Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 27.948 CVE, 0 KEV kaydı · son NVD senkronu 05.11.2026 05:23. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-13213 | The Hearing Access Service (HAS) GATT server in subsys/bluetooth/audio/has.c installs a connection-callback set unconditionally via BT_CONN_CB_DEFINE, so security_changed() runs for every connection that establishes security even before the application has cal | 5.3 | 24.08.2026 |
| CVE-2026-78465 | A flaw was found in the file-pcx plugin in GIMP, affecting 32-bit builds only. When processing a PCX image file, the plugin calculates memory allocation sizes based on the image dimensions and the number of color planes. If a crafted file sets the number of pl | 7.0 | 24.08.2026 |
| CVE-2026-66907 | Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-google-storage consumer downloads Google Cloud Stor | 7.5 | 24.08.2026 |
| CVE-2026-66908 | Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main embedded HTTP server can protect its endpoints with JWT authentication, configured through authe | 7.5 | 24.08.2026 |
| CVE-2026-19685 | NetworkManager did not apply the private_user restriction to the 802-1x.ca-path and phase2-ca-path directory-valued connection properties. This incomplete fix for CVE-2025-9615 allows an unprivileged local user to point a private WPA-Enterprise (802.1X) connec | 7.1 | 24.08.2026 |
| CVE-2026-71364 | A path traversal vulnerability was found in AWX's project archive extraction. The project_archive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary | 7.2 | 24.08.2026 |
| CVE-2026-71366 | A server-side request forgery (SSRF) vulnerability was found in multiple AWX notification backends. The webhook, Mattermost, Rocket.Chat, and Grafana notification backends use notification template URLs as direct HTTP request targets without validating the tar | 7.7 | 24.08.2026 |
| CVE-2026-13212 | The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtio_isr() (drivers/virtio/virtio_common.c), the device-written vq->used->ring[idx].id is used directly as an index into vq->recv_cbs | 8.8 | 24.08.2026 |
| CVE-2026-9728 | The userspace syscall verifier z_vrfy_mbox_send() in drivers/mbox/mbox_handlers.c validated the nested msg->data/msg->size fields by reading them directly out of live userspace memory, and then forwarded the original, still-mutable userspace struct mbox_msg * | 6.4 | 24.08.2026 |
| CVE-2026-78376 | A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory handling and result in memory corruption. | 8.8 | 24.08.2026 |
| CVE-2026-77995 | Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Single Sign-On – OIDC SSO < 1.2.2, Login with Keycloak OAuth Single Sign-On (SSO) < 1.2.2, Single Sign-On for Educational Institutes < 1.2.2 - The manipula | 10.0 | 24.08.2026 |
| CVE-2026-78258 | Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions. | 5.3 | 24.08.2026 |
| CVE-2026-66585 | Unauthenticated Sensitive Data Exposure in WP Cafe Pro < 3.0.15 versions. | 7.5 | 24.08.2026 |
| CVE-2026-66587 | Unauthenticated Local File Inclusion in WP Cafe Pro < 3.0.15 versions. | 9.8 | 24.08.2026 |
| CVE-2026-28151 | Unauthenticated Local File Inclusion in Tonda < 2.6 versions. | 8.1 | 24.08.2026 |
| CVE-2026-28152 | Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions. | 8.1 | 24.08.2026 |
| CVE-2026-28167 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebRehab Super Forms super-forms allows Path Traversal.This issue affects Super Forms: from n/a through 6.3.316. | 7.5 | 24.08.2026 |
| CVE-2026-78314 | SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution. | 8.8 | 24.08.2026 |
| CVE-2026-66897 | A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths speci | 9.9 | 24.08.2026 |
| CVE-2026-77993 | Joomla Extension - joomlack.fr - Reflected XSS in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a reflected XSS via the iscontenttype parameter. | 5.3 | 24.08.2026 |
| CVE-2026-77994 | Joomla Extension - joomlack.fr - Second order SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related to the loadStyles method of the frontend page model. | 9.3 | 24.08.2026 |
| CVE-2026-78202 | A vulnerability was found in itsourcecode Payroll System 1.0. This affects the function save_settings of the file admin_class.php. The manipulation of the argument img results in unrestricted upload. The attack may be performed from remote. The exploit has bee | 5.5 | 24.08.2026 |
| CVE-2026-78201 | A vulnerability has been found in itsourcecode Payroll System 1.0. The impacted element is the function Login of the file admin_class.php. The manipulation of the argument Username leads to sql injection. The attack is possible to be carried out remotely. The | 5.5 | 24.08.2026 |
| CVE-2026-78200 | A flaw has been found in itsourcecode Library Management System 1.0. The affected element is an unknown function of the file editbooks.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit | 2.1 | 24.08.2026 |
| CVE-2026-78185 | A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/cust_edit.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The ex | 2.1 | 24.08.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.