Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 19.333 CVE, 0 KEV kaydı. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-69577 | Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose information over a network. | 7.5 | 13.10.2026 |
| CVE-2026-69326 | Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network. | 8.8 | 13.10.2026 |
| CVE-2026-69354 | Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally. | 7.8 | 13.10.2026 |
| CVE-2026-69363 | Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over a network. | 8.0 | 13.10.2026 |
| CVE-2026-69387 | Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally. | 7.0 | 13.10.2026 |
| CVE-2026-68836 | Heap-based buffer overflow in Windows kernel32.dll allows an authorized attacker to elevate privileges locally. | 7.8 | 13.10.2026 |
| CVE-2026-49785 | Improper resource shutdown or release in Windows UEFI allows an authorized attacker to bypass a security feature locally. | 7.8 | 13.10.2026 |
| CVE-2026-110247 | Several buffer-growth sites in libmime performed size arithmetic in 32-bit types without overflow checks. On a sufficiently large message the growth guard could fail open, or the buffer could be reallocated smaller than required, and a subsequent memcpy would | 8.4 | 13.10.2026 |
| CVE-2026-110256 | Finsys Dockhand through 1.0.18 contains an LDAP injection vulnerability in the tryLdapAuth function in src/lib/server/auth.ts, which inserts the login username into the LDAP search filter without escaping wildcard characters. Unauthenticated attackers can subm | 6.3 | 13.10.2026 |
| CVE-2026-110231 | muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination folder by bypassing its ZipSlip check with unnormalized remote paths. Attackers can craft TAR or ZIP entries like ../../ | 5.6 | 13.10.2026 |
| CVE-2026-110236 | KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted folder names substituted into the {path} placeholder. Attackers can embed a double quote and shell metacharacters | 7.1 | 13.10.2026 |
| CVE-2026-110225 | Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request internal addresses by fetching bookmark thumbnails without private-address checks. Attackers can create bookmarks pointing to | 5.1 | 13.10.2026 |
| CVE-2026-110220 | Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the controller ServiceAccount token via the modelregistry.kubeflow.org/url annotation. Attackers can create an InferenceService poi | 7.1 | 13.10.2026 |
| CVE-2026-110215 | youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/{roleId}/menus. Low-privileged users such as the GUEST test account can gra | 8.7 | 13.10.2026 |
| CVE-2026-110205 | Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed next to * or ? glob characters. Attackers using indirect prompt injection can craft commands like echo *$(...) that match | 7.7 | 13.10.2026 |
| CVE-2026-110210 | Phase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation members without Secrets read permission to read secret history via the secretHistory GraphQL query. Attackers holding an environment key can supply a known sec | 6.0 | 13.10.2026 |
| CVE-2026-110111 | Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrator by abusing the unprotected vm.importFromEsxi and vm.importMultipleFromEsxi methods. Attackers can point xo-server at | 7.7 | 13.10.2026 |
| CVE-2026-109428 | Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by exploiting a parsing discrepancy between tree-sitter-bash and bash in handling backslash-newline line continuations in th | 8.7 | 13.10.2026 |
| CVE-2026-109453 | Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally. | 7.0 | 13.10.2026 |
| CVE-2026-108468 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | 7.0 | 13.10.2026 |
| CVE-2026-108471 | Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. | 8.8 | 13.10.2026 |
| CVE-2026-108462 | Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally. | 5.5 | 13.10.2026 |
| CVE-2026-108463 | Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network. | 8.8 | 13.10.2026 |
| CVE-2026-108464 | Use after free in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally. | 7.0 | 13.10.2026 |
| CVE-2026-108465 | Use after free in Windows Update Delivery Optimization allows an authorized attacker to elevate privileges locally. | 7.0 | 13.10.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.