Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 28.062 CVE, 0 KEV kaydı · son NVD senkronu 05.11.2026 11:23. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-70805 | Vulnerability in the Oracle Project Planning and Control product of Oracle E-Business Suite (component: Change Management). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network a | 8.1 | 19.08.2026 |
| CVE-2026-12631 | The Zephyr kernel validates the k_thread_join() and k_thread_abort() system calls (declared __syscall in include/zephyr/kernel.h) through thread_obj_validate() in kernel/thread.c. Its default switch branch is the access-denied path, taken when k_object_validat | 6.5 | 19.08.2026 |
| CVE-2026-12632 | Zephyr's Precision Time Protocol receive handler ptp_msg_post_recv() in subsys/net/lib/ptp/msg.c takes the 4-bit message type straight off the wire via ptp_msg_type() (msg->header.type_major_sdo_id & 0xF, range 0-15) and uses it to index the msg_size[] table. | 6.5 | 19.08.2026 |
| CVE-2026-12520 | The Sierra Wireless HL7800 cellular modem driver (drivers/modem/vendor_standalone/hl7800.c, located at drivers/modem/hl7800.c in v4.4.0 and earlier) parses AT responses with roughly twenty handlers that call net_buf_linearize(value, sizeof(value), *buf, 0, len | 6.4 | 18.08.2026 |
| CVE-2026-65959 | Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessHT | 5.3 | 18.08.2026 |
| CVE-2026-18963 | A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for an | 9.1 | 18.08.2026 |
| CVE-2026-75913 | CodeWhale versions >= 0.3.27 and < 0.8.64 (published as deepseek-tui >= 0.3.27 and < 0.8.41 on npm and 0.3.27 through 0.8.41 on crates.io, and as codewhale / codewhale-tui >= 0.8.41 and < 0.8.64) contain an argument injection vulnerability in the git_show tool | 8.5 | 18.08.2026 |
| CVE-2026-75857 | CodeWhale versions >= 0.3.10 and < 0.8.64 (published as deepseek-tui >= 0.3.10 and < 0.8.41 on npm and 0.3.10 through 0.8.41 on crates.io, and as codewhale / codewhale-tui >= 0.8.41 and < 0.8.64) contain a vulnerability in the exec_shell_interact (alias exec_i | 7.3 | 18.08.2026 |
| CVE-2026-71365 | A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL (pull_request.statuses_url) from the incoming webhook payload without va | 7.7 | 18.08.2026 |
| CVE-2026-12564 | A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a Ha | 9.6 | 18.08.2026 |
| CVE-2026-74015 | Unauthenticated SQL Injection in Readabler < 2.0.18 versions. | 9.3 | 18.08.2026 |
| CVE-2026-73367 | Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions. | 7.2 | 18.08.2026 |
| CVE-2026-73375 | Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions. | 7.1 | 18.08.2026 |
| CVE-2026-73376 | Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions. | 9.8 | 18.08.2026 |
| CVE-2026-73377 | Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions. | 7.5 | 18.08.2026 |
| CVE-2026-73378 | Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions. | 7.1 | 18.08.2026 |
| CVE-2026-73379 | Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions. | 6.5 | 18.08.2026 |
| CVE-2026-73348 | Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions. | 6.5 | 18.08.2026 |
| CVE-2026-73339 | Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions. | 9.3 | 18.08.2026 |
| CVE-2026-73343 | Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions. | 10.0 | 18.08.2026 |
| CVE-2026-73181 | Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions. | 7.5 | 18.08.2026 |
| CVE-2026-68567 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Grids EasyTest – Simplify A/B Testing convertpro allows DOM-Based XSS.This issue affects EasyTest – Simplify A/B Testing: from n/a through 1.0.1. | 7.1 | 18.08.2026 |
| CVE-2026-66633 | Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions. | 7.1 | 18.08.2026 |
| CVE-2026-74985 | Privilege escalation in the Enterprise Policies component. This vulnerability was fixed in Firefox 154, Firefox ESR 153.1, Thunderbird 154, and Thunderbird 153.1. | 9.8 | 18.08.2026 |
| CVE-2026-74987 | Internally found bugs present in Firefox ESR 140.13, Firefox ESR 153.0 and Firefox 153. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. | 9.8 | 18.08.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.