Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 29.520 CVE, 0 KEV kaydı · son NVD senkronu 05.11.2026 23:24. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-16991 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to gain elevated privileges due to improper handling of symbolic links. | 7.8 | 21.08.2026 |
| CVE-2026-16996 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to an integer underflow. | 8.8 | 21.08.2026 |
| CVE-2026-16997 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary commands due to improper privilege management. | 7.8 | 21.08.2026 |
| CVE-2026-17000 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper authentication. | 9.8 | 21.08.2026 |
| CVE-2026-17003 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to compromise the confidentiality and integrity of the system due to an out-of-bounds write. | 9.1 | 21.08.2026 |
| CVE-2026-16973 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to disclose sensitive kernel memory due to an out-of-bounds read. | 5.5 | 21.08.2026 |
| CVE-2026-16980 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to cause a denial of service due to improper validation of symbolic links. | 5.5 | 21.08.2026 |
| CVE-2026-77176 | A flaw was found in Kata Containers. In configurations utilizing genpolicy for Confidential Containers guest protection, a malicious host operator can exploit insufficient validation of CreateContainer mount and storage rules. This allows them to mount arbitra | 8.1 | 20.08.2026 |
| CVE-2026-64965 | ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user (e.g. a student) enrolled in a course can bypass authorization checks by sending requests directly to the backend import endpoints, | 5.3 | 20.08.2026 |
| CVE-2026-64966 | ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality. An attacker with instructor privileges can upload and extract a specially crafted ZIP archive, causing files to be written outside the intended extraction directory. This a | 8.7 | 20.08.2026 |
| CVE-2026-64960 | ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, files are stored in a web-accessible location before their content is validated. An authenticated attacker who knows a va | 8.7 | 20.08.2026 |
| CVE-2026-64961 | ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values required for token validation remain uninitialized in certain code paths. An unauthenticated attacker who can determine a u | 6.3 | 20.08.2026 |
| CVE-2026-64962 | ATutor is vulnerable to Cross-Site Request Forgery (CSRF) in profile update functionality. An attacker can craft a malicious website which, when visited by an authenticated victim, submits a forged request to the system. Due to the lack of proper CSRF token im | 5.1 | 20.08.2026 |
| CVE-2026-64963 | A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when the AT_FORCE_GET_FILE configuration option is enabled. This can lead to unauthorized access to files and disclosure of information about th | 2.3 | 20.08.2026 |
| CVE-2026-64964 | ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account confirmation functionality. Due to the use of predictable values related to user registration, an attacker who knows or can predict these value | 6.3 | 20.08.2026 |
| CVE-2026-15706 | Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application (BMS) | 9.8 | 20.08.2026 |
| CVE-2026-7485 | Incorrect authorization in frozen BI aggregations in Checkmk <2.5.0p2, <2.4.0p29, <2.3.0p47, and all 2.2.0 versions allows an authenticated user with restricted host and service visibility to learn the names and the existence of hosts and services they are not | 2.3 | 20.08.2026 |
| CVE-2026-77118 | A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pcd.c), the Huffman delta loop advances its output pointer with q++ after every decoded delta and never checks it against the end of the heap-allocated | 8.4 | 20.08.2026 |
| CVE-2026-77079 | n8n before 2.34.1 and 2.33.4 contains an authorization bypass in the custom project role deletion (reassignment) path. When deleting a custom project role with a reassignment target, the code validated only that the target role existed and was project-scoped, | 7.4 | 20.08.2026 |
| CVE-2026-74014 | Subscriber Arbitrary File Upload in IT Residence <= 3.2.1 versions. | 9.9 | 20.08.2026 |
| CVE-2026-74001 | Unauthenticated Broken Authentication in User Registration & Membership Pro <= 5.4.5 versions. | 9.8 | 20.08.2026 |
| CVE-2026-66581 | Unauthenticated Cross Site Scripting (XSS) in JetEngine <= 3.8.14.1 versions. | 7.1 | 20.08.2026 |
| CVE-2026-66590 | Unauthenticated Cross Site Scripting (XSS) in Tagembed <= 7.4 versions. | 7.1 | 20.08.2026 |
| CVE-2026-73196 | A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password (OTP) key value. This oversized key is then decoded and re-encoded without proper size limits, consuming excessive CPU a | 6.5 | 20.08.2026 |
| CVE-2026-73197 | A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodie | 7.5 | 20.08.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.