Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 41.312 CVE, 0 KEV kaydı · son NVD senkronu 15.11.2026 11:31. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-55592 | Dashy is a self-hostable personal dashboard. Prior to 4.3.7, Dashy's workspace view trusts the url query parameter and assigns it directly to an iframe source without scheme validation. If a logged-in user opens a crafted workspace link containing a javascript | 3.9 | 08.07.2026 |
| CVE-2026-53511 | calibre is an e-book manager. Prior to 9.10.0, a malicious EPUB, OPF, or PDF file can execute arbitrary Python code when its metadata is read by calibre, including through Add books or Edit books, by embedding a custom column definition with a python: template | 8.5 | 08.07.2026 |
| CVE-2026-46672 | Actual is a local-first personal finance app. Prior to 26.6.0, @actual-app/cli ships a hand-rolled CSV serializer in packages/cli/src/output.ts used whenever the global --format csv option is passed, whose escapeCsv helper only handles RFC 4180 delimiter, quot | 4.6 | 08.07.2026 |
| CVE-2026-46700 | Actual is a local-first personal finance tool. Prior to 26.6.0, the GET /secret/:name endpoint in @actual-app/sync-server checks only that the caller has a valid session and does not verify the caller is an admin, while the sibling POST /secret/ handler enforc | 4.3 | 08.07.2026 |
| CVE-2026-49471 | Serena is a powerful MCP toolkit for coding that provides semantic retrieval and editing capabilities. Prior to v1.5.2, Serena's built-in web dashboard exposes an unauthenticated Flask API on a fixed, predictable port, with no authentication, no CSRF protectio | 8.3 | 08.07.2026 |
| CVE-2026-50007 | Actual is an open-source personal finance application. Prior to 26.7.0, a missing authorization issue allows a shared user with user_access on a budget file to perform owner-only file management actions. A non-owner shared user can call file-management endpoin | 7.2 | 08.07.2026 |
| CVE-2026-44877 | An unauthenticated remote disclosure vulnerability has been identified in HPE Networking Instant On 1830, 1930, and 1960 Switches. Successful exploitation of this vulnerability could allow an unauthenticated remote threat actor to access sensitive cryptographi | 6.5 | 07.07.2026 |
| CVE-2026-7017 | HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets. When the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argu | 7.1 | 07.07.2026 |
| CVE-2026-59708 | The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, allowing unauthenticated access to full portfolio data. Attackers with a private access ID can retrieve sensitive portfolio | 8.7 | 07.07.2026 |
| CVE-2026-59800 | 9Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not covered by the dashboard middleware matcher, so no authorization check is applied). The sudoPassword fiel | 9.2 | 07.07.2026 |
| CVE-2026-48954 | Improper validation leads to a generic XSS vector in the language override feature. | 5.9 | 07.07.2026 |
| CVE-2026-48955 | An improper access check allows unauthorized users to access workflow stage and transition information. | 6.4 | 07.07.2026 |
| CVE-2026-48956 | An improper access check allows users to display a list of modules in the frontend. | 6.4 | 07.07.2026 |
| CVE-2026-48957 | An improper access check allows unauthorized users to access com_privacy datasets. | 6.4 | 07.07.2026 |
| CVE-2026-48958 | An improper access check allows unauthorized users to create custom fields via webservices endpoints. | 6.4 | 07.07.2026 |
| CVE-2026-48949 | Lack of validation leads to an XSS vulnerability in the MFA management views. | 5.9 | 07.07.2026 |
| CVE-2026-48950 | Lack of escaping leads to an XSS vulnerability in the file management view of com_templates. | 5.9 | 07.07.2026 |
| CVE-2026-48951 | Lack of escaping leads to XSS vulnerabilities in modalreturn layouts of various components. | 5.9 | 07.07.2026 |
| CVE-2026-48952 | Lack of escaping leads to an XSS vulnerability in the update list view of com_installer. | 5.9 | 07.07.2026 |
| CVE-2026-48953 | Lack of escaping leads to an XSS vulnerability in the generic image output layout. | 5.9 | 07.07.2026 |
| CVE-2026-48947 | An improper access check allows privileged users to overwrite media files without editing permissions. | 6.4 | 07.07.2026 |
| CVE-2026-48948 | An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible. | 6.4 | 07.07.2026 |
| CVE-2026-23698 | Vtiger CRM through 8.4.0 contains an authenticated remote code execution vulnerability in the admin module import feature that allows administrator-level attackers to upload arbitrary PHP files by submitting a crafted zip archive through the ModuleManager impo | 8.6 | 07.07.2026 |
| CVE-2026-57851 | MSI Feature Manager contains a local privilege escalation vulnerability in the KernCoreLib64.sys kernel driver that allows any locally logged-on user to perform arbitrary physical memory read/write and unrestricted I/O port operations by accessing exposed IOCT | 8.5 | 07.07.2026 |
| CVE-2026-13019 | Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes have a missing authentication for critical function vulnerability allows a remote, unauthenticated attacker to access an unprotected API. The following versions are known to be a | 9.8 | 07.07.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.