Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 24.370 CVE, 0 KEV kaydı · son NVD senkronu 01.11.2026 16:17. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-80747 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Add bounds check for CRAT subtype length The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A m | 8.0 | 03.09.2026 |
| CVE-2026-80739 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, Check if flow is PEER before acquiring devcom lock In case __mlx5e_add_fdb_flow() fails in lower levels, the flow is deleted via mlx5e_tc_del_flow(), and mlx5e_tc_del_flow() i | — | 03.09.2026 |
| CVE-2026-80738 | In the Linux kernel, the following vulnerability has been resolved: bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie accept a socket pointer 'sk' with argument type ARG_PTR_TO_BTF_ID_SOCK_COMMON. | 7.3 | 03.09.2026 |
| CVE-2026-80728 | In the Linux kernel, the following vulnerability has been resolved: Revert "drm/amdgpu: fix aperture mapping leak" devres teardown is LIFO. The aperture devres node was registered after the DRM device node, so devres_release_all() unmaps the aperture before | — | 03.09.2026 |
| CVE-2026-78408 | The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the | 7.9 | 02.09.2026 |
| CVE-2026-78410 | A flaw was found in util-linux. Restricted bind mounts take the source path from fstab but do not pin that source before the privileged mount. A local unprivileged user who can replace the authorized source or a writable ancestor can redirect SUID mount(8) to | 7.8 | 02.09.2026 |
| CVE-2026-14255 | A maliciously crafted IFC file, when parsed through certain Autodesk products, can trigger an Uncontrolled Recursion vulnerability. A malicious actor may leverage this vulnerability to cause the application to terminate unexpectedly, resulting in a denial-of-s | 5.5 | 02.09.2026 |
| CVE-2024-7956 | A vulnerability exists in the affected products that allows a threat actor to gain access to user’s projects. To exploit this vulnerability the threat actor must have basic user privileges. If exploited, the threat actor can modify and delete the project. | 7.6 | 02.09.2026 |
| CVE-2024-3773 | The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perfo | 5.9 | 02.09.2026 |
| CVE-2026-84807 | Kimai (kimai/kimai) before 2.65.0 contains a business logic / improper authorization vulnerability in the default team creation endpoints. An authenticated user with project permission-management privileges can create or use a customer, project, or activity wh | 5.3 | 02.09.2026 |
| CVE-2024-35585 | Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication. | 8.6 | 02.09.2026 |
| CVE-2026-19754 | Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL templa | 8.6 | 02.09.2026 |
| CVE-2024-7952 | A data exposure vulnerability exists in the affected product. There are hardcoded links in the source code that lead to JSON files that can be reached without authentication. If exploited, a threat actor could view customer data. | 8.7 | 01.09.2026 |
| CVE-2026-49329 | A flaw was found in openshift/oauth-server. The OAuth login and error page endpoints pass the unauthenticated Accept-Language header to golang.org/x/text/language.ParseAcceptLanguage() without input validation. A bypass of the CVE-2022-32149 mitigation exists: | 7.5 | 01.09.2026 |
| CVE-2024-14047 | A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker with existing access to the system could pre-position malicious filesystem links, causing a sub | 7.1 | 01.09.2026 |
| CVE-2024-10085 | CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause denial of service of the OPC UA communication platform when a large number of OPC UA requests are sent to the platform. | 8.2 | 01.09.2026 |
| CVE-2026-83596 | A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling. | 8.8 | 01.09.2026 |
| CVE-2025-63607 | TechStore 1.0 is vulnerable to Cross Site Scripting (XSS). In contact_display, the application echoes the id parameter verbatim into the rendered page, permitting execution of attacker-supplied JavaScript in users browser. | 6.1 | 01.09.2026 |
| CVE-2026-17615 | A flaw was found in RESTEasy's SourceProvider. This vulnerability allows an unauthenticated attacker to perform an unauthenticated remote file read. By sending a specially crafted XML body with a DOCTYPE declaration referencing external entities to an endpoint | 7.5 | 31.08.2026 |
| CVE-2026-82854 | Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is concatenated into t | 9.3 | 31.08.2026 |
| CVE-2024-58379 | nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedde | 6.9 | 31.08.2026 |
| CVE-2026-66323 | Improper neutralization of parameter/argument delimiters in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 5.4 | 28.08.2026 |
| CVE-2026-66324 | External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | 6.5 | 28.08.2026 |
| CVE-2026-66798 | Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. | 4.3 | 28.08.2026 |
| CVE-2026-62904 | Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. | 5.4 | 28.08.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.