Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 12.460 CVE, 0 KEV kaydı. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-62896 | Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network. | 9.6 | 07.08.2026 |
| CVE-2026-62918 | Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network. | 7.5 | 07.08.2026 |
| CVE-2026-63508 | Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network. | 10.0 | 07.08.2026 |
| CVE-2026-62830 | Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network. | 9.9 | 07.08.2026 |
| CVE-2026-62836 | Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network. | 10.0 | 07.08.2026 |
| CVE-2026-59115 | '.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network. | 9.9 | 07.08.2026 |
| CVE-2026-59118 | Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network. | 9.3 | 07.08.2026 |
| CVE-2026-50515 | Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network. | 9.9 | 07.08.2026 |
| CVE-2026-56161 | Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network. | 9.6 | 07.08.2026 |
| CVE-2026-56162 | Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network. | 10.0 | 07.08.2026 |
| CVE-2026-17264 | Opening a crafted DICOM file containing malicious JPEG-compressed pixel data triggers an attacker-controlled heap out-of-bounds write, which may allow an attacker to remotely execute arbitrary code. | 5.3 | 07.08.2026 |
| CVE-2026-49163 | Improper limitation of a pathname to a restricted directory ('path traversal') in Application Insights Profiler allows an authorized attacker to elevate privileges over a network. | 8.8 | 07.08.2026 |
| CVE-2026-50481 | Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network. | 9.9 | 07.08.2026 |
| CVE-2026-8325 | A maliciously crafted PDF file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnerability to cause a crash, cause data corruption, or execute arbitrary code in the context of the curre | 7.8 | 07.08.2026 |
| CVE-2026-7405 | A maliciously crafted TIF file, when parsed through certain Autodesk products during image import, can cause an Out-of-Bounds Read in the image handling library. A malicious actor can leverage this vulnerability to cause a denial of service | 5.5 | 07.08.2026 |
| CVE-2026-7406 | A maliciously crafted BMP file, when parsed through certain Autodesk products, can force a Untrusted Pointer Dereference vulnerability. A malicious actor can leverage this vulnerability to execute arbitrary code in the context of the current process. | 7.8 | 07.08.2026 |
| CVE-2026-71497 | jsoup is a Java library for working with real-world HTML. From 1.14.3 until 1.23.1, jsoup's HTML parser could incorrectly handle a malformed tag name ending in a control character, causing the tag to acquire the parsing behavior of a different element. When a | 4.7 | 07.08.2026 |
| CVE-2026-71498 | node-re2 provides RE2 regular expression bindings for Node.js. Prior to version 1.26.1, passing a Buffer whose final bytes form a truncated (incomplete) multi-byte UTF-8 sequence could cause the native binding to read past the end of the allocated buffer while | 5.1 | 07.08.2026 |
| CVE-2026-71554 | h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/ | 5.3 | 07.08.2026 |
| CVE-2026-71555 | PILOS (Platform for Interactive Live-Online Seminars) is a frontend for BigBlueButton. From 2.1.0 until 4.14.1, PILOS does not send a Cross-Origin-Opener-Policy response header, so pages opened by PILOS via a link that opens a new browsing context (e.g., targe | 4.1 | 07.08.2026 |
| CVE-2026-71439 | Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. From version 11.6.0 until 11.16.1, Mermaid Radar Diagrams allow arbitrary large values for the ticks parameter, which can cause high CPU usage and freeze th | 5.3 | 07.08.2026 |
| CVE-2026-71445 | AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/add_tags endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using str(res[0]). If attacker | 8.2 | 07.08.2026 |
| CVE-2026-71446 | AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the JavaScript onclick handler used to display a stored screenshot, without context-appropriate encoding. An attacker who c | 6.9 | 07.08.2026 |
| CVE-2026-71447 | AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts. The affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers: onclick=" | 6.9 | 07.08.2026 |
| CVE-2026-71476 | Nx is a monorepo solution for TypeScript and polyglot codebases. From version 20.8.0 until 22.7.7 and 23.0.2, the Nx self-hosted HTTP remote cache extracts downloaded cache artifacts without constraining where files are written. A malicious or on-path (MITM) r | 8.7 | 07.08.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.