Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 27.345 CVE, 0 KEV kaydı · son NVD senkronu 04.11.2026 23:22. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-69522 | Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. | 8.8 | 08.09.2026 |
| CVE-2026-69499 | Integer overflow or wraparound in Windows Imaging Component allows an unauthorized attacker to execute code over a network. | 8.8 | 08.09.2026 |
| CVE-2026-69439 | Heap-based buffer overflow in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network. | 8.8 | 08.09.2026 |
| CVE-2026-69304 | Improper handling of highly compressed data (data amplification) in ASP.NET Core allows an unauthorized attacker to deny service over a network. | 5.9 | 08.09.2026 |
| CVE-2026-68880 | Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges over a network. | 8.0 | 08.09.2026 |
| CVE-2026-64918 | Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a network. | 6.5 | 08.09.2026 |
| CVE-2026-62804 | External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 7.8 | 08.09.2026 |
| CVE-2026-58649 | Origin validation error in .NET allows an unauthorized attacker to disclose information over a network. | 6.5 | 08.09.2026 |
| CVE-2026-84385 | A improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.6, FortiSOAR PaaS 7.5.0 through 7.5.3, FortiSOAR PaaS 7.4 all versions, FortiSOAR PaaS 7.3 all versions, FortiSOAR on-premise 7.6.0 through 7.6.6, FortiSOAR on-premise 7.5.0 t | 5.4 | 08.09.2026 |
| CVE-2026-84387 | An Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability [CWE-77] vulnerability in Fortinet FortiSandbox 5.2.0, FortiSandbox 5.0.0 through 5.0.6, FortiSandbox 4.4.0 through 4.4.9, FortiSandbox 4.2 all versions may al | 7.2 | 08.09.2026 |
| CVE-2026-84389 | A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiSIEM 7.5.0 through 7.5.1, FortiSIEM 7.4.1 through 7.4.2 may allow attacker to execute unauthorized code or commands via <insert attack vector here> | 3.1 | 08.09.2026 |
| CVE-2026-84392 | A NULL Pointer Dereference vulnerability [CWE-476] vulnerability in Fortinet FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS 6.4 all versions, FortiPAM 1.9.0, FortiPAM 1.8 all versions, FortiPAM 1.7 all versions, FortiPAM | 2.7 | 08.09.2026 |
| CVE-2026-20293 | A vulnerability in the Unified Extensible Firmware Interface (UEFI) Shell implementation of Cisco UCS Servers and UCS-based appliances could allow an authenticated attacker with valid credentials for a user account with the role of user or admin or an una | 7.1 | 08.09.2026 |
| CVE-2026-74860 | A flaw was found in libxml2 with Python bindings enabled. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing a Document Type Definition (DTD) with enumerated attribute values. This triggers a double-free | 8.5 | 08.09.2026 |
| CVE-2026-76561 | A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges ca | 7.2 | 08.09.2026 |
| CVE-2026-86517 | A flaw has been found in itsourcecode Sales and Inventory System 1.0. The impacted element is the function mysqli_query of the file /pages/us_searchfrm.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the att | 2.1 | 08.09.2026 |
| CVE-2026-86469 | A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX temporary file fails, the library unlinks the destination and recreates it without exclusive creation or symlink protection. | 5.3 | 07.09.2026 |
| CVE-2026-86422 | ImageMagick before 7.1.2-30 contains a time-of-check-time-of-use vulnerability in path policy enforcement on Windows that allows attackers to bypass read or write restrictions by exploiting symlink race conditions. Attackers can swap symlinks between policy va | 1.0 | 07.09.2026 |
| CVE-2026-86423 | ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the GetList method of PerlMagick. A crafted call to the GetList method can trigger the use-after-free, resulting in a crash (denial of service). | 4.8 | 07.09.2026 |
| CVE-2026-86424 | ImageMagick before 7.1.2-30 and 6.9.13-55 contains a time-of-check-time-of-use (TOCTOU) vulnerability in the video decoder that allows attackers to bypass path policy write restrictions via symlink swaps. An attacker can replace a symlink between policy valida | 2.0 | 07.09.2026 |
| CVE-2026-86425 | ImageMagick before 7.1.2-30 and 6.9.x before 6.9.13-55 contains a heap-use-after-free vulnerability in the Layer method of PerlMagick. An attacker who supplies a crafted list of images can trigger memory access after deallocation, resulting in a crash (denial | 4.8 | 07.09.2026 |
| CVE-2026-86420 | ImageMagick before 7.1.2-30 and 6.9.13-55 fails to properly lower the memory budget when an operation inside OpenPixelCache fails. Repeated triggering of such failures can exhaust the process memory budget and result in a denial of service. | 6.3 | 07.09.2026 |
| CVE-2026-86421 | ImageMagick before 7.1.2-30 and 6.9.13-55 contains a memory leak in the MSL image decoder. A crafted MSL image triggers memory allocation without proper deallocation, allowing an attacker to exhaust memory and cause a denial of service. | 6.3 | 07.09.2026 |
| CVE-2026-79678 | A flaw was found in FreeIPA's idp-add command, where insufficiently validated --organization/--base-url input reaches a constrained eval() call before the corresponding LDAP access control check is enforced. This allows any authenticated IPA principal, regardl | 8.1 | 07.09.2026 |
| CVE-2026-76578 | A flaw was found in FreeIPA. The self-managed OTP token ACI does not require authentication and does not restrict which attributes may be added alongside the token entry. An unauthenticated LDAP client can exploit this, combined with a related flaw in the unde | 9.8 | 07.09.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.