Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 8.083 CVE, 0 KEV kaydı · son NVD senkronu 25.10.2026 04:11. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-75775 | Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to | 7.7 | 23.10.2026 |
| CVE-2026-63244 | An authentication bypass vulnerability in WizLearn Technologies' Learning Management System (LMS) could allow an unauthenticated remote attacker to bypass password authentication and the OAuth authentication flow by sending a specially crafted POST request, po | 9.8 | 23.10.2026 |
| CVE-2026-4952 | The "ASMobile" web interface, which is part of the VertiGIS software package "GIS Portal", allows authenticated users to define a business reference. JavaScript code can be inserted into this field. On its own this only affects the user who entered it (self-XS | 5.1 | 23.10.2026 |
| CVE-2026-4951 | The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to search for employees across all defined companies (user groups). The search term can be passed in the "searchValue" URL parameter, so the search is performe | 5.1 | 23.10.2026 |
| CVE-2026-4950 | The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to manage the employees of defined companies (user groups). User properties, for example the "secondName" parameter, can be filled with JavaScript code while e | 4.8 | 23.10.2026 |
| CVE-2026-63243 | An authentication vulnerability in the Bluetooth Low Energy (BLE) implementation of Creative Sound Blaster Katana could allow an attacker within Bluetooth range to connect to an affected device without prior pairing or authentication. | 4.3 | 23.10.2026 |
| CVE-2026-55981 | A firmware verification vulnerability in Creative Sound Blaster Katana could allow an attacker to modify a legitimate firmware image and upload the modified firmware to an affected device. | 9.6 | 23.10.2026 |
| CVE-2026-109935 | The Otter Blocks WordPress plugin before 3.2.8 does not enforce its block visibility conditions when a published post is rendered through the WordPress REST API, allowing unauthenticated users to read block content that the site owner restricted to specific r | 5.3 | 23.10.2026 |
| CVE-2026-107858 | Missing Origin Validation in WebSockets (CWE-1385) and Permissive Cross-domain Policy with Untrusted Domains (CWE-942) in the development web server (ADK Web) in Google Agent Development Kit (ADK) for Java (com.google.adk:google-adk-dev versions 0.1.0 before 1 | 7.2 | 23.10.2026 |
| CVE-2026-86055 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of the password-reset link it emails to a user from the client-supplied HTTP Host header, with no trusted-host validation. | 8.7 | 23.10.2026 |
| CVE-2026-86020 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB contains a spreadsheet formula injection vulnerability in the part import/export workflow. An authenticated user with permission to import parts c | 4.6 | 23.10.2026 |
| CVE-2026-86019 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated API users to bypass the configured maximum attachment file size by uploading attachments through the API using base64-encoded | 5.3 | 23.10.2026 |
| CVE-2026-86018 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.2, Part-DB allows authenticated users to bypass the configured maximum attachment file size when using the server-side “Download external file” attachment fe | 5.3 | 23.10.2026 |
| CVE-2026-59188 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files based solely on the user-controlled filename extension rather than actual file content type. An authenticated attacker | 5.4 | 23.10.2026 |
| CVE-2026-55835 | Lookyloo is a web interface that allows users to capture a website page and then display a tree of domains that call each other. Prior to version 1.39.4, an unauthenticated user can trigger Lookyloo's "report a capture" email on demand (this is expected). The | 6.9 | 23.10.2026 |
| CVE-2026-90458 | OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service. | 5.4 | 23.10.2026 |
| CVE-2026-89419 | OpenStack Ironic before 39.0.1 sometimes allows a user to change the maintenance setting on a node via PATCH to /v1/nodes/{ident} - in other words, not using the specific maintenance endpoint. | 5.0 | 23.10.2026 |
| CVE-2026-55600 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.2, Part-DB renders BOM validation information messages using Twig's |raw filter. These messages include translated placeholders populated with user-controlle | 5.7 | 23.10.2026 |
| CVE-2026-54631 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the file .env committed in the Part-DB repository contains a fixed value for APP_SECRET (a03498528f5a5fc089273ec9ae5b2849). The official Docker image jbtr | 6.3 | 23.10.2026 |
| CVE-2026-54630 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler stores uploaded files under the web-served media directory using the client-supplied file extension, and its extension | 9.6 | 23.10.2026 |
| CVE-2026-54615 | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, LogEntryExtraFormatter builds the HTML shown in the "Extra" column of the activity-log table (/log) and in element history tables. Every branch of LogEntr | 6.0 | 23.10.2026 |
| CVE-2026-115638 | OpenStack Ironic through 39.0.1 allows a denial of service via a configdrive that results in a very large amount of uncompressed data, aka a gzip bomb. | 4.3 | 23.10.2026 |
| CVE-2026-19678 | A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publ | 8.7 | 23.10.2026 |
| CVE-2026-19677 | An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary oper | 9.3 | 23.10.2026 |
| CVE-2026-115537 | A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function simpan of the file application/modules/admin/controllers/routing_pages.php of the component URL Validation. This manipula | 2.1 | 23.10.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.