Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 8.121 CVE, 0 KEV kaydı · son NVD senkronu 25.10.2026 16:11. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-77995 | Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2 - The manipula | 10.0 | 24.08.2026 |
| CVE-2026-78258 | Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions. | 5.3 | 24.08.2026 |
| CVE-2026-66585 | Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions. | 7.5 | 24.08.2026 |
| CVE-2026-66587 | Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions. | 9.8 | 24.08.2026 |
| CVE-2026-28151 | Unauthenticated Local File Inclusion in Tonda < 2.6 versions. | 8.1 | 24.08.2026 |
| CVE-2026-28152 | Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions. | 8.1 | 24.08.2026 |
| CVE-2026-78314 | SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution. | 8.8 | 24.08.2026 |
| CVE-2026-66897 | A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths speci | 9.9 | 24.08.2026 |
| CVE-2026-77993 | Joomla Extension - joomlack.fr - Reflected XSS in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a reflected XSS via the iscontenttype parameter. | 5.3 | 24.08.2026 |
| CVE-2026-77994 | Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related to the loadStyles method of the frontend page model. | 9.3 | 24.08.2026 |
| CVE-2026-78202 | A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_settings of the file admin_class.php. The manipulation of the argument img results in unrestricted upload. The attack may be performed from remote. The exploit has bee | 5.5 | 24.08.2026 |
| CVE-2026-78201 | A vulnerability has been found in itsourcecode Payroll System 1.0. The impacted element is the function Login of the file admin_class.php. The manipulation of the argument Username leads to sql injection. The attack is possible to be carried out remotely. The | 5.5 | 24.08.2026 |
| CVE-2026-78200 | A flaw has been found in itsourcecode Library Management System 1.0. The affected element is an unknown function of the file editbooks.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit | 2.1 | 24.08.2026 |
| CVE-2026-78185 | A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/cust_edit.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The ex | 2.1 | 24.08.2026 |
| CVE-2026-78171 | A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/processlogin.php. The manipulation of the argument User leads to sql injection. It is possible to initi | 5.5 | 24.08.2026 |
| CVE-2026-78115 | A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /admin/edit_user_account.php of the component User Account Update. Such manipulation of the argument id/username leads to improp | 2.1 | 23.08.2026 |
| CVE-2026-78055 | A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /BSIT2.php. The manipulation of the argument course leads to cross site scripting. Remote | 2.1 | 23.08.2026 |
| CVE-2026-78054 | A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /BSIS1.php. Executing a manipulation of the argument course can lead to cross site scripting. The attack may be launched remotel | 2.1 | 23.08.2026 |
| CVE-2026-74672 | In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: acquire init_mm lock on huge vmap to avoid ptdump UAF Patch series "mm: fix UAF caused by race between ptdump and vmap pgtable freeing", v6. Kernel page table walkers fall into | — | 22.08.2026 |
| CVE-2026-74632 | In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: fix huge_zero_pfn race Patch series "mm/huge_memory: fix huge_zero_pfn race", v2. There is a subtle race in the reference-counted huge_zero_folio implementation. The fast p | 7.8 | 22.08.2026 |
| CVE-2026-76609 | Joomla Extension - fabrikar.com - Unauthenticated modification of any comment in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checks. | 6.9 | 22.08.2026 |
| CVE-2026-77027 | Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2 - The handling of user supplied input in the jsactions feature leads to an stored XSS vector. | 8.6 | 22.08.2026 |
| CVE-2026-77992 | Joomla Extension - fabrikar.com - heredoc terminator breakout in the calc element in Fabrik < 4.7.2 - The onUpdateComment endpoint did not perform any access checks. | 9.5 | 22.08.2026 |
| CVE-2026-76601 | Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2 - The order plugin did not perform any access checks. | 6.9 | 22.08.2026 |
| CVE-2026-76602 | Joomla Extension - fabrikar.com - Unauthenticated SQL injection in ORDER BY in Fabrik < 4.7.2 - The order parameter in list models is used in queries without validation, allowing read SQLi vectors. | 9.3 | 22.08.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.