Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 24.301 CVE, 0 KEV kaydı · son NVD senkronu 01.11.2026 04:17. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-63568 | Allocation of resources without limits or throttling in the CMP/CRMF password-based MAC verifier (PKMacBuilder) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated attacker to cause a denial of service through CPU exhaust | 8.7 | 02.10.2026 |
| CVE-2026-63569 | Improper input validation in DHAgreement.CalculateAgreement (MTI/A0 two-pass Diffie-Hellman) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to make the local party compute an agreed value the attacker already knows, defea | 9.1 | 02.10.2026 |
| CVE-2026-15999 | Improper validation of integrity check value in the AES-CCM implementation (CcmParameters and CcmBlockCipher) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an on-path attacker to modify CCM-encrypted content without detection via an Algorit | 8.2 | 02.10.2026 |
| CVE-2026-16000 | Missing cryptographic step in the DSTU 7624 CCM mode implementation (KCcmBlockCipher) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows an attacker who can observe encrypted messages of known or chosen content to forge ciphertexts with valid au | 8.7 | 02.10.2026 |
| CVE-2026-16001 | Exposure of the message authentication key through the encryption keystream in the stream mode of IesEngine (an IesEngine constructed without a block cipher) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who has observed o | 8.2 | 02.10.2026 |
| CVE-2026-63566 | Memory allocation with excessive size value in the DTLS handshake reassembly (DtlsReliableHandshake, DtlsReassembler) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote unauthenticated DTLS peer to cause a denial of service through memo | 8.7 | 02.10.2026 |
| CVE-2026-104286 | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9, FortiMail 7.0 all versions m | 9.8 | 01.10.2026 |
| CVE-2026-84682 | A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the setProductVer command handler to execute arbitrary operating system commands as root during device bo | 7.7 | 01.10.2026 |
| CVE-2023-54404 | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The described memory use only grows in proportion to input already allocated by JSON.parse before Zod runs, is reachable only without an application request-size limit, | — | 01.10.2026 |
| CVE-2026-100517 | Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Reviews for WooCommerce: from n/a thro | 7.5 | 01.10.2026 |
| CVE-2026-83589 | A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulti | 6.1 | 01.10.2026 |
| CVE-2026-101295 | Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image layer | 7.3 | 30.09.2026 |
| CVE-2026-93903 | LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case." | 9.4 | 30.09.2026 |
| CVE-2026-97301 | Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions. | 6.5 | 30.09.2026 |
| CVE-2026-62146 | A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-sid | 7.8 | 30.09.2026 |
| CVE-2024-31027 | Cross Site Scripting vulnerability in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the last name, first name, and username parameters in the user registration functionality. | 5.4 | 29.09.2026 |
| CVE-2024-31026 | An issue in Greek Universities Network (GUnet) Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the chat input field in the course module. | 9.8 | 29.09.2026 |
| CVE-2026-102558 | A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame d | 8.6 | 29.09.2026 |
| CVE-2026-102559 | A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer ov | 8.6 | 29.09.2026 |
| CVE-2026-102675 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, responses served through protocol.registerFileProtocol or protocol.registerHttpProtocol for a custom sc | 7.4 | 29.09.2026 |
| CVE-2026-102556 | A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the doc | 8.6 | 29.09.2026 |
| CVE-2026-102557 | A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation w | 8.6 | 29.09.2026 |
| CVE-2026-100801 | Privilege escalation in the DLL Services component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird 153.4, Firefox 159, Firefox ESR 153.6, Thunderbird 159, Thunderbird 153.6, Firefox 157, and Firefox ESR 140. | 8.8 | 29.09.2026 |
| CVE-2026-18413 | The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_sequence in include/zephyr/drivers/adc.h documents that "the driver must ensure that samples are not written beyond the li | 7.8 | 29.09.2026 |
| CVE-2026-18414 | The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_sequence in include/zephyr/drivers/adc.h documents that "the driver must ensure that samples are not written beyond the li | 7.8 | 29.09.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.