Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 24.396 CVE, 0 KEV kaydı · son NVD senkronu 01.11.2026 22:17. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-19949 | The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparat | 8.8 | 25.08.2026 |
| CVE-2026-32560 | Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 versions. | 8.8 | 25.08.2026 |
| CVE-2026-32563 | Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions. | 9.8 | 25.08.2026 |
| CVE-2026-75370 | An out-of-bounds read/write vulnerability in the MessageParser::parseECSSTCHeader component of SpaceDot AcubeSAT OBC software commit eaf90ec allows attackers to cause a Denial of Service (DoS) via supplying a crafted CAN message. | 6.5 | 24.08.2026 |
| CVE-2026-66907 | Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-google-storage consumer downloads Google Cloud Stor | 7.5 | 24.08.2026 |
| CVE-2026-66908 | Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main embedded HTTP server can protect its endpoints with JWT authentication, configured through authe | 7.5 | 24.08.2026 |
| CVE-2026-78376 | A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption. | 8.8 | 24.08.2026 |
| CVE-2026-77995 | Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2 - The manipula | 10.0 | 24.08.2026 |
| CVE-2026-78258 | Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions. | 5.3 | 24.08.2026 |
| CVE-2026-66585 | Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions. | 7.5 | 24.08.2026 |
| CVE-2026-66587 | Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions. | 9.8 | 24.08.2026 |
| CVE-2026-28151 | Unauthenticated Local File Inclusion in Tonda < 2.6 versions. | 8.1 | 24.08.2026 |
| CVE-2026-28152 | Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions. | 8.1 | 24.08.2026 |
| CVE-2026-28167 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebRehab Super Forms super-forms allows Path Traversal.This issue affects Super Forms: from n/a through 6.3.316. | 7.5 | 24.08.2026 |
| CVE-2026-78314 | SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution. | 8.8 | 24.08.2026 |
| CVE-2026-66897 | A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths speci | 9.9 | 24.08.2026 |
| CVE-2026-77993 | Joomla Extension - joomlack.fr - Reflected XSS in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a reflected XSS via the iscontenttype parameter. | 5.3 | 24.08.2026 |
| CVE-2026-77994 | Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related to the loadStyles method of the frontend page model. | 9.3 | 24.08.2026 |
| CVE-2026-78202 | A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_settings of the file admin_class.php. The manipulation of the argument img results in unrestricted upload. The attack may be performed from remote. The exploit has bee | 5.5 | 24.08.2026 |
| CVE-2026-78201 | A vulnerability has been found in itsourcecode Payroll System 1.0. The impacted element is the function Login of the file admin_class.php. The manipulation of the argument Username leads to sql injection. The attack is possible to be carried out remotely. The | 5.5 | 24.08.2026 |
| CVE-2026-78200 | A flaw has been found in itsourcecode Library Management System 1.0. The affected element is an unknown function of the file editbooks.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit | 2.1 | 24.08.2026 |
| CVE-2026-78185 | A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/cust_edit.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The ex | 2.1 | 24.08.2026 |
| CVE-2026-78171 | A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/processlogin.php. The manipulation of the argument User leads to sql injection. It is possible to initi | 5.5 | 24.08.2026 |
| CVE-2026-78115 | A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /admin/edit_user_account.php of the component User Account Update. Such manipulation of the argument id/username leads to improp | 2.1 | 23.08.2026 |
| CVE-2026-78055 | A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /BSIT2.php. The manipulation of the argument course leads to cross site scripting. Remote | 2.1 | 23.08.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.