Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 9.635 CVE, 0 KEV kaydı · son NVD senkronu 25.10.2026 22:11. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-76259 | In Splunk Enterprise for Windows versions below 10.4.2, 10.2.6, 10.0.9, 9.4.13, and 9.3.14, a local user with access to the Windows host could bind to the management port before Splunk Enterprise starts, intercept authentication tokens from child processes, an | 7.8 | 20.08.2026 |
| CVE-2026-55089 | Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/* in the authorization_code OAuth path by using requiredClaims with the admin claim. This check requires only that the | 9.9 | 19.08.2026 |
| CVE-2026-49870 | Snipe-IT is an IT asset/license management system. Prior to 8.6.1, POST /two-factor has no rate limiting, lockout, or attempt counter, allowing an attacker with valid credentials to submit unlimited TOTP guesses against the three accepted codes created by conf | 5.9 | 19.08.2026 |
| CVE-2026-61518 | ISPConfig contains an authenticated SQL injection vulnerability in the Remote API. The primary_id parameter passed to delete and update API methods is concatenated directly into SQL WHERE clauses without integer casting or parameterized query binding. The buil | 8.7 | 19.08.2026 |
| CVE-2026-76239 | Stigmem before 0.9.0a11 fails to validate the delivery_address parameter when creating webhook subscriptions, allowing authenticated users to specify internal loopback and private network destinations. Attackers can trigger matching fact-change events to cause | 5.3 | 19.08.2026 |
| CVE-2026-76226 | Renovate versions from 43.65.0 before 43.102.11 contain a remote code execution vulnerability in bazel-module and bazelisk managers when using lockFileMaintenance. Attackers can execute arbitrary code by providing malicious dependencies that are referenced in | 6.8 | 19.08.2026 |
| CVE-2026-76221 | GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject m | 8.7 | 19.08.2026 |
| CVE-2026-54796 | Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerabilit | 7.2 | 19.08.2026 |
| CVE-2026-67363 | Joomla Extension - balbooa.com - Pre-auth Payment Amount Tampering in Balbooa Forms < 2.4.3.2 - The stripeCharges and payAuthorize endpoints accept the charge total from a client-controlled request parameter and forward it to the payment gateway without recomp | 7.7 | 19.08.2026 |
| CVE-2026-71046 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile P | 8.8 | 19.08.2026 |
| CVE-2026-71041 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Gantt Chart). The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Ag | 7.0 | 19.08.2026 |
| CVE-2026-70933 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP | 7.1 | 19.08.2026 |
| CVE-2026-18963 | A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for an | 9.1 | 18.08.2026 |
| CVE-2026-74015 | Unauthenticated SQL Injection in Readabler < 2.0.18 versions. | 9.3 | 18.08.2026 |
| CVE-2026-73367 | Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions. | 7.2 | 18.08.2026 |
| CVE-2026-73375 | Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions. | 7.1 | 18.08.2026 |
| CVE-2026-73376 | Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions. | 9.8 | 18.08.2026 |
| CVE-2026-73377 | Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions. | 7.5 | 18.08.2026 |
| CVE-2026-73378 | Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions. | 7.1 | 18.08.2026 |
| CVE-2026-73379 | Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions. | 6.5 | 18.08.2026 |
| CVE-2026-73348 | Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions. | 6.5 | 18.08.2026 |
| CVE-2026-73339 | Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions. | 9.3 | 18.08.2026 |
| CVE-2026-73343 | Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions. | 10.0 | 18.08.2026 |
| CVE-2026-73181 | Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions. | 7.5 | 18.08.2026 |
| CVE-2026-66633 | Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions. | 7.1 | 18.08.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.