pebble/SMD binary

• RCE
• Yerel yetki yükseltme
• Komut enjeksiyonu

radareorg · radare2Bugün

Pocket ID: Email verification token remains valid after address change, enabling arbitrary verified-email spoofing

pocket-id · pocket-idBugün

Dulwich before 1.2.20 Commit Parser Tree Header Misinterpretation

• Kimlik doğrulamasız

jelmer · dulwichBugün

GLPI: Blind Time based SQLI in dropdowns

• SQL enjeksiyonu

glpi-project · glpiBugün

GLPI is a free asset and IT management software package.

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

glpi-project · glpiBugün

VitaFit Cloud API Storage Bucket Unauthenticated Access Information Disclosure

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

shenzhen shine industrial co., ltd. · vitafitBugün

VitaFit Cloud API Excessive Data Exposure via relation/search Endpoint

• Erişim denetimi (IDOR)

shenzhen shine industrial co., ltd. · vitafitBugün

VitaFit Cloud API Authentication Bypass via POST /front/login/sns/

• Kimlik doğrulamasız
• Kimlik doğrulama atlatma

shenzhen shine industrial co., ltd. · vitafitBugün

GLPI: Unallowed notifications sending

• Erişim denetimi (IDOR)

glpi-project · glpiBugün

Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences

pocket-id · pocket-idBugün

tsParticles: Generated release notes can execute shell commands in the stable publish workflow

• Girişsiz RCE
• Komut enjeksiyonu

tsparticles · tsparticlesBugün

tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process

• Kimlik doğrulamasız

tsparticles · tsparticlesBugün

VeraCrypt: Heap overflow and out-of-bounds read in Serializable deserialization (elevated Core service input path)

• Deserializasyon
• Yerel yetki yükseltme
• Bellek hatası

veracrypt · veracryptBugün

A flaw has been found in Edimax BR-6208AC 1.32.

• Girişsiz RCE
• Komut enjeksiyonu

Bugün

Incorrect privilege assignment issue exists in Hinemos.

ntt data intellilink corporation · hinemosBugün