Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 41.269 CVE, 0 KEV kaydı · son NVD senkronu 14.11.2026 17:30. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-27403 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NerdPress Hubbub Lite allows Stored XSS. This issue affects Hubbub Lite: from n/a through 1.36.3. | 6.5 | 23.07.2026 |
| CVE-2026-27418 | Unauthenticated Broken Access Control in WP Fast Total Search <= 1.81.282 versions. | 5.3 | 23.07.2026 |
| CVE-2026-27422 | Missing Authorization vulnerability in bPlugins YT Player yt-player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YT Player: from n/a through 2.1.2. | 5.3 | 23.07.2026 |
| CVE-2026-27423 | Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions. | 4.3 | 23.07.2026 |
| CVE-2026-27355 | Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions. | 5.3 | 23.07.2026 |
| CVE-2026-27372 | Unauthenticated Sensitive Data Exposure in PeproDev Ultimate Invoice <= 2.2.6 versions. | 6.5 | 23.07.2026 |
| CVE-2026-27064 | Editor Arbitrary File Upload in Mailster <= 4.1.17 versions. | 9.1 | 23.07.2026 |
| CVE-2026-25427 | Subscriber Broken Access Control in eRoom <= 1.7.1 versions. | 5.4 | 23.07.2026 |
| CVE-2026-25466 | Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions. | 5.3 | 23.07.2026 |
| CVE-2026-25405 | Contributor SQL Injection in eRoom <= 1.7.1 versions. | 8.5 | 23.07.2026 |
| CVE-2026-25424 | Contributor Broken Access Control in Mediavine Control Panel <= 2.10.10 versions. | 4.3 | 23.07.2026 |
| CVE-2026-24537 | Unauthenticated Cross Site Request Forgery (CSRF) in WP Accessibility Helper (WAH) <= 0.6.6 versions. | 4.3 | 23.07.2026 |
| CVE-2026-24552 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in John-Michael L'Allier Create mediavine-create allows Blind SQL Injection.This issue affects Create: from n/a through 2.5.3. | 8.5 | 23.07.2026 |
| CVE-2026-24628 | Administrator Cross Site Scripting (XSS) in Photo Gallery by Supsystic <= 1.16.3 versions. | 5.9 | 23.07.2026 |
| CVE-2026-24639 | Author Server Side Request Forgery (SSRF) in Photo Block <= 1.7.1 versions. | 4.4 | 23.07.2026 |
| CVE-2026-16745 | A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network binding, a malicious actor within the cluster can bypass authentication and impersonate any user by providing an arbitrary access token. This | 8.8 | 23.07.2026 |
| CVE-2026-64611 | A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing a printer-advertised IEEE-1284 device ID with an empty model field, causing sustained CPU consumption. A network-adjacent attacker could exp | 7.5 | 23.07.2026 |
| CVE-2026-65754 | Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer XML include paths could read files outside the site directory. | 7.5 | 23.07.2026 |
| CVE-2026-65755 | Joomla Extension - regularlabs.com - Date-sensitive query-cache leakage in Articles Anywhere and Users Anywhere extension - Date-sensitive query cache keys did not retain a bounded time component. Cached results could remain active across future publication or | 7.5 | 23.07.2026 |
| CVE-2026-65756 | Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript. | 6.1 | 23.07.2026 |
| CVE-2026-65757 | Joomla Extension - regularlabs.com - Inconsistent CSRF token checks / privilege checks in Modules Anywhere extension - The editor popup could expose restricted module data to authenticated users without the required module permissions or valid request tokens. | 8.1 | 23.07.2026 |
| CVE-2026-65758 | Joomla Extension - tassos.gr - Sensitive data exposure in Convert Forms extension 2.5.0-5.2.2 - The front-end Submissions view did not enforce access control. An unauthenticated visitor could therefore list a form's submissions. | 8.2 | 23.07.2026 |
| CVE-2026-64872 | Joomla Extension - regularlabs.com - Path traversal in Cache Cleaner Pro extension - Custom purge and log paths could escape the site webroot directory. | 6.5 | 23.07.2026 |
| CVE-2026-64873 | Joomla Extension - regularlabs.com - SSRF in Cache Cleaner Pro extension - Custom query URLs could access internal or reserved network services. | 9.8 | 23.07.2026 |
| CVE-2026-64874 | Joomla Extension - regularlabs.com - CDN Credential leakage Cache Cleaner Pro extension - CDN credentials were exposed in administrator request URLs. | 9.8 | 23.07.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.