Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 41.312 CVE, 0 KEV kaydı · son NVD senkronu 15.11.2026 11:31. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-34599 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, there is an authenticated command injection vulnerability in the GetLogs Livewire component which allows users with team membership (lo | 8.8 | 07.07.2026 |
| CVE-2026-32718 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.466, mutating API validation endpoints are guarded by read ability, allowing read-scoped API tokens to perform state-changing operations suc | 6.5 | 07.07.2026 |
| CVE-2026-57572 | Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server accepted request-supplied browser_config.extra_args, which flowed into Chromium's launch arguments. An attacker could inject Chromium switches that replace a | 10.0 | 07.07.2026 |
| CVE-2026-57573 | Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, the Docker API server applied its SSRF destination check on the non-streaming /crawl path but not on the streaming path. handle_stream_crawl_request passed seed URLs straight to t | 8.6 | 07.07.2026 |
| CVE-2026-59711 | showdown contains a cross-site scripting vulnerability in metadata title handling that allows attackers to inject arbitrary HTML and JavaScript. When completeHTMLDocument option is enabled, unescaped less-than and greater-than characters in markdown frontmatte | 5.3 | 07.07.2026 |
| CVE-2026-59712 | Leantime's Users::getUser method in the JSON-RPC API lacks proper authorization checks, allowing authenticated users to retrieve full user credential rows including password hashes, TOTP secrets, and session tokens. Attackers can exploit this by calling users. | 8.6 | 07.07.2026 |
| CVE-2026-59713 | Leantime contains an OIDC login CSRF vulnerability in the verifyState() method that unconditionally returns true without validating state parameters. Attackers can craft malicious callback URLs with attacker-controlled authorization codes to perform session fi | 8.6 | 07.07.2026 |
| CVE-2026-55514 | vLLM is a library for LLM inference and serving. From 0.12.0 to before 0.24.0, sending a pure prompt embeds payload in a /v1/completions request with a model using M-RoPE causes EngineCore to fail an assertion and fatally crash, shutting down the entire server | 7.1 | 07.07.2026 |
| CVE-2026-55574 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, the structured_outputs.regex API parameter passes a user-supplied regular expression string directly to the grammar compiler backends with no compilation tim | 8.7 | 07.07.2026 |
| CVE-2026-55727 | A flaw in the authentication mechanism for video stream requests in Genetec Security Center 5.14.0.0 prior to build 5.14.178.18 may allow an unauthenticated attacker to access live video streams. | 7.5 | 07.07.2026 |
| CVE-2026-57571 | Crawl4AI is an open-source LLM-friendly web crawler and scraper. Prior to 0.9.0, when the crawler saves a downloaded file, the destination filename was taken from attacker-influenced input and joined to the downloads directory with no confinement. A filename c | 9.6 | 07.07.2026 |
| CVE-2026-48267 | DNG SDK versions 1.7.1 2536 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial-of-service condit | 5.5 | 07.07.2026 |
| CVE-2026-50135 | Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made RootMappingFs.statRoot use Stat (follows symlinks) instead of Lstat , so a direct resources.Get of a symlink pointing outside its mount returned the target's contents — letting | 6.9 | 07.07.2026 |
| CVE-2026-54234 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Prior to 0.24.0, a frontend-legal multi-request speculative decoding workload can cause the rejection sampler to produce a recovered token equal to the model vocabulary size | 7.5 | 07.07.2026 |
| CVE-2026-34038 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.469, an authenticated remote command injection vulnerability in application deployment handling allows users with application write permissi | 9.9 | 07.07.2026 |
| CVE-2026-21384 | Memory Corruption when updating prepared commands with invalid port indices based on user space input exceeds supported read client limits. | 5.3 | 07.07.2026 |
| CVE-2026-25268 | Memory Corruption when processing invalid HT40 channel layouts during dynamic channel switching operations. | 8.8 | 07.07.2026 |
| CVE-2026-25271 | Memory Corruption when processing asynchronous input parameters due to improper handling of modified values between check and use. | 7.0 | 07.07.2026 |
| CVE-2026-14468 | HashiCorp Terraform Enterprise contained an issue in its version control system (VCS) ingestion of registry modules that did not correctly enforce the intended boundary on packaged module content. This may allow an authenticated user to include files from outs | 7.7 | 07.07.2026 |
| CVE-2026-14471 | Improper Neutralization of Special Elements in the metrics-service retention policy management component in Amazon mcp-gateway-registry before 1.0.13 might allow an authenticated remote user to execute arbitrary SQL queries via a crafted table_name value that | 8.6 | 07.07.2026 |
| CVE-2026-21368 | Memory Corruption when parsing jpeg commands due to unaccounted extra writes to the buffer during validation checks. | 5.3 | 07.07.2026 |
| CVE-2026-21369 | Memory Corruption when handling flash commands due to outdated LED count values being used after userspace modification. | 5.3 | 07.07.2026 |
| CVE-2026-21370 | Memory Corruption when validating input batch size and buffer plane count exceeds maximum allowed values. | 5.3 | 07.07.2026 |
| CVE-2026-21379 | Memory Corruption when allocating memory with sizes that exceed the maximum allowed value. | 7.8 | 07.07.2026 |
| CVE-2026-21383 | Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique value for each call to ensure security. | 7.1 | 07.07.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.