https://vulnogram.org/ Most recent CVEs assigned by TR-CERT (Computer Emergency Response Team of the Republic of Türkiye) (tr-cert). https://vulnogram.org/seaview/icons/tr-cert.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-18205 https://vulnogram.org/CVE-2026-18205 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ticimax Informatics Technologies Inc. Ticimax E-Commerce Platform allows Reflected XSS. This issue affects Ticimax E-Commerce Platform: through 2026… Medium Network Exploitable Tue, 20 Oct 2026 11:24:49 GMT https://vulnogram.org/CVE-2026-15575 https://vulnogram.org/CVE-2026-15575 Active debug code vulnerability in SFM Software Technologies Inc. Costifier allows Exploit Non-Production Interfaces. This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in… Medium Network Exploitable Fri, 16 Oct 2026 08:45:41 GMT https://vulnogram.org/CVE-2026-15219 https://vulnogram.org/CVE-2026-15219 Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploitation of Trusted Identifiers. This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this d… Medium Fri, 16 Oct 2026 08:42:32 GMT https://vulnogram.org/CVE-2026-14177 https://vulnogram.org/CVE-2026-14177 Observable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure allows Account Footprinting. This issue affects ikas E-Commerce Infrastructure: through 2026-07-13. High Network Exploitable Fri, 16 Oct 2026 08:13:48 GMT https://vulnogram.org/CVE-2026-16740 https://vulnogram.org/CVE-2026-16740 Missing authentication for critical function vulnerability in TR7 Cyber ​​Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber ​​Defense Inc. TR7 ASP on physical appliance allows OS Command Injection. This issue affects TR7 ASP: from 1.0.40.236 be… Critical Network Exploitable Wed, 14 Oct 2026 12:47:35 GMT https://vulnogram.org/CVE-2026-16741 https://vulnogram.org/CVE-2026-16741 Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TR7 Cyber ​​Defense Inc. TR7 ASP on virtual appliance and TR7 Cyber ​​Defense Inc. TR7 ASP on physical appliance allows OS Command Injection.… Critical Network Exploitable Wed, 14 Oct 2026 12:42:25 GMT https://vulnogram.org/CVE-2026-89279 https://vulnogram.org/CVE-2026-89279 Cross-Site request forgery (CSRF) vulnerability in AuthTake Technology Inc. Authtake allows Encryption Brute Forcing. This issue affects authtake: from v1.3 before v1.4. Medium Network Exploitable Tue, 13 Oct 2026 11:23:40 GMT https://vulnogram.org/CVE-2026-13138 https://vulnogram.org/CVE-2026-13138 Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform allows Manipulating State. This issue affects Biletiva Ticketing Platform: through 2026-07-23. High Network Exploitable Tue, 13 Oct 2026 08:37:46 GMT https://vulnogram.org/CVE-2026-12613 https://vulnogram.org/CVE-2026-12613 Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Technology UYAP Document Editor… High Network Exploitable Mon, 12 Oct 2026 14:01:38 GMT https://vulnogram.org/CVE-2026-18390 https://vulnogram.org/CVE-2026-18390 Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Di… High Mon, 12 Oct 2026 13:57:33 GMT https://vulnogram.org/CVE-2026-90983 https://vulnogram.org/CVE-2026-90983 Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. (Hayat Hospital) Hayat Mobile allows Authentication Bypass. This issue affects Hayat Mobile: from 3.3.0 before 3.4.0. High Network Exploitable Fri, 09 Oct 2026 15:22:11 GMT https://vulnogram.org/CVE-2026-92085 https://vulnogram.org/CVE-2026-92085 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TMT Machinery Industry and Trade Co. Ltd. Talassoft Industrial Management Software allows Stored XSS. This issue affects Talassoft Industrial Manage… Medium Fri, 09 Oct 2026 13:26:29 GMT https://vulnogram.org/CVE-2026-86405 https://vulnogram.org/CVE-2026-86405 Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects PrestaShop Virtual POS Module: from… Critical Network Exploitable Fri, 09 Oct 2026 12:52:43 GMT https://vulnogram.org/CVE-2026-85531 https://vulnogram.org/CVE-2026-85531 Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects OpenCart Virtual POS Module: from 26.8… Critical Network Exploitable Fri, 09 Oct 2026 12:28:54 GMT https://vulnogram.org/CVE-2026-12859 https://vulnogram.org/CVE-2026-12859 Missing Authorization vulnerability in Caz Informatics Services Trade Inc. Advancity ALMS Cloud allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Advancity ALMS Cloud: through 2026-10-08. NOTE: The vendor was contact… Medium Thu, 08 Oct 2026 14:33:42 GMT https://vulnogram.org/CVE-2026-89290 https://vulnogram.org/CVE-2026-89290 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Stored XSS. This issue affects eimzamip: from v1.6.4 before v1.6.7. Low Thu, 08 Oct 2026 13:45:43 GMT https://vulnogram.org/CVE-2026-91844 https://vulnogram.org/CVE-2026-91844 Unrestricted upload of file with dangerous type vulnerability in İzometri IT Services