Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 34.990 CVE, 0 KEV kaydı · son NVD senkronu 10.11.2026 11:27. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-48121 | @langchain/langgraph-checkpoint-mongodb provides a LangGraph.js CheckpointSaver implementation that uses MongoDB for storage. Versions 1.3.0 and below are vulnerable to NoSQL injection: checkpoint identifiers (thread_id, checkpoint_ns, checkpoint_id) from conf | 6.7 | 04.08.2026 |
| CVE-2026-18774 | A flaw has been found in NousResearch hermes-agent up to 0.16.0. This affects the function save_url_image of the file agent/image_gen_provider.py of the component xAI Image Generation Provider. This manipulation causes server-side request forgery. The attack m | 2.1 | 04.08.2026 |
| CVE-2026-18775 | A vulnerability has been found in NousResearch hermes-agent up to 0.16.0. This vulnerability affects the function browser_snapshot of the file tools/browser_tool.py of the component Browser Tooling. Such manipulation leads to server-side request forgery. The a | 2.1 | 04.08.2026 |
| CVE-2026-18784 | A vulnerability was found in o6 open62541 up to 1.5.5. This issue affects the function UA_Client_readNodeClassAttribute of the file src/client/ua_client_highlevel.c. Performing a manipulation results in heap-based buffer overflow. Attacking locally is a requir | 1.9 | 04.08.2026 |
| CVE-2026-18785 | A vulnerability was determined in o6 open62541 ca356b088ada7dee824d1b4acd07c1ff07ce242b. Impacted is the function UA_Client_getRemoteDataTypes of the file examples/custom_datatype/client_types_custom.c. Executing a manipulation can lead to use after free. It i | 1.9 | 04.08.2026 |
| CVE-2026-18787 | A vulnerability was identified in GL.iNet AX1800 up to 4.8.3. The affected element is the function remove_rule of the file /usr/share/gl-ngx/oui-rpc.lua of the component RPC Endpoint. The manipulation of the argument args.id leads to command injection. The att | 7.4 | 04.08.2026 |
| CVE-2026-15307 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial lo | 8.7 | 04.08.2026 |
| CVE-2026-15314 | Tapo P110 v1 smart Wi-Fi Plug contains an improper boundary validation vulnerability in the handling of authenticated HTTP request bodies due to insufficient input validation before memory copy operations. This may lead to buffer overflow condition, causing th | 7.1 | 04.08.2026 |
| CVE-2026-15337 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()` is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in | 6.9 | 04.08.2026 |
| CVE-2026-15830 | An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects supplied as well-known text (WKT), | 6.9 | 04.08.2026 |
| CVE-2026-15920 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed a | 5.1 | 04.08.2026 |
| CVE-2026-69253 | Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to version 3.1.3, several custom-tool components — AgentAsTool, ChatflowTool, and ExecuteFlow — ran code in the in-process vm2 sandbox. To build that co | 9.0 | 04.08.2026 |
| CVE-2026-69254 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode() accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.t | 9.4 | 04.08.2026 |
| CVE-2026-69098 | kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a __type__ field. Attackers can | 9.3 | 04.08.2026 |
| CVE-2026-69100 | LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attac | 8.7 | 04.08.2026 |
| CVE-2026-69110 | OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:f | 9.3 | 04.08.2026 |
| CVE-2026-69252 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authentica | 7.2 | 04.08.2026 |
| CVE-2026-25292 | Memory Corruption when processing untrusted user input in the fastboot command handler for audio framework configuration. | 7.6 | 04.08.2026 |
| CVE-2026-24083 | Memory Corruption while processing IOCTL device driver requests with invalid arguments. | 7.8 | 04.08.2026 |
| CVE-2026-24084 | Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities. | 7.5 | 04.08.2026 |
| CVE-2026-25288 | Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size. | 7.4 | 04.08.2026 |
| CVE-2026-25289 | Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values. | 9.6 | 04.08.2026 |
| CVE-2026-24077 | Information Disclosure when processing wireless network channel switch information with improperly formatted length fields. | 6.5 | 04.08.2026 |
| CVE-2026-24078 | Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling. | 6.5 | 04.08.2026 |
| CVE-2026-24079 | Cryptographic Issue while processing registration requests with malformed or missing authentication parameters. | 8.1 | 04.08.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.