Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 35.867 CVE, 0 KEV kaydı · son NVD senkronu 10.11.2026 17:27. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-15337 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.utils.translation.check_for_language()` is subject to a potential denial-of-service attack when given many distinct, very long language codes, which are retained as keys in an in | 6.9 | 04.08.2026 |
| CVE-2026-15830 | An issue was discovered in Django 6.0 before 6.0.9 and 5.2 before 5.2.18. GeoDjango's `django.contrib.gis.geos.GEOSGeometry` is subject to a potential denial-of-service when parsing deeply nested `GEOMETRYCOLLECTION` objects supplied as well-known text (WKT), | 6.9 | 04.08.2026 |
| CVE-2026-15920 | An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. `django.contrib.admin.utils.display_for_field()` renders `URLField` values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed a | 5.1 | 04.08.2026 |
| CVE-2026-69253 | Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to version 3.1.3, several custom-tool components — AgentAsTool, ChatflowTool, and ExecuteFlow — ran code in the in-process vm2 sandbox. To build that co | 9.0 | 04.08.2026 |
| CVE-2026-69254 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, executeJavaScriptCode() accepted caller-provided nodeVMOptions and merged them over the default NodeVM security settings in packages/components/src/utils.t | 9.4 | 04.08.2026 |
| CVE-2026-69098 | kotaemon through 0.12.0 contains an insecure deserialization vulnerability in the check_connection endpoint that allows unauthenticated attackers to instantiate arbitrary Python classes by supplying crafted YAML/JSON input with a __type__ field. Attackers can | 9.3 | 04.08.2026 |
| CVE-2026-69100 | LAMP Rapid Development Platform through 5.6.2, fixed in commit 84b0c27, contains a remote code execution vulnerability in GlueFactory that executes unsandboxed Groovy scripts from database template fields without compilation restrictions or whitelisting. Attac | 8.7 | 04.08.2026 |
| CVE-2026-69110 | OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:f | 9.3 | 04.08.2026 |
| CVE-2026-69252 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authentica | 7.2 | 04.08.2026 |
| CVE-2026-25292 | Memory Corruption when processing untrusted user input in the fastboot command handler for audio framework configuration. | 7.6 | 04.08.2026 |
| CVE-2026-24083 | Memory Corruption while processing IOCTL device driver requests with invalid arguments. | 7.8 | 04.08.2026 |
| CVE-2026-24084 | Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities. | 7.5 | 04.08.2026 |
| CVE-2026-25288 | Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size. | 7.4 | 04.08.2026 |
| CVE-2026-25289 | Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values. | 9.6 | 04.08.2026 |
| CVE-2026-24077 | Information Disclosure when processing wireless network channel switch information with improperly formatted length fields. | 6.5 | 04.08.2026 |
| CVE-2026-24078 | Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling. | 6.5 | 04.08.2026 |
| CVE-2026-24079 | Cryptographic Issue while processing registration requests with malformed or missing authentication parameters. | 8.1 | 04.08.2026 |
| CVE-2026-24080 | Memory Corruption when handling malformed request parameters in the fingerprint TA. | 7.8 | 04.08.2026 |
| CVE-2026-18773 | A vulnerability was detected in NousResearch hermes-agent up to 2026.6.5. Affected by this issue is the function _check_slash_access of the file gateway/run.py of the component Quick Command Handler. The manipulation results in incorrect authorization. The att | 2.1 | 04.08.2026 |
| CVE-2026-21366 | Memory corruption while processing a packet with a size close to the maximum allowed value. | 7.8 | 04.08.2026 |
| CVE-2026-24076 | Memory Corruption when processing registry values with incorrect types using a direct query method. | 6.7 | 04.08.2026 |
| CVE-2026-10032 | The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user cli | 6.1 | 04.08.2026 |
| CVE-2026-69250 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is unauthenticated by design and performs a server-side HTTP request | 8.5 | 04.08.2026 |
| CVE-2026-67618 | marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious base_url in PEP-723 inline script metadata, which is merged into session configuration with higher prec | 7.1 | 04.08.2026 |
| CVE-2026-68494 | The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength() into | 8.7 | 04.08.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.