Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 41.269 CVE, 0 KEV kaydı · son NVD senkronu 14.11.2026 17:30. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-65907 | In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible | 9.1 | 23.07.2026 |
| CVE-2026-65908 | In JetBrains PyCharm before 2026.1.4, 2026.2 arbitrary code execution via malicious Python executable was possible on untrusted project open | 8.6 | 23.07.2026 |
| CVE-2026-65896 | Grav API Plugin (Composer package getgrav/grav-plugin-api) before 1.0.10 fails to properly validate the slug field in the POST /pages/{route}/move endpoint. PagesController::move() sanitizes the slug only with ltrim($body['slug'], '.'), which strips leading pe | 7.1 | 23.07.2026 |
| CVE-2026-65897 | Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation r | 8.7 | 23.07.2026 |
| CVE-2026-65540 | Unauthenticated Cross Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert <= 1.6.5 versions. | 7.1 | 23.07.2026 |
| CVE-2026-65550 | Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions. | 5.9 | 23.07.2026 |
| CVE-2026-65605 | SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag r | 9.4 | 23.07.2026 |
| CVE-2026-65607 | SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir | 7.1 | 23.07.2026 |
| CVE-2026-65608 | Grav versions >= 1.7.0 and before 2.0.9 contain a remote code execution vulnerability. FlexDirectory::dynamicDataField() resolves blueprint data-*@: directives by calling call_user_func_array() on attacker-influenced input, validating only that the target is c | 8.7 | 23.07.2026 |
| CVE-2026-65895 | Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting s | 8.2 | 23.07.2026 |
| CVE-2026-65531 | Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions. | 4.8 | 23.07.2026 |
| CVE-2026-65532 | Shop manager SQL Injection in Persian Woocommerce SMS <= 7.2.2 versions. | 7.6 | 23.07.2026 |
| CVE-2026-65533 | Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions. | 6.5 | 23.07.2026 |
| CVE-2026-65534 | Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions. | 5.9 | 23.07.2026 |
| CVE-2026-65535 | Contributor Sensitive Data Exposure in TinyMCE Templates <= 4.8.1 versions. | 4.3 | 23.07.2026 |
| CVE-2026-65536 | Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions. | 6.5 | 23.07.2026 |
| CVE-2026-65537 | Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <= 1.3.3 versions. | 4.3 | 23.07.2026 |
| CVE-2026-65538 | Author Cross Site Scripting (XSS) in Machete <= 5.2 versions. | 5.9 | 23.07.2026 |
| CVE-2026-65539 | Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions. | 7.1 | 23.07.2026 |
| CVE-2026-65522 | Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions. | 6.5 | 23.07.2026 |
| CVE-2026-65524 | Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions. | 4.3 | 23.07.2026 |
| CVE-2026-65525 | Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions. | 5.3 | 23.07.2026 |
| CVE-2026-65526 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle Visualizer allows Blind SQL Injection. This issue affects Visualizer: from n/a through 4.0.1. | 8.5 | 23.07.2026 |
| CVE-2026-65527 | Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions. | 6.5 | 23.07.2026 |
| CVE-2026-65528 | Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions. | 6.5 | 23.07.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.