CVE Veritabanı
Teknik veriler otomatik gelir, önemli açıklıklar Türkçeye çevrilir. Editörlerimizin incelediği kayıtlar İncelendi etiketiyle işaretlenir.
NVD, CISA KEV ve EPSS kaynaklarından otomatik senkronize edilir
1.000+ sonuç · sayfa 18
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress eklentisi, 5.7.4 sürümüne kadar olan tüm sürümlerde, Kimlik Doğrulama Atlatma yoluyla Yarış Durumu zafiyeti nedeniyle…
17 Eki 2026
Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider.
17 Eki 2026
ZoneMinder, ücretsiz ve açık kaynaklı bir kapalı devre televizyon yazılım uygulamasıdır. 1.38.3 sürümünden önce, downloadEvents() işlevi, bir kullanıcı tarafından shell metakarakterleri içeren bir…
16 Eki 2026
Netcore NR256CN 1.5.140116 sürümüne kadar, Boa web sunucusunun user_ok() fonksiyonunda, önceden kimlik doğrulama yapılmayan bir yığın taşması zafiyeti içerir. Bu, Basic-auth kullanıcı adlarını…
16 Eki 2026
LangChat, 2a6285a taahhüdüne kadar, kayıtlı bir Sa-Token ara yüzü olmaması nedeniyle uzak saldırganların REST denetleyicilerine erişmesine olanak tanıyan bir kimlik doğrulama eksikliği içerir.…
16 Eki 2026
WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers…
16 Eki 2026
Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in…
16 Eki 2026
DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in…
16 Eki 2026
DataBuff ai-apm-web 0.1.10 sürümüne kadar hard-coded mặc định kimlik bilgileri zafiyeti içerir ve bu da kimlik doğrulamayı atlayan saldırganların yerleşik admin/Databuff@123 hesabını kullanarak…
16 Eki 2026
WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint.…
16 Eki 2026
IceCMS 4.1.5 sürümüne kadar, Shiro jwt filtresinden /User/** dışlanması nedeniyle kimlik doğrulaması eksikliği içerir. Bu, kimlik doğrulaması yapılmamış saldırganların herhangi bir hesabı…
16 Eki 2026
Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST…
16 Eki 2026
FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers…
16 Eki 2026
Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are…
16 Eki 2026
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the…
16 Eki 2026
MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when…
16 Eki 2026
MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in…
16 Eki 2026
Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers/<id>/exec does not enforce authentication on the WebSocket upgrade request.…
16 Eki 2026 · EPSS %0.3
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in…
16 Eki 2026
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid…
16 Eki 2026
RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values…
16 Eki 2026
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use…
16 Eki 2026
The storage status-change REST service allows location records still associated with DICOM instances to be changed to deletion-related states. Changing a location to TO_DELETE causes…
16 Eki 2026
An untrusted search path in DeepSeek Harness (dsh) commit c291e796 allows attackers to execute arbitrary code via supplying and opening crafted executable files in place of legitimate content.
16 Eki 2026
In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical…
16 Eki 2026
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection
16 Eki 2026
An attacker can use a hard-coded credential to log in to EseeCloud devices.
16 Eki 2026
Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.
16 Eki 2026
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Injection.This issue affects Green…
16 Eki 2026
The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via…
16 Eki 2026