Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 41.242 CVE, 0 KEV kaydı · son NVD senkronu 14.11.2026 11:30. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-16634 | TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99. The tomlc99 library is no longer maintained, and has an uncontrolled recursion vulnerability publicly reported in the issue tracker. Any caller that passes untrus | 9.8 | 24.07.2026 |
| CVE-2026-56391 | GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer in | 4.6 | 24.07.2026 |
| CVE-2026-56392 | GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an under | 1.8 | 24.07.2026 |
| CVE-2026-63317 | Arbitrary Class Instantiation via XML Feature Generator Descriptor and Format Name in Apache OpenNLP Versions Affected: - before 2.5.10 - before 3.0.0-M5 Description: Three code paths in Apache OpenNLP load a class by its fully-qualified name via Class.f | 5.6 | 24.07.2026 |
| CVE-2026-15704 | In Eclipse BaSyx Go Components versions up to and including 1.0.0, ABAC-enabled deployments are vulnerable to an authorization bypass caused by inconsistent trailing-slash handling between the ABAC middleware and the HTTP router. The shared router configura | 9.8 | 24.07.2026 |
| CVE-2026-24727 | An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10.3 allows remote authenticated users with administrator privileges to execute arbitrary commands by | 9.3 | 24.07.2026 |
| CVE-2026-49743 | Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objects in the kernel, leading to read/write UAFs. During workload submission involving a fence exported by the GPU driv | 7.8 | 24.07.2026 |
| CVE-2026-49744 | Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Out of bounds accesses triggered by malware introduced to a Guest KMD could allow p | 7.8 | 24.07.2026 |
| CVE-2026-49745 | Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside the Guest's virtualised GPU memory. Software installed and run under a Guest VM can send commands to the GPU which resu | 7.8 | 24.07.2026 |
| CVE-2026-12702 | In affected versions of Octopus Deploy Insufficient checks on the project trigger actions allows an unauthorized user to trigger a deployment. | 5.1 | 24.07.2026 |
| CVE-2026-16519 | A DLL hijacking vulnerability exists in the GeoVision GV-IP Device Utility desktop application. The application loads one or more dynamic-link libraries (DLLs) from an unsafe search path, allowing a local attacker to place a malicious DLL in a location searche | 7.3 | 24.07.2026 |
| CVE-2026-66138 | In OpenStack Ironic Python Agent through 11.6.0, a project-scoped user with the manager role can achieve arbitrary code execution on a running Ironic-Python-Agent via a maliciously constructed configuration, because the value of ntp_server is passed to a shell | 7.2 | 24.07.2026 |
| CVE-2026-66139 | OpenStack Zaqar through 22.0.0 allows authentication bypass via an EXTRA-SPEC header when a UUID is known. | 4.8 | 24.07.2026 |
| CVE-2026-54422 | In OpenStack Ironic Python Agent through 11.5.0, a malicious bootc container, when deployed using ironic-python-agent, may be able to extract the credentials used to download it. | 5.5 | 24.07.2026 |
| CVE-2026-11922 | A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the `POST /api/v1/login` and self password-change endpoints by rotating the `X-Forwarded-For` header. The rate limiter keys requests by `request.clie | 6.5 | 24.07.2026 |
| CVE-2026-62825 | Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network. | 9.8 | 24.07.2026 |
| CVE-2026-58275 | Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network. | 9.8 | 24.07.2026 |
| CVE-2026-56191 | Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network. | 10.0 | 24.07.2026 |
| CVE-2026-56160 | Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network. | 9.9 | 24.07.2026 |
| CVE-2026-56165 | Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network. | 9.8 | 24.07.2026 |
| CVE-2026-56167 | Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a network. | 8.8 | 24.07.2026 |
| CVE-2026-54120 | Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network. | 8.8 | 24.07.2026 |
| CVE-2026-50517 | Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network. | 9.9 | 24.07.2026 |
| CVE-2026-49159 | Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network. | 6.5 | 24.07.2026 |
| CVE-2026-35425 | Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network. | 7.2 | 24.07.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.