Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 8.105 CVE, 0 KEV kaydı · son NVD senkronu 25.10.2026 10:11. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-115414 | OS command injection in the Terraform hook in AWS SAM CLI before 1.166.2 might allow an actor who can influence the Terraform configuration or plan file consumed by a build to execute arbitrary commands as the build user on the host running the build via a cra | 8.4 | 22.10.2026 |
| CVE-2026-115360 | OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling ph | 5.3 | 22.10.2026 |
| CVE-2026-115352 | Mistune before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser that allows unauthenticated attackers to exhaust CPU by submitting long runs of unmatched '[' characters. Attackers can send small markdown payloads that trigger O( | 8.7 | 22.10.2026 |
| CVE-2026-115348 | Mistune from 3.0.0 before 3.3.0 contains an algorithmic complexity vulnerability in the inline link parser's parse_link_text function that allows unauthenticated attackers to exhaust CPU with unbalanced brackets. Attackers can submit Markdown containing many u | 8.7 | 22.10.2026 |
| CVE-2026-114655 | libmongocrypt builds requests to external key management services (AWS, Azure and GCP) by inserting values from key vault documents, KMS provider configuration and KMS responses into request lines, headers and signed request bodies without validating or encodi | 6.0 | 22.10.2026 |
| CVE-2026-114654 | A numeric-type conversion flaw in the BSON handling library of the MongoDB C# Driver allows an out-of-range binary subtype value supplied through untrusted textual input to bypass the library's binary-element integrity checks. When such a value is later encode | 6.9 | 22.10.2026 |
| CVE-2026-114653 | A client-side encryption schema construction component in the MongoDB C# Driver places caller-supplied field identifiers into a position that is interpreted as a pattern expression, without normalizing or validating them. As a result, an application that desig | 7.1 | 22.10.2026 |
| CVE-2026-114652 | A data-query-logic neutralization weakness in the update-statement construction component of the MongoDB C# Driver can cause application-supplied values to be interpreted as query/update logic rather than as literal data. An application user who can influence | 7.1 | 22.10.2026 |
| CVE-2026-114651 | A memory-handling weakness in the BSON deserialization component of the MongoDB C# Driver may cause data left over from previously processed content to be returned when specially crafted serialized input is parsed. An unauthenticated party able to supply seria | 6.3 | 22.10.2026 |
| CVE-2026-114650 | A flaw in the client-side encryption support of the MongoDB .NET/C# driver can cause data designated for client-side field-level encryption to be written without encryption. Under certain platform text-encoding configurations, an internal name conversion loses | 6.9 | 22.10.2026 |
| CVE-2026-114649 | The MongoDB C# Driver compares TLS client certificates by issuer and serial number only when deciding whether two clients can share cached connections. In an application that creates clients from certificates supplied by different users, a user who provides a | 7.6 | 22.10.2026 |
| CVE-2026-114648 | The MongoDB C# Driver does not neutralize dot and dollar characters in dictionary keys, field names and array-filter identifiers used in LINQ queries before placing them into the field paths it sends to the server. An application user whose input reaches these | 7.2 | 22.10.2026 |
| CVE-2026-114647 | The MongoDB C# Driver does not reject replacement documents whose top-level field names begin with a dollar sign in FindOneAndReplace, unlike other replace operations. An application that builds such a document from user-supplied field names can have the serve | 5.3 | 22.10.2026 |
| CVE-2026-114646 | A data-validation flaw exists in the BSON handling and binary serialization path of the MongoDB C# Driver. When an application constructs a raw or lazy BSON document object from externally supplied binary data, the driver does not verify that the size quantity | 6.9 | 22.10.2026 |
| CVE-2026-114645 | A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an undersized heap buffer to be allocated when an excessively long credential value is supplied in the client's connection configuration. A party abl | 5.7 | 22.10.2026 |
| CVE-2026-114644 | The MongoDB C# Driver's BSON library contains an uncontrolled resource consumption weakness in its deserialization handling of one BSON value type. An application that deserializes untrusted content with the library retains data derived from that content for t | 8.2 | 22.10.2026 |
| CVE-2026-114643 | The MongoDB C# Driver writes GeoJSON extra members without checking whether their names collide with reserved GeoJSON members such as type and coordinates. An application that places user-supplied field names into these extra members can store documents with d | 5.3 | 22.10.2026 |
| CVE-2026-114613 | MessagePack is the serializer implementation for Python msgpack.org. Prior to 1.2.3, the msgpack-python C extension (msgpack._cmsgpack) leaks a decoded map value when deserialization rejects a key with strict_map_key=True (the default). Repeated malformed inpu | 7.5 | 22.10.2026 |
| CVE-2026-114612 | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authent | 9.9 | 22.10.2026 |
| CVE-2026-114519 | Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with a basic role to read the accounts of other users of its own company, including accounts with higher privileges, and, in versions from 3.5.0, | 8.6 | 22.10.2026 |
| CVE-2026-113876 | SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could submit a conditional create whose predicate matches an existing resource and receive the target resource's contents. | 5.3 | 22.10.2026 |
| CVE-2026-113875 | On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be able to query and read resources that they are not otherwise permitted to access. | 2.3 | 22.10.2026 |
| CVE-2025-69723 | A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL. | — | 22.10.2026 |
| CVE-2025-65200 | An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the templateURL to the _localstack/cloudformation/deploy endpoint, the hosted content ca | — | 22.10.2026 |
| CVE-2022-51026 | Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLAB_SELF_HOST en | 9.3 | 22.10.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.