Domestic and Foreign Trade Co. Ltd. Eimzamip allows Using Malicious Files. This issue affects eimzamip: from v1.6.4 before v1.6.6. High Thu, 08 Oct 2026 13:42:27 GMT https://vulnogram.org/CVE-2026-19218 https://vulnogram.org/CVE-2026-19218 Weak Password Recovery Mechanism for Forgotten Password vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. MyRezzta allows Password Recovery Exploitation. This issue affects MyRezzta: from 2.06.03 before 2.07.01. Critical Network Exploitable Thu, 08 Oct 2026 12:03:29 GMT https://vulnogram.org/CVE-2026-92555 https://vulnogram.org/CVE-2026-92555 Insertion of sensitive information into sent data vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. AKINSOFT WOLVOX Control Panel allows Pull Data from System Resources. This issue affects AKINSOFT WOLVOX Control Panel… Critical Network Exploitable Thu, 08 Oct 2026 11:49:47 GMT https://vulnogram.org/CVE-2026-19083 https://vulnogram.org/CVE-2026-19083 Authorization bypass through User-Controlled key vulnerability in AKIN Software Computer Import-Export Industry and Trade Co. Ltd. OctoCloud allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects OctoCloud: from 1.12.06 b… High Thu, 08 Oct 2026 11:32:49 GMT https://vulnogram.org/CVE-2026-85523 https://vulnogram.org/CVE-2026-85523 Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Felisify Information Technologies Industry and Trade Inc. SambaBox allows OS Command Injection. This issue affects SambaBox: before 5.4.1. High Tue, 06 Oct 2026 13:55:32 GMT https://vulnogram.org/CVE-2026-82924 https://vulnogram.org/CVE-2026-82924 Improper Control of Interaction Frequency vulnerability in Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. Expert Mail allows Brute Force. This issue affects Expert Mail: through 2026-09-18. Medium Network Exploitable Tue, 06 Oct 2026 13:33:39 GMT https://vulnogram.org/CVE-2026-12380 https://vulnogram.org/CVE-2026-12380 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akıllı Ticaret Software Technologies Ltd. Co. E-Commerce Pack allows Reflected XSS. This issue affects E-Commerce Pack: through 2026-10-06. NOTE: Th… Medium Network Exploitable Tue, 06 Oct 2026 13:05:16 GMT https://vulnogram.org/CVE-2026-5782 https://vulnogram.org/CVE-2026-5782 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in MRV Technology Foreign Trade Ltd. Co. TurkHotspot allows Reflected XSS. This issue affects TurkHotspot: through 2026-10-02. NOTE: The vendor was con… Medium Unsupported When Assigned Fri, 02 Oct 2026 14:13:02 GMT https://vulnogram.org/CVE-2026-85215 https://vulnogram.org/CVE-2026-85215 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in GG Soft Software Services Inc. Paperwork allows SQL Injection. This issue affects Paperwork: through 2026-09-09. High Fri, 02 Oct 2026 13:01:52 GMT https://vulnogram.org/CVE-2026-11795 https://vulnogram.org/CVE-2026-11795 Observable discrepancy vulnerability in Softtr Informatics Trading Limited Company E-Commerce Pack allows Account Footprinting. This issue affects E-Commerce Pack: before 5.03.01.54. Medium Network Exploitable Fri, 02 Oct 2026 12:42:19 GMT https://vulnogram.org/CVE-2026-85209 https://vulnogram.org/CVE-2026-85209 Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System (LMS) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Learning Management… Medium Fri, 02 Oct 2026 11:58:15 GMT https://vulnogram.org/CVE-2026-80298 https://vulnogram.org/CVE-2026-80298 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows SQL Injection. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contact… High Unsupported When Assigned Fri, 02 Oct 2026 09:07:52 GMT https://vulnogram.org/CVE-2026-80443 https://vulnogram.org/CVE-2026-80443 Improper certificate validation vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Adversary in the Middle (AiTM). This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the produ… High Network Exploitable Unsupported When Assigned Fri, 02 Oct 2026 09:04:40 GMT https://vulnogram.org/CVE-2026-80337 https://vulnogram.org/CVE-2026-80337 Missing Authorization vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learne… Medium Unsupported When Assigned Fri, 02 Oct 2026 09:01:25 GMT https://vulnogram.org/CVE-2026-80464 https://vulnogram.org/CVE-2026-80464 Server-Side request forgery (SSRF) vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Server Side Request Forgery. