Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 12.456 CVE, 0 KEV kaydı · son NVD senkronu 26.10.2026 04:12. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-28155 | Unauthenticated Insecure Direct Object References (IDOR) in Do Lasso <= 358 versions. | 6.5 | 13.08.2026 |
| CVE-2026-28156 | Subscriber SQL Injection in Do Lasso <= 358 versions. | 8.5 | 13.08.2026 |
| CVE-2026-28157 | Subscriber Path Traversal in Do Lasso <= 358 versions. | 7.5 | 13.08.2026 |
| CVE-2026-28158 | Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions. | 7.1 | 13.08.2026 |
| CVE-2026-28159 | Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions. | 6.5 | 13.08.2026 |
| CVE-2026-28161 | Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions. | 8.8 | 13.08.2026 |
| CVE-2026-27999 | Subscriber Broken Access Control in Tourfic <= 2.23.1 versions. | 6.5 | 13.08.2026 |
| CVE-2026-28001 | Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. | 9.3 | 13.08.2026 |
| CVE-2026-28002 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22. | 8.5 | 13.08.2026 |
| CVE-2026-28003 | Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions. | 7.1 | 13.08.2026 |
| CVE-2026-28004 | Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions. | 7.1 | 13.08.2026 |
| CVE-2026-28008 | Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions. | 9.8 | 13.08.2026 |
| CVE-2026-28142 | Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions. | 9.3 | 13.08.2026 |
| CVE-2026-28148 | Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions. | 9.8 | 13.08.2026 |
| CVE-2026-27535 | Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions. | 7.1 | 13.08.2026 |
| CVE-2026-27536 | Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions. | 7.1 | 13.08.2026 |
| CVE-2026-27537 | Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions. | 6.5 | 13.08.2026 |
| CVE-2026-27538 | Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. | 7.5 | 13.08.2026 |
| CVE-2026-27539 | Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions. | 7.1 | 13.08.2026 |
| CVE-2026-27543 | Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions. | 8.1 | 13.08.2026 |
| CVE-2026-27544 | Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions. | 10.0 | 13.08.2026 |
| CVE-2026-19716 | Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend | 5.1 | 13.08.2026 |
| CVE-2026-21832 | HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may be displayed to users, potentially resulting in unintended behavior or security impact under certain conditions. | 4.3 | 13.08.2026 |
| CVE-2026-27345 | Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions. | 7.5 | 13.08.2026 |
| CVE-2026-27380 | Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions. | 7.2 | 13.08.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.