Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 41.312 CVE, 0 KEV kaydı · son NVD senkronu 15.11.2026 11:31. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-27412 | Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions. | 8.1 | 02.07.2026 |
| CVE-2026-27414 | Contributor PHP Object Injection in Werkstatt <= 4.8.3 versions. | 8.8 | 02.07.2026 |
| CVE-2026-27419 | Subscriber Arbitrary File Upload in Zegen <= 1.1.9 versions. | 9.9 | 02.07.2026 |
| CVE-2026-27425 | Unauthenticated Cross Site Scripting (XSS) in Automotive Listings <= 18.6 versions. | 7.1 | 02.07.2026 |
| CVE-2026-27426 | Unauthenticated Cross Site Scripting (XSS) in Automotive Car Dealership Business <= 13.3.3 versions. | 7.1 | 02.07.2026 |
| CVE-2026-27430 | Unauthenticated Cross Site Scripting (XSS) in TheFox <= 3.9.76 versions. | 7.1 | 02.07.2026 |
| CVE-2026-27433 | Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a before 5.6.85. | 6.5 | 02.07.2026 |
| CVE-2026-27402 | Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPress <= 5.2 versions. | 7.1 | 02.07.2026 |
| CVE-2026-27404 | Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions. | 7.1 | 02.07.2026 |
| CVE-2026-27060 | Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember Premium allows Object Injection. This issue affects ARMember Premium: from n/a before 7.6. | 8.8 | 02.07.2026 |
| CVE-2026-11946 | An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service in open62541. The endpointUrl field of GetEndpointsRequest is not validated for length. An attacker can declare an arbitrarily large string (up to ~4.09 GB via | 7.5 | 02.07.2026 |
| CVE-2026-54431 | In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose JSON Web Key (jwk) header contains private key material. RFC 9449 section 4.3 step 7 requires the verifier to reject such a proof but oauth2_token_verify() function return | 5.1 | 02.07.2026 |
| CVE-2026-54430 | liboauth2 is vulnerable to Server-Side Request Forgery in oauth2_jose_jwks_aws_alb_resolve() function. The AWS ALB verifier reads both signer and kid from the unverified JWT header. If signer matches the configured ARN, kid is appended to alb_base_url without | 5.1 | 02.07.2026 |
| CVE-2026-8441 | The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprp_load_more_revs AJAX action in versions up to, and including, 12.7.2. The parameter is read via $_POST['notinstring'] and passed through san | 7.5 | 02.07.2026 |
| CVE-2026-8482 | A vulnerability was discovered on StormShield Network Security 4.3.0 to 4.3.41 (included), 4.8.0 to 4.8.15 (included) , 5.0.0 to 5.0.5 (included) There is a possible leak of secret information if administration commands have been passed with the CLI command l | 4.3 | 02.07.2026 |
| CVE-2026-13369 | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attach_files() function in versions up to, and including, 3.3.29. This is due to the get_files_for_attachment() function accepting a raw attacker-controlled 'files | 7.5 | 02.07.2026 |
| CVE-2026-14336 | PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in is_issuer_known, pia/models.py:139) instead of validating the issuer as a properly host-bounded URL. An attacker can craft an issue | 8.2 | 02.07.2026 |
| CVE-2026-8147 | In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any authenticated user to bypass experiment-level authorization controls on all trace operations, including | 8.1 | 02.07.2026 |
| CVE-2026-9563 | In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consumed while parsing a single JSON document. Applications that parse attacker- controlled JSON can be for | 7.5 | 02.07.2026 |
| CVE-2026-33592 | An unauthenticated remote attacker can exhaust server memory via the FindServers Discovery Service in open62541. The serverUris field of FindServersRequest is not validated for length or array size. An attacker can declare an arbitrarily large string (up to ~3 | 7.5 | 02.07.2026 |
| CVE-2026-5821 | The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to and including 1.7.4. This is due to insufficient path validation in the Image_Backup::remove() function where backup file paths stored in post meta are used dir | 8.1 | 02.07.2026 |
| CVE-2026-11592 | The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.9.27. This is due to the plugin not properly verifyin | 4.3 | 02.07.2026 |
| CVE-2026-57277 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the vari | 8.3 | 02.07.2026 |
| CVE-2026-57278 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the vari | 8.3 | 02.07.2026 |
| CVE-2026-57274 | GeoWebPlayer (also called "Web Plugin" in the GV-VMS documentation and "WS Player" for VMS-Cloud) is an addon that can be installed with various GeoVision software (GV-VMS, GV-Cloud, ...). It creates a websocket server that expands the capabilities of the vari | 8.3 | 02.07.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.