Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 41.312 CVE, 0 KEV kaydı · son NVD senkronu 15.11.2026 17:31. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-54834 | Unauthenticated Sensitive Data Exposure in Object Cache 4 everyone <= 2.3.2 versions. | 7.5 | 26.06.2026 |
| CVE-2026-52701 | Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions. | 6.5 | 26.06.2026 |
| CVE-2026-54820 | Unauthenticated SQL Injection in JetBooking <= 4.0.4.1 versions. | 9.3 | 26.06.2026 |
| CVE-2026-24547 | Unauthenticated Broken Access Control in SiteGround Email Marketing <= 1.7.5 versions. | 5.3 | 26.06.2026 |
| CVE-2026-57923 | In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings | 7.5 | 26.06.2026 |
| CVE-2026-57924 | In JetBrains YouTrack before 2026.2.16593 default role configuration exposed excessive user profile details | 5.3 | 26.06.2026 |
| CVE-2026-57925 | In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags | 5.3 | 26.06.2026 |
| CVE-2026-57926 | In JetBrains YouTrack before 2026.2.16593 the websandbox bridge was vulnerable to a prototype pollution attack | 9.8 | 26.06.2026 |
| CVE-2026-57921 | In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint | 7.5 | 26.06.2026 |
| CVE-2026-57922 | In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible | 5.3 | 26.06.2026 |
| CVE-2026-53914 | In JetBrains Kotlin before 2.4.20 code execution was possible via unsafe deserialization in the build cache metadata | 9.8 | 26.06.2026 |
| CVE-2026-13426 | The Mattermost Go module github.com/mattermost/mattermost/server/public versions < v0.1.22 fail to validate path parameters when constructing API route paths which allows an attacker to redirect API calls to unintended endpoints via crafted IDs containing path | 5.4 | 26.06.2026 |
| CVE-2026-57920 | Peplink InControl 2 through 2.14.2 before 2026-06-03 allows use of a semicolon to bypass access-control rules for certain /rest/o/{orgId} endpoints. | 7.7 | 26.06.2026 |
| CVE-2026-57915 | It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are recommended to upgrade to version 2.1.2, which fixes this issue. | 7.3 | 26.06.2026 |
| CVE-2026-40711 | Dell Dell Container Storage Modules, version(s) csi-powerstore v2.16.0, csi-unity v2.16.0, csi-powerflex v2.16.0, csi-powermax v2.16.0, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A hi | 8.0 | 26.06.2026 |
| CVE-2026-57620 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Strifler Exclusive Addons Elementor allows Stored XSS. This issue affects Exclusive Addons Elementor: from n/a through 2.7.9.8. | 6.5 | 26.06.2026 |
| CVE-2026-57914 | By sending a deeply nested ASN1 structure to a Apache Kerby client or service, it's possible to trigger a StackOverFlow Exception which can lead to denial of service issues. Users are recommended to upgrade to version 2.1.2, which fixes this issue. | 6.5 | 26.06.2026 |
| CVE-2026-57473 | A vulnerability exists in the netclient and factory services of Reolink Home Hub (versions prior to v3.3.0.456_26031911) due to the possibility of brute-force cracking the credentials. This issue could allow attackers on the same local network to intercept tra | 5.8 | 26.06.2026 |
| CVE-2026-57912 | Johnson & Johnson Campus Recruiting before 2025-10-31 allows viewing of data provided by recruited students, and notes entered about students by interviewers. | 7.5 | 26.06.2026 |
| CVE-2026-57913 | Johnson & Johnson Audit Tracking Management System (ATMS) before 2026-04-21 allows viewing of meeting minutes and transcripts. | 7.5 | 26.06.2026 |
| CVE-2026-57918 | libnfs through 6.0.2 before 935b8db has an xid integer underflow in READ_IOVEC in rpc_read_from_socket in lib/socket.c during a connection to a crafted NFS server, when the expected pdu size exceeds the absolute pdu size from the xid/record-marker. | 7.1 | 26.06.2026 |
| CVE-2026-6658 | A vulnerability in jupyter/nbconvert versions <= 7.17.0 allows for Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports. The `data_mermaid` block in `share/templates/lab/base.html.j2` renders `text/vnd.mermaid` cell output direc | 5.4 | 26.06.2026 |
| CVE-2026-11625 | Bytes::Random::Secure versions through 0.29 for Perl share internal state across forked processes. When an object is initialised before forking, or when the functional interface is used, then the internal state for the PRNG is shared across processes and iden | 7.5 | 26.06.2026 |
| CVE-2026-11702 | Bytes::Random::Secure::Tiny versions through 1.011 for Perl share internal state across forked processes. When an object is initialised before forking, then the internal state for the PRNG is shared across processes and identical random streams will be produc | 7.5 | 26.06.2026 |
| CVE-2026-57881 | An unauthenticated stack-based buffer overflow vulnerability exists in vlsvr in GeoVision GV-LPC2011 and GV-LPC2211 V1.12 and earlier. The vulnerability is caused by insufficient length validation when processing remote login data. A remote attacker may exploi | 9.8 | 26.06.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.