Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 31.015 CVE, 0 KEV kaydı · son NVD senkronu 06.11.2026 05:24. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-49418 | When msync(MS_INVALIDATE) is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager's page list. A subsequent page fault will cause the fault handler to re-insert the page into the | 8.8 | 19.08.2026 |
| CVE-2026-71046 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security). The supported version that is affected is 9.3.6. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Agile P | 8.8 | 19.08.2026 |
| CVE-2026-71041 | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Gantt Chart). The supported version that is affected is 9.3.6. Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Ag | 7.0 | 19.08.2026 |
| CVE-2026-70933 | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.25.0.000. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP | 7.1 | 19.08.2026 |
| CVE-2026-70805 | Vulnerability in the Oracle Project Planning and Control product of Oracle E-Business Suite (component: Change Management). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network a | 8.1 | 19.08.2026 |
| CVE-2026-12631 | The Zephyr kernel validates the k_thread_join() and k_thread_abort() system calls (declared __syscall in include/zephyr/kernel.h) through thread_obj_validate() in kernel/thread.c. Its default switch branch is the access-denied path, taken when k_object_validat | 6.5 | 19.08.2026 |
| CVE-2026-12632 | Zephyr's Precision Time Protocol receive handler ptp_msg_post_recv() in subsys/net/lib/ptp/msg.c takes the 4-bit message type straight off the wire via ptp_msg_type() (msg->header.type_major_sdo_id & 0xF, range 0-15) and uses it to index the msg_size[] table. | 6.5 | 19.08.2026 |
| CVE-2026-12520 | The Sierra Wireless HL7800 cellular modem driver (drivers/modem/vendor_standalone/hl7800.c, located at drivers/modem/hl7800.c in v4.4.0 and earlier) parses AT responses with roughly twenty handlers that call net_buf_linearize(value, sizeof(value), *buf, 0, len | 6.4 | 18.08.2026 |
| CVE-2026-65959 | Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler() without acl.CheckAccessHT | 5.3 | 18.08.2026 |
| CVE-2026-18963 | A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for an | 9.1 | 18.08.2026 |
| CVE-2026-75913 | CodeWhale versions >= 0.3.27 and < 0.8.64 (published as deepseek-tui >= 0.3.27 and < 0.8.41 on npm and 0.3.27 through 0.8.41 on crates.io, and as codewhale / codewhale-tui >= 0.8.41 and < 0.8.64) contain an argument injection vulnerability in the git_show tool | 8.5 | 18.08.2026 |
| CVE-2026-75857 | CodeWhale versions >= 0.3.10 and < 0.8.64 (published as deepseek-tui >= 0.3.10 and < 0.8.41 on npm and 0.3.10 through 0.8.41 on crates.io, and as codewhale / codewhale-tui >= 0.8.41 and < 0.8.64) contain a vulnerability in the exec_shell_interact (alias exec_i | 7.3 | 18.08.2026 |
| CVE-2026-71365 | A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism. When processing GitHub pull request webhooks, AWX extracts the status callback URL (pull_request.statuses_url) from the incoming webhook payload without va | 7.7 | 18.08.2026 |
| CVE-2026-12564 | A flaw was found in the AAP Controller's HashiCorp Vault credential plugin. The kubernetes_auth() function in awx_plugins/credentials/hashivault.py reads the controller pod's Kubernetes service account token and sends it to an attacker-controlled URL when a Ha | 9.6 | 18.08.2026 |
| CVE-2026-75032 | A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. | 6.3 | 18.08.2026 |
| CVE-2026-74015 | Unauthenticated SQL Injection in Readabler < 2.0.18 versions. | 9.3 | 18.08.2026 |
| CVE-2026-73996 | Unrestricted Upload of File with Dangerous Type vulnerability in ThemeGrill Masteriyo - LMS learning-management-system allows Upload a Web Shell to a Web Server.This issue affects Masteriyo - LMS: from n/a through 2.3.2. | 9.8 | 18.08.2026 |
| CVE-2026-73367 | Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions. | 7.2 | 18.08.2026 |
| CVE-2026-73375 | Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions. | 7.1 | 18.08.2026 |
| CVE-2026-73376 | Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions. | 9.8 | 18.08.2026 |
| CVE-2026-73377 | Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions. | 7.5 | 18.08.2026 |
| CVE-2026-73378 | Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions. | 7.1 | 18.08.2026 |
| CVE-2026-73379 | Unauthenticated Bypass Vulnerability in Contact Form by Supsystic < 1.10.0 versions. | 6.5 | 18.08.2026 |
| CVE-2026-73348 | Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions. | 6.5 | 18.08.2026 |
| CVE-2026-73339 | Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions. | 9.3 | 18.08.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.