CVE-2026-104080
Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API /valid_token/ route that allows unauthenticated attackers to execute arbitrary commands as…
İçeriği inceleyinALLSAFE / Güncel Güvenlik AçıklarıGelişmeleri izleyin.
Gelişmeleri izleyin.
Riskleri önceliklendirin.
NIST NVD, USOM / Siber Güvenlik Başkanlığı ve Exploit-DB kaynaklarından güvenlik bildirimleri. Etkilenen ürün ve sürümleri özgün kaynakta doğrulayın.
Kayıtlar kaynakların yayın tarihleri ve özgün içerikleriyle sunulur. Bir kaydın bulunması, kurumunuzun etkilendiğini tek başına göstermez. Sürüm ve yapılandırmayı kontrol ederek üreticinin güncel önerilerini değerlendirin.
CVE-2026-73695
Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php, where an attacker-supplied module name is concatenated directly into an include path with no…
İçeriği inceleyinCVE-2026-73696
Control Web Panel (CWP) before webpanel_version 1.12 contains an execution after redirect vulnerability in the user panel authentication flow, where CWPUserIndex's unauthenticatedFlow() calls toLoginWithIntendedUri() which emits a redirect…
İçeriği inceleyinCVE-2026-73697
Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_editor user panel module. The acc=update action writes attacker-controlled…
İçeriği inceleyinCVE-2026-120491
Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client users to inject script by sending a crafted nowpath parameter to webclient/makethumb.html. Attackers…
İçeriği inceleyinCVE-2026-120492
Chainlit 2.12.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to bypass path-scoped MCP allowed_urls entries because validate_mcp_url does not reject the semicolon character. Attackers can…
İçeriği inceleyinCVE-2026-120460
Jpom through 2.11.12 contains a cross-workspace authorization bypass vulnerability that allows authenticated users to manage other workspaces' Docker hosts by supplying foreign Docker asset ids. Attackers with Docker…
İçeriği inceleyinCVE-2026-120461
Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves command templates and SSH nodes by ID without workspace filtering. Authenticated users with SSH command…
İçeriği inceleyinCVE-2026-120487
LaraDashboard before 1.4.5 contains an incorrect authorization vulnerability in SettingPolicy::manageCoreUpgrades() that allows non-Superadmin administrators with settings.edit to access Superadmin-only core-upgrade operations. Attackers can use the /admin/settings/core-upgrades backup, download,…
İçeriği inceleyinCVE-2026-120488
LaraDashboard before 1.4.9 contains a stored cross-site scripting vulnerability that allows authenticated users with post.create or post.edit permission to inject scripts via unsanitized LaraBuilder design_json block content. Attackers…
İçeriği inceleyinCVE-2026-120489
Outline before 1.12.0 contains an incorrect authorization vulnerability in authorizeDocumentPublish() that allows authenticated members to publish documents into private collections without write access. Attackers can detach a child…
İçeriği inceleyinCVE-2026-120455
rapidyaml through 0.16.0 contains an out-of-bounds write vulnerability in ParseEngine::_add_annotation() that allows attackers to corrupt memory by supplying YAML with excess anchors or tags. Attackers can submit YAML…
İçeriği inceleyin