Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 40.867 CVE, 0 KEV kaydı · son NVD senkronu 13.11.2026 17:29. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-69110 | OpenCode Studio before 2.4.4 contains a missing authentication vulnerability that allows unauthenticated remote attackers to read arbitrary files within the temp and static/music directories by directly accessing the GET /api/tmp/:tmpFile and GET /api/music/:f | 9.3 | 04.08.2026 |
| CVE-2026-69252 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat:files feature gate and did not enforce checkPermission on GET or DELETE. A low-privileged authentica | 7.2 | 04.08.2026 |
| CVE-2026-25292 | Memory Corruption when processing untrusted user input in the fastboot command handler for audio framework configuration. | 7.6 | 04.08.2026 |
| CVE-2026-24083 | Memory Corruption while processing IOCTL device driver requests with invalid arguments. | 7.8 | 04.08.2026 |
| CVE-2026-24084 | Weak configuration when UE does not verify the consistency of its additional security capabilities with the replayed capabilities. | 7.5 | 04.08.2026 |
| CVE-2026-25288 | Transient DOS when processing a short target wake time channel usage response frame with insufficient packet size. | 7.4 | 04.08.2026 |
| CVE-2026-25289 | Memory Corruption when processing Device Capability Extended attributes in certain NAN Service Discovery Frames with invalid length values. | 9.6 | 04.08.2026 |
| CVE-2026-24077 | Information Disclosure when processing wireless network channel switch information with improperly formatted length fields. | 6.5 | 04.08.2026 |
| CVE-2026-24078 | Information Disclosure when IPSec negotiation fails or is not established properly during NG-eCall SIP signaling. | 6.5 | 04.08.2026 |
| CVE-2026-24079 | Cryptographic Issue while processing registration requests with malformed or missing authentication parameters. | 8.1 | 04.08.2026 |
| CVE-2026-24080 | Memory Corruption when handling malformed request parameters in the fingerprint TA. | 7.8 | 04.08.2026 |
| CVE-2026-18773 | A vulnerability was detected in NousResearch hermes-agent up to 2026.6.5. Affected by this issue is the function _check_slash_access of the file gateway/run.py of the component Quick Command Handler. The manipulation results in incorrect authorization. The att | 2.1 | 04.08.2026 |
| CVE-2026-21366 | Memory corruption while processing a packet with a size close to the maximum allowed value. | 7.8 | 04.08.2026 |
| CVE-2026-24076 | Memory Corruption when processing registry values with incorrect types using a direct query method. | 6.7 | 04.08.2026 |
| CVE-2026-10032 | The openUrl function in @a2ui/web_core passes an agent-controlled URL directly to window.open() without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user cli | 6.1 | 04.08.2026 |
| CVE-2026-69250 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the OAuth2 token refresh endpoint POST /api/v1/oauth2-credential/refresh/:credentialId is unauthenticated by design and performs a server-side HTTP request | 8.5 | 04.08.2026 |
| CVE-2026-67618 | marimo before 0.23.15 contains a configuration injection vulnerability that allows notebook authors to exfiltrate operator API keys by embedding a malicious base_url in PEP-723 inline script metadata, which is merged into session configuration with higher prec | 7.1 | 04.08.2026 |
| CVE-2026-68494 | The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-blocking parser) is incomplete. This record covers the remaining bypass. The earlier fix wired validateIntegerLength() into | 8.7 | 04.08.2026 |
| CVE-2026-67195 | Perspective 5.0.0 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary operating system commands by submitting crafted expression strings to the PolarsVirtualServer backend, which passes client-supplied inpu | 8.7 | 04.08.2026 |
| CVE-2026-67196 | Perspective 5.0.0 contains a cross-site scripting vulnerability in the built-in Debug plugin that allows attackers to inject arbitrary HTML and JavaScript by writing table cell values containing unescaped HTML markup, which are interpolated directly into inner | 5.1 | 04.08.2026 |
| CVE-2026-67198 | Perspective 5.0.0 contains a denial-of-service vulnerability in the VirtualServer protocol dispatcher that allows unauthenticated remote attackers to crash the server process by sending malformed or incomplete protobuf messages. Attackers can send well-formed | 8.7 | 04.08.2026 |
| CVE-2026-67199 | Perspective 5.0.0 contains a denial of service vulnerability that allows remote attackers to block the server event loop indefinitely by submitting a crafted expression containing unbounded for or while loop constructs in a TableMakeViewReq message. Attackers | 7.1 | 04.08.2026 |
| CVE-2026-67200 | Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths. Attackers can bypass the insufficient query-s | 8.7 | 04.08.2026 |
| CVE-2026-61514 | Puwell IP Camera firmware versions 2.x through 4.x contains an authentication bypass vulnerability that allows unauthenticated attackers to access device functions by sending protocol-conforming packets over TCP port 23456 without credentials. Attackers can ex | 9.3 | 04.08.2026 |
| CVE-2026-61515 | Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on | 9.3 | 04.08.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.