Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 24.219 CVE, 0 KEV kaydı · son NVD senkronu 31.10.2026 10:16. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-98405 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parse_posix_sids() In parse_posix_sids(), sidsbuf_end is calculated using the server-supplied out_len without being validated against the actual | 8.1 | 14.10.2026 |
| CVE-2026-98386 | In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot For QLAFX00 the request ring is ioremapped device I/O memory (ha->iobase + req_que_off), not DMA-coherent RAM, which is why | — | 14.10.2026 |
| CVE-2026-110690 | Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root() function instead of the root.resolve() validatio | 8.7 | 14.10.2026 |
| CVE-2026-109968 | A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default proc | 5.5 | 14.10.2026 |
| CVE-2026-104795 | The insights-runtime-extractor runs as a privileged DaemonSet (`hostPID: true`) that scans container processes for runtime fingerprinting. When scanning a container, the coordinator: 1. **fork()s** a child process 2. **setns()** into the target container's PI | 8.8 | 14.10.2026 |
| CVE-2026-109971 | A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user through process listing or the /proc filesystem. | 4.7 | 14.10.2026 |
| CVE-2026-109970 | A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting restrictive permissions. Under the default process umask, the file is world-readable. Additionally, the PIN fil | 4.7 | 14.10.2026 |
| CVE-2026-109969 | A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user can connect to the cont | 4.7 | 14.10.2026 |
| CVE-2026-110447 | Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. This is an OS command injection in | 9.2 | 14.10.2026 |
| CVE-2026-96521 | Photoshop Desktop is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. | 7.8 | 14.10.2026 |
| CVE-2026-88085 | Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally. | 6.4 | 14.10.2026 |
| CVE-2026-88086 | Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over an adjacent network. | 5.3 | 14.10.2026 |
| CVE-2026-88088 | Integer overflow or wraparound in SQL Server allows an authorized attacker to elevate privileges locally. | 7.0 | 14.10.2026 |
| CVE-2026-88089 | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally. | 6.7 | 14.10.2026 |
| CVE-2026-88081 | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | 7.7 | 14.10.2026 |
| CVE-2026-88082 | Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally. | 7.0 | 14.10.2026 |
| CVE-2026-88083 | Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. | 7.5 | 14.10.2026 |
| CVE-2026-88084 | Allocation of resources without limits or throttling in SQL Server allows an authorized attacker to deny service over a network. | 5.3 | 14.10.2026 |
| CVE-2026-85919 | Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally. | 7.0 | 14.10.2026 |
| CVE-2026-85876 | Use after free in SQL Server allows an authorized attacker to elevate privileges locally. | 7.0 | 14.10.2026 |
| CVE-2026-83945 | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | 6.6 | 14.10.2026 |
| CVE-2026-70189 | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code locally. | 6.7 | 14.10.2026 |
| CVE-2026-68883 | Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network. | 8.5 | 14.10.2026 |
| CVE-2026-90531 | Adobe Experience Manager is affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access to internal res | 9.6 | 13.10.2026 |
| CVE-2026-90532 | Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation | 10.0 | 13.10.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.