Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 33.991 CVE, 0 KEV kaydı · son NVD senkronu 09.11.2026 11:26. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-18359 | Server-side request forgery in the METS and IIIF import URI handling in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to make the server issue arbitrary HTTP requests to internal hosts, including the cloud instance metadata service, v | 8.5 | 06.08.2026 |
| CVE-2026-18258 | Authorization bypass in the Line, LineTranscription, VirtualCollection, tag and process API endpoints in Scripta/eScriptorium through 26.04.1 allows a remote authenticated user to read, modify and delete other users' transcription content via primary keys supp | 8.8 | 06.08.2026 |
| CVE-2026-18275 | Authorization bypass in the process and annotation taxonomy serializers in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to run segmentation and transcription against other users' document parts, overwriting their content, via part pr | 6.5 | 06.08.2026 |
| CVE-2026-18276 | Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export and training activity | 4.3 | 06.08.2026 |
| CVE-2026-70637 | LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes data_socket and file_fd descrip | 8.2 | 06.08.2026 |
| CVE-2026-70646 | aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, `WebhookHandler.feed_update()` deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing | 7.5 | 06.08.2026 |
| CVE-2026-66711 | Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions. | 7.1 | 06.08.2026 |
| CVE-2026-66712 | Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions. | 7.5 | 06.08.2026 |
| CVE-2026-67261 | Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) an OS Command Injection vulnerability in the IAPI component. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to the execu | 9.8 | 06.08.2026 |
| CVE-2026-66703 | Contributor Cross Site Scripting (XSS) in MailOptin <= 1.2.78.0 versions. | 6.5 | 06.08.2026 |
| CVE-2026-66705 | Unauthenticated Cross Site Scripting (XSS) in Facebook for WordPress <= 5.2.1 versions. | 7.1 | 06.08.2026 |
| CVE-2026-66706 | Author Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 versions. | 5.9 | 06.08.2026 |
| CVE-2026-66707 | Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions. | 7.1 | 06.08.2026 |
| CVE-2026-66708 | Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions. | 8.2 | 06.08.2026 |
| CVE-2026-66709 | Shop manager Remote Code Execution (RCE) in CTX Feed <= 6.6.42 versions. | 9.1 | 06.08.2026 |
| CVE-2026-66688 | Contributor Cross Site Scripting (XSS) in Ultimate Addons for Elementor <= 1.45.2 versions. | 6.5 | 06.08.2026 |
| CVE-2026-66690 | Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions. | 7.1 | 06.08.2026 |
| CVE-2026-66692 | Customer Insecure Direct Object References (IDOR) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.10.0 versions. | 4.3 | 06.08.2026 |
| CVE-2026-66694 | Unauthenticated Cross Site Scripting (XSS) in Thrive Architect <= 10.9.3.1 versions. | 7.1 | 06.08.2026 |
| CVE-2026-66695 | Unauthenticated Path Traversal in W3 Total Cache <= 2.10.2 versions. | 6.5 | 06.08.2026 |
| CVE-2026-66696 | Contributor Sensitive Data Exposure in Gutenberg Blocks by Kadence Blocks <= 3.7.8 versions. | 4.3 | 06.08.2026 |
| CVE-2026-66699 | Custom role Broken Access Control in Dokan <= 5.0.10 versions. | 5.3 | 06.08.2026 |
| CVE-2026-66701 | Unauthenticated Broken Access Control in Profile Builder <= 3.16.5 versions. | 5.3 | 06.08.2026 |
| CVE-2026-66664 | Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.0 versions. | 7.1 | 06.08.2026 |
| CVE-2026-66665 | Unauthenticated Arbitrary File Upload in Type Hub <= 2.0.6 versions. | 10.0 | 06.08.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.