Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 20.758 CVE, 0 KEV kaydı · son NVD senkronu 29.10.2026 16:15. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2024-54581 | Rejected reason: This candidate was in a CNA pool that was not assigned to any issues. | — | 19.10.2026 |
| CVE-2025-60482 | A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file. | 5.5 | 19.10.2026 |
| CVE-2026-107084 | Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows cross-site request forgery (CSRF) against admin/modules/circulation/loan_history_maintenance.php because the action=run GET parameter performs privileged, destructive operations with no CSRF toke | 8.8 | 19.10.2026 |
| CVE-2025-52290 | A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg version N-119856-gbe46370941 allows attackers to cause a Denial of Service (DoS) via processing a crafted media file. | 7.5 | 19.10.2026 |
| CVE-2025-55654 | A use-after-free in the gf_filter_pid_get_packet function (filter_core/filter_pid.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a crafted file. | 5.5 | 19.10.2026 |
| CVE-2025-55667 | A segmentation violation in the dump_isom_saps function (/mp4box/filedump.c) of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attackers to cause a Denial of Service (DoS) via supplying a crafted MP4 file. | 5.5 | 19.10.2026 |
| CVE-2025-60480 | A heap buffer overflow in the gf_odf_ac4_cfg_alternative_info function (/odf/descriptors.c) of GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master allows attackers to cause a Denial of Service (DoS) via supplying a crafted AC4 file. | 5.5 | 19.10.2026 |
| CVE-2026-12669 | IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and the request is rejected. | 4.3 | 19.10.2026 |
| CVE-2026-12670 | IBM MQ could allow an authenticated attacker to cause a denial of service through a specially crafted message that triggers excessive memory operations during character set conversion. | 6.5 | 19.10.2026 |
| CVE-2026-12350 | IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process. | 6.5 | 19.10.2026 |
| CVE-2026-12660 | IBM MQ Web Console could allow an authenticated administrator to write files outside the intended directory due to improper path validation. | 2.7 | 19.10.2026 |
| CVE-2026-12665 | IBM MQ could allow a remote attacker to execute arbitrary code due to a stack buffer overflow when processing TLS certificates with malformed distinguished names during channel connection establishment. | 9.8 | 19.10.2026 |
| CVE-2026-12148 | IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes for Java. | 8.8 | 19.10.2026 |
| CVE-2026-12155 | IBM MQ could allow an authenticated attacker to cause a denial of service by sending specially crafted multicast status messages that trigger a NULL pointer dereference. | 6.5 | 19.10.2026 |
| CVE-2026-12343 | IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of RFH2 message header fields in queued publish/subscribe operations. | 6.5 | 19.10.2026 |
| CVE-2026-11829 | IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of offset values in MQOPEN requests. | 6.5 | 19.10.2026 |
| CVE-2026-11831 | IBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very limited information about process memory layout due to an out-of-bounds read when processing a specially crafted client request. | 5.4 | 19.10.2026 |
| CVE-2026-111750 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the pure Python parser accepts ambiguous HTTP request framing. An unauthenticated attacker can consequently smuggle requests when an application uses AIOHTTP_NO_EX | 6.3 | 19.10.2026 |
| CVE-2026-111064 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, keepalive timeout handling is absent during the initial portion of a request. An attacker can keep an idle connection open indefinitely before sending any request | 8.2 | 19.10.2026 |
| CVE-2025-7043 | The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client crede | 5.4 | 19.10.2026 |
| CVE-2024-4412 | The software accepts user-supplied data without sufficient validation, allowing for the injection of malicious Expression Language (EL) code. This can lead to the execution of arbitrary operations within the affected deployment. Exploitation of this vulnerabi | 2.7 | 19.10.2026 |
| CVE-2026-111057 | Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in BLOCKED_PATTERNS concatenates the /lab and /api/terminals regular-expression literals. Requests to /api/terminals therefo | 10.0 | 19.10.2026 |
| CVE-2026-109431 | Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling sing | 8.6 | 19.10.2026 |
| CVE-2026-109433 | Camunda 7.24.0 before 7.24.16 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.is | 6.0 | 19.10.2026 |
| CVE-2026-112294 | FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to modify other users' content rows because checkRowOwner never verifies ownership. Any registered user can send requests t | 5.3 | 19.10.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.