Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 9.635 CVE, 0 KEV kaydı · son NVD senkronu 25.10.2026 22:11. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-90648 | wasm2c in WebAssembly wabt through 1.0.41 allows sandbox escape in some situations that primarily involve 32-bit platforms, aka a "table flip" attack. It does not check the return value of calloc() in wasm_rt_allocate_funcref_table() (wasm2c/wasm-rt-impl-table | 7.1 | 13.09.2026 |
| CVE-2026-89673 | In the Linux kernel, the following vulnerability has been resolved: nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo nfsd4_ff_encode_getdeviceinfo() computes the da_addr_body reservation as 16 + netid_len + addr_len, but the subsequent xdr_encode | — | 11.09.2026 |
| CVE-2026-89623 | In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: stop device IO before hid_hw_stop Quiesce device IO at the start of the devm cleanup callback mcp2221_hid_unregister() so that incoming HID reports cannot race with hardware te | — | 11.09.2026 |
| CVE-2026-86517 | A flaw has been found in itsourcecode Sales and Inventory System 1.0. The impacted element is the function mysqli_query of the file /pages/us_searchfrm.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the att | 2.1 | 08.09.2026 |
| CVE-2026-86269 | A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/emp_edit1.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. Th | 2.1 | 07.09.2026 |
| CVE-2026-86265 | A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/us_transac.php. Such manipulation of the argument Username leads to sql injection. It is possible to la | 2.1 | 07.09.2026 |
| CVE-2026-86245 | A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/sup_transac.php. Performing a manipulation of the argument companyname results in sql injection. It is po | 2.1 | 07.09.2026 |
| CVE-2026-19754 | Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated user who can create or modify Formula fields can provide an undocumented fourth argument that is treated as a SQL templa | 8.6 | 02.09.2026 |
| CVE-2026-19949 | The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to SQL Injection via archive restore functionality in all versions up to, and including, 7.109 due to insufficient escaping on the user supplied parameter and lack of sufficient preparat | 8.8 | 25.08.2026 |
| CVE-2026-32560 | Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 versions. | 8.8 | 25.08.2026 |
| CVE-2026-32563 | Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress <= 2.0.63 versions. | 9.8 | 25.08.2026 |
| CVE-2026-75370 | An out-of-bounds read/write vulnerability in the MessageParser::parseECSSTCHeader component of SpaceDot AcubeSAT OBC software commit eaf90ec allows attackers to cause a Denial of Service (DoS) via supplying a crafted CAN message. | 6.5 | 24.08.2026 |
| CVE-2026-66907 | Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-google-storage consumer downloads Google Cloud Stor | 7.5 | 24.08.2026 |
| CVE-2026-66908 | Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main embedded HTTP server can protect its endpoints with JWT authentication, configured through authe | 7.5 | 24.08.2026 |
| CVE-2026-77995 | Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2 - The manipula | 10.0 | 24.08.2026 |
| CVE-2026-78258 | Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions. | 5.3 | 24.08.2026 |
| CVE-2026-66585 | Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions. | 7.5 | 24.08.2026 |
| CVE-2026-66587 | Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions. | 9.8 | 24.08.2026 |
| CVE-2026-28151 | Unauthenticated Local File Inclusion in Tonda < 2.6 versions. | 8.1 | 24.08.2026 |
| CVE-2026-28152 | Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions. | 8.1 | 24.08.2026 |
| CVE-2026-78314 | SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution. | 8.8 | 24.08.2026 |
| CVE-2026-66897 | A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths speci | 9.9 | 24.08.2026 |
| CVE-2026-77993 | Joomla Extension - joomlack.fr - Reflected XSS in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a reflected XSS via the iscontenttype parameter. | 5.3 | 24.08.2026 |
| CVE-2026-77994 | Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related to the loadStyles method of the frontend page model. | 9.3 | 24.08.2026 |
| CVE-2026-78202 | A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_settings of the file admin_class.php. The manipulation of the argument img results in unrestricted upload. The attack may be performed from remote. The exploit has bee | 5.5 | 24.08.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.