Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 41.242 CVE, 0 KEV kaydı · son NVD senkronu 14.11.2026 11:30. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-18028 | The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. | 2.3 | 28.07.2026 |
| CVE-2026-18029 | Our payment integration with GiroCheckout did not properly validate payment status responses. An attacker could use a successful payment status response from one payment and supply it to the system for a different payment, gaining access to multiple valid t | 6.3 | 28.07.2026 |
| CVE-2026-63301 | In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, the underlying language-deletion API endpoint does not enforce an equivalent server-side authorization | 7.0 | 28.07.2026 |
| CVE-2026-63302 | Quick.CMS is vulnerable to Local File Inclusion (LFI) in the admin.php endpoint via the p parameter. An authenticated attacker with admin privileges can include arbitrary files located within the application's directory structure via a crafted HTTP request. Su | 5.1 | 28.07.2026 |
| CVE-2026-17072 | A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not accoun | 3.3 | 28.07.2026 |
| CVE-2026-59248 | Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service. The HPACK and QPACK prefixed-integer decoder | 8.7 | 28.07.2026 |
| CVE-2026-65624 | Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1. The HTTP/1.1 handler in cowboy_http enforces the max_headers limit by counting | 6.9 | 28.07.2026 |
| CVE-2026-58246 | SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privileged user. An attacker with access to the resulting trace data could obtain identifiers t | 4.3 | 28.07.2026 |
| CVE-2026-16462 | In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This allows a remote unauthenticated attacker to execute arbitrary SQL commands. | 9.3 | 28.07.2026 |
| CVE-2026-8167 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in THEWP Digital Solutions News Theme V8 allows Reflected XSS. This issue affects News Theme V8: through 16.06.2026. | 6.1 | 28.07.2026 |
| CVE-2026-9680 | Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpoint listening on all network interfaces by default. | 5.8 | 28.07.2026 |
| CVE-2026-55977 | Successful exploitation of this vulnerability could allow an attacker with local network access to bypass the application's rate-limiting mechanism, enabling brute-forcing of the screen-sharing code and potentially displaying harmful content on the affected sc | 3.3 | 28.07.2026 |
| CVE-2026-11756 | A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could lead to an unauthenticated remote code execution. | 10.0 | 28.07.2026 |
| CVE-2026-65441 | Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions. | 7.1 | 28.07.2026 |
| CVE-2026-65442 | Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions. | 7.2 | 28.07.2026 |
| CVE-2026-65443 | Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions. | 7.1 | 28.07.2026 |
| CVE-2026-65445 | Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions. | 6.5 | 28.07.2026 |
| CVE-2026-65446 | Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions. | 7.1 | 28.07.2026 |
| CVE-2026-66473 | Unauthenticated Broken Access Control in Xendit Payment <= 7.1.0 versions. | 7.5 | 28.07.2026 |
| CVE-2026-61953 | Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro <= 15.0.6 versions. | 7.2 | 28.07.2026 |
| CVE-2026-61957 | Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions. | 7.1 | 28.07.2026 |
| CVE-2026-65438 | Unauthenticated Cross Site Scripting (XSS) in Message Filter for Contact Form 7 <= 1.6.3.9 versions. | 7.1 | 28.07.2026 |
| CVE-2026-65439 | Unauthenticated Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <=3.5.45 versions. | 7.1 | 28.07.2026 |
| CVE-2026-65440 | Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions. | 7.1 | 28.07.2026 |
| CVE-2026-59240 | The vulnerability involves an Insecure Direct Object Reference (IDOR) in the `DeleteNotificationController::delete()` method at endpoint `GET /notification/delete/{id}`. The flaw allows any authenticated user, regardless of company or permissions, to delete no | 6.9 | 28.07.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.