Güvenlik açıkları (CVE)
NVD (National Vulnerability Database) verisiyle CVE kayıtlarını arayın. Aktif olarak istismar edilen açıklar için CISA KEV kataloğunu inceleyin.
Yerel veritabanında 41.269 CVE, 0 KEV kaydı · son NVD senkronu 15.11.2026 05:30. Belirli bir CVE kimliği yerelde yoksa NVD'den anlık getirilir.
| CVE | Açıklama | CVSS | Yayın |
|---|---|---|---|
| CVE-2026-58647 | Improper neutralization of input during web page generation ('cross-site scripting') in Power BI allows an authorized attacker to perform spoofing over a network. | 5.4 | 14.07.2026 |
| CVE-2026-59197 | Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before r | 8.2 | 14.07.2026 |
| CVE-2026-59200 | Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode | 7.5 | 14.07.2026 |
| CVE-2026-58631 | Improper authorization in Windows Admin Center allows an authorized attacker to execute code locally. | 7.8 | 14.07.2026 |
| CVE-2026-58636 | Improper link resolution before file access ('link following') in Window PC Manager allows an authorized attacker to elevate privileges locally. | 7.8 | 14.07.2026 |
| CVE-2026-58279 | Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. | 6.5 | 14.07.2026 |
| CVE-2026-58595 | Improper restriction of rendered ui layers or frames in Microsoft Bing App for IOS allows an unauthorized attacker to perform spoofing over a network. | 8.1 | 14.07.2026 |
| CVE-2026-56169 | Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network. | 8.8 | 14.07.2026 |
| CVE-2026-56170 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. | 7.5 | 14.07.2026 |
| CVE-2026-56185 | Improper authentication in Windows Admin Center allows an authorized attacker to disclose information over a network. | 6.5 | 14.07.2026 |
| CVE-2026-57107 | Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges locally. | 7.8 | 14.07.2026 |
| CVE-2026-57969 | Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. | 8.8 | 14.07.2026 |
| CVE-2026-55012 | Integer overflow or wraparound in Microsoft Defender allows an unauthorized attacker to execute code locally. | 7.8 | 14.07.2026 |
| CVE-2026-55014 | Improper access control in Windows Remote Help Defense allows an authorized attacker to elevate privileges locally. | 7.8 | 14.07.2026 |
| CVE-2026-55011 | Integer underflow (wrap or wraparound) in Microsoft Defender allows an unauthorized attacker to execute code locally. | 7.8 | 14.07.2026 |
| CVE-2026-54432 | Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS). The issue occurs because the attachment MIME type is not properly escaped on the attachment-validation warning page. | 4.7 | 14.07.2026 |
| CVE-2026-54433 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message. The attacker-controlled JavaScript executes within the victim's authenticated session simply by opening or previewing | 10.0 | 14.07.2026 |
| CVE-2026-54058 | Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel ac | 8.3 | 14.07.2026 |
| CVE-2026-50520 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally. | 8.4 | 14.07.2026 |
| CVE-2026-50663 | Relative path traversal in Age of Empires II: Definitive Edition Game allows an unauthorized attacker to execute code over a network. | 8.8 | 14.07.2026 |
| CVE-2026-50338 | Improper authentication in Azure Spring Apps allows an authorized attacker to elevate privileges over a network. | 8.2 | 14.07.2026 |
| CVE-2026-50354 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | 7.1 | 14.07.2026 |
| CVE-2026-49790 | Integer underflow (wrap or wraparound) in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. | 7.8 | 14.07.2026 |
| CVE-2026-49173 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | 7.8 | 14.07.2026 |
| CVE-2026-45496 | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | 5.5 | 14.07.2026 |
Kaynak: NIST NVD CVE API 2.0. CVE açıklamaları kaynağındaki İngilizce metinle gösterilir. Bu ürün NVD API'sini kullanır ancak NVD tarafından onaylanmamış veya sertifikalandırılmamıştır.