Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 24.296 CVE, 0 KEV kaydı · son NVD senkronu 31.10.2026 22:17. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-105003 | Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally. | 7.8 | 13.10.2026 |
| CVE-2026-105006 | Use after free in HID class driver allows an unauthorized attacker to elevate privileges with a physical attack. | 6.4 | 13.10.2026 |
| CVE-2026-105007 | An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior to copying memory to it. To exploit the vulnerability, in a local attack scenario, an attacker could r | 8.8 | 13.10.2026 |
| CVE-2026-104875 | Ente provides end-to-end encrypted cloud services and security tools. Prior to server image 2026.07.09, the POST /emergency-contacts/approve-recovery endpoint authorized approval using a client-supplied userID and updated an emergency recovery session using on | 7.1 | 13.10.2026 |
| CVE-2026-103575 | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 8.8 | 13.10.2026 |
| CVE-2026-103576 | Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. | 6.5 | 13.10.2026 |
| CVE-2026-103577 | Insecure default variable initialization in Microsoft QUIC allows an unauthorized attacker to bypass a security feature over a network. | 7.5 | 13.10.2026 |
| CVE-2026-103555 | Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally. | 7.0 | 13.10.2026 |
| CVE-2026-102870 | Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to execute code over a network. | 8.8 | 13.10.2026 |
| CVE-2026-102231 | Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | 7.7 | 13.10.2026 |
| CVE-2026-23705 | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.6, FortiAnalyzer 7.2.0 through 7.2.13, FortiManager 7.4. | 7.2 | 13.10.2026 |
| CVE-2026-106175 | A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.8, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, | 2.3 | 13.10.2026 |
| CVE-2025-57739 | An improper neutralization of special elements used in an SQL Command ("SQL Injection") vulnerability [CWE-89] vulnerability in Fortinet FortiMail 7.6.0 through 7.6.3, FortiMail 7.4.0 through 7.4.5, FortiMail 7.2.0 through 7.2.8 allows an authenticated attacke | 8.8 | 13.10.2026 |
| CVE-2026-104085 | odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can emb | 8.7 | 13.10.2026 |
| CVE-2026-110127 | waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticated members to modify or delete other members' cart items. Attackers can enumerate sequential cart ids via PUT /cart, POST | 5.3 | 13.10.2026 |
| CVE-2026-110122 | PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templates via PUT /store/goods/goods/freight. GoodsServiceImpl.freight and GoodsSkuServiceImpl.fr | 5.3 | 13.10.2026 |
| CVE-2026-110110 | JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because the AlarmConfigController _enable and _disable endpoints lack the save action annota | 5.3 | 13.10.2026 |
| CVE-2026-110117 | SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged employees to modify system-wide level-3 protection settings. Attackers can call the unannotated updateConfig and loginFa | 7.1 | 13.10.2026 |
| CVE-2026-110105 | B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to reach admin routes because PermissionMidware.check permits routes lacking permission.rule.url entries. Attackers can request /admin/report/igno | 6.9 | 13.10.2026 |
| CVE-2026-10759 | A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neutralization. An authenticated administrator could supply crafted input that modifies | 5.5 | 13.10.2026 |
| CVE-2026-110100 | Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import() that allows any authenticated user to import days off into any contract from an arbitrary URL. Attackers can submit a contract id and URL via POST to overwrite non-workin | 5.3 | 13.10.2026 |
| CVE-2024-34321 | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Notes parameter in the Notes.aspx endpoint. | 6.1 | 13.10.2026 |
| CVE-2024-34323 | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter. This vulnerability allows attackers to access sensitive information via a crafted HTTP request. | 10.0 | 13.10.2026 |
| CVE-2024-34324 | An issue in ProPhoenix Law RMS v2022.2403.3.101 allows attackers to execute a session hijacking attack via injecting a crafted 24-character string into the ASP.NET_SessionId cookie. | 9.1 | 13.10.2026 |
| CVE-2024-34326 | ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Alert/MsgType parameter in the errorHandler.aspx endpoint. | 6.1 | 13.10.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.