Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 8.083 CVE, 0 KEV kaydı · son NVD senkronu 25.10.2026 04:11. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-55190 | Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, App\Utils\UrlUtils::isUrlSafe() is the SSRF guard applied to user-supplied import URLs. It can be bypassed two ways, both reach | 6.5 | 23.10.2026 |
| CVE-2026-54711 | pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.1, when using .pgpass, database connection information including the username and password will be logged at the debug level. This is | 2.4 | 23.10.2026 |
| CVE-2026-115752 | Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store icon fetcher that trusts absolute signalk.appIcon URLs. Attackers publishing npm packages with Signal K keywords can make servers request loo | 2.3 | 23.10.2026 |
| CVE-2026-115751 | Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows attackers to bypass the ssrf.blockedHosts denylist using trailing-dot hostnames. Attackers who control an OpenAPI spec URL or redirect target c | 6.3 | 23.10.2026 |
| CVE-2026-115750 | mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture Authorization and Cookie headers because safeFetch() forwards them on cross-origin redirects. Attackers controlling a spec host or abusing an | 6.3 | 23.10.2026 |
| CVE-2026-115749 | hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passing input to importlib.import_module(). Attackers controlling configuration values or com | 4.8 | 23.10.2026 |
| CVE-2026-115730 | i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadP | 2.3 | 23.10.2026 |
| CVE-2026-115729 | @pdfme/common from 5.5.10 before 6.2.6 contains a server-side request forgery vulnerability that allows attackers to bypass the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost alias | 8.9 | 23.10.2026 |
| CVE-2026-115728 | @hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposi | 8.7 | 23.10.2026 |
| CVE-2026-112863 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS kallyas allows Reflected XSS.This issue affects KALLYAS: from n/a through 4.25.0. | 7.1 | 23.10.2026 |
| CVE-2026-112859 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object Injection.This issue affects Little Birdies: from n/a through 1.3.16. | 9.8 | 23.10.2026 |
| CVE-2026-112858 | Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects Rhodos: from n/a through 1.3.3. | 9.8 | 23.10.2026 |
| CVE-2026-112856 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This issue affects Vagabonds: from n/a through 1.3.10. | 9.8 | 23.10.2026 |
| CVE-2026-112855 | Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects Redy: from n/a through 1.3.5. | 9.8 | 23.10.2026 |
| CVE-2026-112854 | Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object Injection.This issue affects Holistic Center: from n/a through 1.2.6. | 9.8 | 23.10.2026 |
| CVE-2026-112852 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue affects Helion: from n/a through 1.1.12. | 8.1 | 23.10.2026 |
| CVE-2026-112851 | Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue affects HotLock: from n/a through 1.3.9. | 9.8 | 23.10.2026 |
| CVE-2026-112850 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File Inclusion.This issue affects Your Dress: from n/a through 1.4.1. | 8.1 | 23.10.2026 |
| CVE-2026-112848 | Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue affects Hostme v2: from n/a through 7.0. | 9.8 | 23.10.2026 |
| CVE-2026-112847 | Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects ZenSoul: from n/a through 1.13. | 9.8 | 23.10.2026 |
| CVE-2026-112846 | Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This issue affects Save Life: from n/a through 1.2.14. | 9.8 | 23.10.2026 |
| CVE-2026-98911 | In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2_switch_rx() In case of an error in dpaa2_switch_rx(), the dpaa2_switch_free_fd() function is called in order to free the FD. This is incorrect since | 7.5 | 23.10.2026 |
| CVE-2026-98899 | In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: mark the rcu locked areas properly When we bump the uref counter, there's no need to keep the rcu lock because the referred hash table can't disappear. Also, from the same | 7.8 | 23.10.2026 |
| CVE-2026-98895 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Handle destroying table that has a miss table If a table has a miss table that was created by 'mlx5hws_table_set_default_miss' API function, its miss_tbl keeps the table that | 7.0 | 23.10.2026 |
| CVE-2026-98889 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before iwl_mvm_scan_fits(), so oversized IEs could be copied into the fixed preq buffer before length vali | 7.8 | 23.10.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.