CVE Veritabanı

A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the argument Type leads to os…

13 Eki 2026 · EPSS %2.3

A flaw has been found in D-Link DCS-930L B1.08B4. This impacts the function mpfd_decode of the file bootloader_region.bin of the component Emergency HTTP Recovery Server. Executing a manipulation of…

13 Eki 2026 · EPSS %0.2

GitLab, 19.2'den önce 19.2.8, 19.3'den önce 19.3.5 ve 19.4'den önce 19.4.2 sürümlerini etkileyen bir soruna çözüm bulmuştur. Belirli koşullar altında, bu sorun, bir CI/CD yapılandırmasındaki özel…

gitlab / gitlab · 13 Eki 2026 · EPSS %27.3

The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutating and read route in this servlet calls…

13 Eki 2026 · EPSS %0.4

SAP S/4HANA (Değiştirme/Doğrulama Kurallarını Yönetme), bir alan özgü betik dili kullanan kural tanımı işlevselliği tarafından işlenen girişi yeterli ölçüde doğrulamıyor. Belirli iş ayrıcalıklarına…

13 Eki 2026 · EPSS %0.4

SAP Manufacturing Integration and Intelligence, belirli yönetim işlevleri içinde yetki sınırlarını yeterli derecede zorlamıyor. MII yöneticisi ayrıcalıklarına sahip bir saldırgan, altta yatan Java…

13 Eki 2026 · EPSS %0.3

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured…

13 Eki 2026 · EPSS %0.3

SAP Cloud SDK için Python, çoklu kiracılı BTP uygulamalarını etkileyen bir OAuth2 SSRF güvenlik açığı içerir. tenant_subdomain parametresini kontrol eden bir saldırgan, OAuth2 token isteklerini…

13 Eki 2026 · EPSS %0.4

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute arbitrary code on the system due to improper data sanitization by the HTTP Server…

ibm / i · 13 Eki 2026 · EPSS %0.5

IBM DataStage on Cloud Pak for Data 5.4.0.0, uzaktan kimlik doğrulama yapılmış bir saldırgana, yetkisiz bir aktöre karşı hassas bilgilerin açığa çıkması nedeniyle hassas bilgileri elde etme olanağı…

ibm / datastage_on_cloud_pak_for_data · 12 Eki 2026 · EPSS %0.3

IBM DataStage on Cloud Pak for Data 5.4.0.0, bir yol gezinmesi sırasında yol adı doğrulamasının düzgün yapılmaması nedeniyle, uzaktan kimliği doğrulanmış bir saldırganın keyfi kod çalıştırmasına izin…

ibm / datastage_on_cloud_pak_for_data · 12 Eki 2026 · EPSS %0.5

IBM DataStage, Cloud Pak for Data 5.4.0.0 sürümünde, bir yol gezinti zafiyeti nedeniyle uzaktan kimlik doğrulama yapılmış bir saldırgan hizmet reddi meydana getirebilir.

ibm / datastage_on_cloud_pak_for_data · 12 Eki 2026 · EPSS %0.4

IBM Maximo AI Service 9.1.0, and 9.2.0 could allow a remote attacker to execute arbitrary code due to improper control of code generation.

12 Eki 2026 · EPSS %0.5

OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue.

12 Eki 2026 · EPSS %0.1

REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0, which fixes the issue.

12 Eki 2026 · EPSS %0.3

OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrade to version 1.22.0 which fixes the issue.

12 Eki 2026 · EPSS %0.1

Rapyd Admin 9.0.0'dan önce 9.20.0'a kadar hard-kodlanmış kimlik bilgilerine ilişkin bir zafiyet içerir ve bu, uzaktan kimliği doğrulanmamış saldırganların AuthSeeder tarafından oluşturulan…

12 Eki 2026

A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the component DDNS. Executing a manipulation of the argument Hostname…

12 Eki 2026 · EPSS %0.4

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in tools/uvr5/vr.py that allows unauthenticated attackers to execute commands via output folder paths. Attackers can…

12 Eki 2026 · EPSS %2.9

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 is vulnerable to privilege escalation. An authenticated attacker could craft a malicious request that bypasses additional authorization and input validation…

12 Eki 2026 · EPSS %0.5

In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global authentication logic that improperly drops security controls…

12 Eki 2026 · EPSS %0.4

A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation…

12 Eki 2026

PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and `POST /{path}/{agent_id}' without…

12 Eki 2026

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound…

12 Eki 2026 · EPSS %0.3

A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formAutoFWupgrade. Executing a manipulation of the argument tftpsIP can lead to…

12 Eki 2026 · EPSS %2.0

A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The manipulation of the argument readE2P leads to command injection. It is…

12 Eki 2026 · EPSS %2.0

A vulnerability has been found in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formWlanMP. Such manipulation of the argument ateBW leads to buffer overflow. The attack can…

12 Eki 2026 · EPSS %0.4

Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5 hash of the provider…

12 Eki 2026

A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulation causes improper authentication. The attack can be…

12 Eki 2026 · EPSS %1.2