Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 41.312 CVE, 0 KEV kaydı · son NVD senkronu 15.11.2026 17:31. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-57436 | Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::Document#root= validated only that the new root was a Nokogiri::XML::Node, allowing a DTD node to be set as the document root. The result is a he | 1.7 | 25.06.2026 |
| CVE-2026-57437 | Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::XPathContext did not keep its source document alive for garbage collection. If an XPathContext outlived its document and the document was collect | 1.7 | 25.06.2026 |
| CVE-2026-57534 | Malicious HTML content could be injected into the content of a page in the pretix-pages plugin. | 2.1 | 25.06.2026 |
| CVE-2026-57234 | Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, the NONET parse option, which Nokogiri turns on by default for Nokogiri::XML::Schema (see CVE-2020-26247), was not correctly enforced on the JRuby implementatio | 2.6 | 25.06.2026 |
| CVE-2026-57235 | Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::NodeSet#[] (and its alias #slice) checked the requested index against the node set's bounds using a 32-bit-truncated copy of the index. A large n | 6.3 | 25.06.2026 |
| CVE-2026-57236 | Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, calling Document#encoding= with an invalid encoding (e.g., a non-string, or a string containing a null byte) raises an exception, but only after freeing the doc | 1.7 | 25.06.2026 |
| CVE-2026-57434 | Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri contains a bug when calling certain methods on allocated-but-uninitialized native wrapper classes that inherit from Nokogiri::XML::Node. This caused a | 1.7 | 25.06.2026 |
| CVE-2026-49319 | Remote Keyless Entry System (RKES), using the 433 MHz key fob bearing FCC ID CWTR53R0 manufactured by ALPS ALPINE CO., LTD., is vulnerable to a roll-back attack against its rolling-code authentication. An attacker within RF range who records two consecutiv | 6.9 | 25.06.2026 |
| CVE-2026-46735 | Dell Display and Peripheral Manager (DDPM Mac), versions prior to 2.3, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access could potentially exploit th | 7.8 | 25.06.2026 |
| CVE-2026-13222 | Our payment integration with Oppwa-based payment methods did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to m | 6.3 | 25.06.2026 |
| CVE-2026-13223 | Our payment integration with Computop-based payment methods did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access t | 6.3 | 25.06.2026 |
| CVE-2026-13314 | Malicious HTML content could be injected into the content rendered by the pretix-digital plugin. | 2.0 | 25.06.2026 |
| CVE-2026-57619 | Contributor Sensitive Data Exposure in Elementor Website Builder <= 4.1.3 versions. | 6.5 | 25.06.2026 |
| CVE-2026-57429 | Contributor Broken Access Control in Slim SEO <= 4.6.2 versions. | 6.5 | 25.06.2026 |
| CVE-2026-56053 | Subscriber PHP Object Injection in EventPrime <= 4.3.4.1 versions. | 8.8 | 25.06.2026 |
| CVE-2026-56054 | Subscriber Arbitrary File Deletion in JS Help Desk <= 3.1.1 versions. | 7.7 | 25.06.2026 |
| CVE-2026-56071 | Unauthenticated Cross Site Scripting (XSS) in Forminator <= 1.53.1 versions. | 7.1 | 25.06.2026 |
| CVE-2026-56122 | Winstone Servlet Engine through 0.9.10 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by sending HTTP GET requests with dot-dot-slash sequences that are not sanitized when serving static files from the con | 8.7 | 25.06.2026 |
| CVE-2026-56013 | Unauthenticated Insecure Direct Object References (IDOR) in License Manager for WooCommerce <= 3.0.15 versions. | 6.5 | 25.06.2026 |
| CVE-2026-56014 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Averta Master Slider master-slider allows Reflected XSS.This issue affects Master Slider: from n/a through 3.11.5. | 7.1 | 25.06.2026 |
| CVE-2026-56023 | Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 versions. | 5.4 | 25.06.2026 |
| CVE-2026-56042 | Customer Cross Site Scripting (XSS) in Advanced Order Export For WooCommerce <= 4.0.9 versions. | 7.1 | 25.06.2026 |
| CVE-2026-56050 | Improper Access Control vulnerability in Themeisle PPOM for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PPOM for WooCommerce: from n/a through 33.0.18. | 6.5 | 25.06.2026 |
| CVE-2026-54848 | Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal APIExperts Square for WooCommerce allows Retrieve Embedded Sensitive Data. This issue affects APIExperts Square for WooCommerce: from n/a through 4.7.3. | 8.3 | 25.06.2026 |
| CVE-2026-54849 | Unauthenticated SQL Injection in Premmerce Wishlist for WooCommerce <= 1.1.11 versions. | 9.3 | 25.06.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.