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and it was learned that the produ… Medium Unsupported When Assigned Fri, 02 Oct 2026 08:58:08 GMT https://vulnogram.org/CVE-2026-18782 https://vulnogram.org/CVE-2026-18782 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection. This issue affects Trex MES: through 202… Critical Network Exploitable Wed, 30 Sep 2026 14:15:15 GMT https://vulnogram.org/CVE-2026-18783 https://vulnogram.org/CVE-2026-18783 Missing authentication for critical function vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Authentication Bypass. This issue affects Trex MES: through 2026-09-29. High Wed, 30 Sep 2026 14:12:02 GMT https://vulnogram.org/CVE-2026-82307 https://vulnogram.org/CVE-2026-82307 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection. This issue affects SOPLOG: before Soplog 2026.9.4.1. Critical Network Exploitable Wed, 30 Sep 2026 13:20:43 GMT https://vulnogram.org/CVE-2026-86778 https://vulnogram.org/CVE-2026-86778 Observable response discrepancy vulnerability in Maksisoft Technology, IT, and Software Industry and Trade Inc. Maksisoft Gym allows Account Footprinting. This issue affects Maksisoft Gym: from 0.5.10 before 0.5.11. Medium Network Exploitable Wed, 30 Sep 2026 12:59:32 GMT https://vulnogram.org/CVE-2026-86450 https://vulnogram.org/CVE-2026-86450 Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects DetaWix Mobile Web Portal:… High Network Exploitable Tue, 29 Sep 2026 13:46:39 GMT https://vulnogram.org/CVE-2026-87748 https://vulnogram.org/CVE-2026-87748 Missing Authorization vulnerability in Interprobe Information Technologies Inc. Qorela DC allows Privilege Abuse. This issue affects Qorela DC: from 1.6.1-RC29 before v1.6.2. High Tue, 29 Sep 2026 11:51:55 GMT https://vulnogram.org/CVE-2026-90924 https://vulnogram.org/CVE-2026-90924 Use of default credentials vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Try Common or Default Usernames and Passwords. This issue affects Logsign SIEM: from 6.4.101 before 6.4.117. Critical Network Exploitable Mon, 28 Sep 2026 13:53:46 GMT https://vulnogram.org/CVE-2026-90925 https://vulnogram.org/CVE-2026-90925 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Path Traversal. This issue affects Logsign SIEM: from 6.4.101 befo… High Mon, 28 Sep 2026 13:50:31 GMT https://vulnogram.org/CVE-2026-90926 https://vulnogram.org/CVE-2026-90926 Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Code Injection. This issue affects Logsign SIEM: from 6.4.101 before 6.4.117. High Mon, 28 Sep 2026 13:47:09 GMT https://vulnogram.org/CVE-2026-86595 https://vulnogram.org/CVE-2026-86595 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Iron Mountain Archiving Services Inc. EnVision allows SQL Injection. This issue affects enVision: before 260655. High Mon, 28 Sep 2026 13:12:46 GMT https://vulnogram.org/CVE-2026-82323 https://vulnogram.org/CVE-2026-82323 Authorization bypass through User-Controlled key vulnerability in Enocta Educational Technologies Inc. Enocta Platform allows Exploitation of Trusted Identifiers. This issue affects Enocta Platform: through 2026-09-28. High Mon, 28 Sep 2026 12:36:20 GMT https://vulnogram.org/CVE-2026-82326 https://vulnogram.org/CVE-2026-82326 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Enocta Educational Technologies Inc. Enocta Platform allows XSS Targeting HTML Attributes. This issue affects Enocta Platform: through 2026-09-28. Medium Mon, 28 Sep 2026 12:33:57 GMT https://vulnogram.org/CVE-2026-87752 https://vulnogram.org/CVE-2026-87752 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows XSS Targeting HTML Attributes. This issue affects Agentis: from… Medium Network Exploitable Mon, 28 Sep 2026 11:34:37 GMT https://vulnogram.org/CVE-2026-82915 https://vulnogram.org/CVE-2026-82915 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Path Traversal. This issue affects eBA Plus Document and Workf… Medium Mon, 28 Sep 2026 08:32:19 GMT https://vulnogram.org/CVE-2026-85134 https://vulnogram.org/CVE-2026-85134 Unrestricted upload of file with dangerous type vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Upload a Web Shell to a Web Server. This issue affects eBA Plus Document and Workflow Managem… High Mon, 28 Sep 2026 08:28:44 GMT https://vulnogram.org/CVE-2026-82969 https://vulnogram.org/CVE-2026-82969 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Management System allows Stored XSS. This issue affects eBA Plus Document and Wor… Medium Mon, 28 Sep 2026 08:24:35 GMT https://vulnogram.org/CVE-2026-77707 https://vulnogram.org/CVE-2026-77707 Improper certificate validation vulnerability in HAVELSAN Inc. Liman Render Engine allows Adversary in the Middle (AiTM). This issue affects Liman Render Engine: from 1.0 before 1.2-75. Medium Network Exploitable Thu, 24 Sep 2026 14:41:57 GMT https://vulnogram.org/CVE-2026-77703 https://vulnogram.org/CVE-2026-77703 Key exchange without entity authentication vulnerability in HAVELSAN Inc. Liman Render Engine allows Adversary in the Middle (AiTM). This issue affects Liman Render Engine: from 1.0 before 1.2-75. Medium Network Exploitable Thu, 24 Sep 2026 14:38:52 GMT https://vulnogram.org/CVE-2026-88916 https://vulnogram.org/CVE-2026-88916 Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Privilege Escalation. This issue affects UlakPDF: through 09092026. Medium Thu, 24 Sep 2026 12:49:44 GMT