Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 32.866 CVE, 0 KEV kaydı · son NVD senkronu 07.11.2026 11:24. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-28157 | Subscriber Path Traversal in Do Lasso <= 358 versions. | 7.5 | 13.08.2026 |
| CVE-2026-28158 | Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions. | 7.1 | 13.08.2026 |
| CVE-2026-28159 | Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions. | 6.5 | 13.08.2026 |
| CVE-2026-28161 | Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions. | 8.8 | 13.08.2026 |
| CVE-2026-27999 | Subscriber Broken Access Control in Tourfic <= 2.23.1 versions. | 6.5 | 13.08.2026 |
| CVE-2026-28001 | Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. | 9.3 | 13.08.2026 |
| CVE-2026-28002 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22. | 8.5 | 13.08.2026 |
| CVE-2026-28003 | Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions. | 7.1 | 13.08.2026 |
| CVE-2026-28004 | Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions. | 7.1 | 13.08.2026 |
| CVE-2026-28008 | Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions. | 9.8 | 13.08.2026 |
| CVE-2026-28142 | Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions. | 9.3 | 13.08.2026 |
| CVE-2026-28148 | Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions. | 9.8 | 13.08.2026 |
| CVE-2026-27535 | Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions. | 7.1 | 13.08.2026 |
| CVE-2026-27536 | Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions. | 7.1 | 13.08.2026 |
| CVE-2026-27537 | Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.11.2 versions. | 6.5 | 13.08.2026 |
| CVE-2026-27538 | Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. | 7.5 | 13.08.2026 |
| CVE-2026-27539 | Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions. | 7.1 | 13.08.2026 |
| CVE-2026-27543 | Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions. | 8.1 | 13.08.2026 |
| CVE-2026-27544 | Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions. | 10.0 | 13.08.2026 |
| CVE-2026-19716 | Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend | 5.1 | 13.08.2026 |
| CVE-2026-21832 | HCL AION is affected by a vulnerability where indirect prompt injection can lead to HTML injection in rendered output. Injected markup may be displayed to users, potentially resulting in unintended behavior or security impact under certain conditions. | 4.3 | 13.08.2026 |
| CVE-2026-27345 | Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions. | 7.5 | 13.08.2026 |
| CVE-2026-27380 | Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions. | 7.2 | 13.08.2026 |
| CVE-2026-73583 | A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's inter-process communication (IPC) message parsing. By sending a specially crafted message, the attacker can | 6.6 | 13.08.2026 |
| CVE-2026-73584 | A flaw was found in sblim-sfcb. A local, low-privileged attacker can exploit a race condition during privileged instance migration by manipulating a temporary file in the `/tmp` directory. By repeatedly recreating a symbolic link, the attacker can redirect pri | 6.3 | 13.08.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.