CVE Program partner

TuranSec

Turan Security

API
CVEs, 365 days203210 all time, 7 rejected
Quality99%median 99%
CVSS by the CNA100%share of records
CWE100%share of records
Affected versions99%not n/a or unspecified
CVSS added by CISA0%lower is better
OrganisationTuran Security
RoleCNA
TypeResearcher
Reports tomitre
ScopeVulnerabilities discovered through independent research conducted by TuranSec to products and projects that are not CNAs themselves.
Advisorieshttps://cve.turansec.uz/

Latest CVEs · RSS

  • CVE-2026-105107 2026-10-14 · CVSS 7.6
    Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.pl script (sub calculate) concatenates the user-controlled C
  • CVE-2026-105106 2026-10-14 · CVSS 8.8
    Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-de
  • CVE-2026-105110 2026-10-08 · CVSS 9.8
    OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary commands a
  • CVE-2026-105105 2026-10-03 · CVSS 9.8
    CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 allo
  • CVE-2026-72610 2026-08-11 · CVSS 4.3
    A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the borrowers => edit_borrowers
  • CVE-2026-72609 2026-08-11 · CVSS 7.1
    An SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the acquisition => order_receive permi
  • CVE-2026-72608 2026-08-11 · CVSS 6.5
    A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => label_creator permi
  • CVE-2026-72607 2026-08-11 · CVSS 7.1
    A stored SQL injection vulnerability in Koha through 24.11.17, 25.05.12, 25.11.06, and 26.05.01 allows authenticated staff with the tools => items_batchmod perm
  • CVE-2026-72606 2026-08-11 · CVSS 7.5
    A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary
  • CVE-2026-72605 2026-08-11 · CVSS 7.5
    A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile
  • CVE-2026-72604 2026-08-11 · CVSS 6.5
    A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admi
  • CVE-2026-72603 2026-08-11 · CVSS 9.9
    An OS command injection vulnerability in wg-easy 15.3.0 allows users with the clients.create permission to execute arbitrary commands as root by injecting newli
  • CVE-2026-72602 2026-08-11 · CVSS 7.5
    A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arbi
  • CVE-2026-72601 2026-08-11 · CVSS 7.5
    A broken access control vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including personally identifiable in
  • CVE-2026-72600 2026-08-11 · CVSS 7.5
    A broken access control vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated remote attackers to download invoice PDF files containing customer P
  • CVE-2026-72599 2026-08-11 · CVSS 9.8
    An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter
  • CVE-2026-72598 2026-08-11 · CVSS 6.5
    A server-side request forgery vulnerability in Apioo Fusio 8.8.3 allows authenticated consumer-role users to make the server issue HTTP requests to internal net
  • CVE-2026-72597 2026-08-11 · CVSS 6.5
    A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe
  • CVE-2026-72596 2026-08-11 · CVSS 8.1
    A broken access control vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by other users. The post model
  • CVE-2026-72595 2026-08-11 · CVSS 8.1
    A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to update ticket records belonging to other teams via
  • CVE-2026-72563 2026-08-11 · CVSS 8.1
    A broken access control vulnerability in BadChoice Handesk as of 2026-07-10 allows any authenticated agent to overwrite lead records belonging to other teams vi
  • CVE-2026-72562 2026-08-11 · CVSS 8.8
    An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through version 2.3 allows authenticated backend users to execute arbitrary SQL via the DataOb
  • CVE-2026-72561 2026-08-11 · CVSS 8.8
    A broken access control vulnerability in Peppermint Lab Peppermint through commit ba6e217 allows any authenticated non-administrative user to reconfigure the pl
  • CVE-2026-72560 2026-08-11 · CVSS 6.5
    A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRF_PROTECTION_ENABLED is set to false by default. T
  • CVE-2026-72559 2026-08-11 · CVSS 5.4
    A stored cross-site scripting vulnerability in HortusFox 5.9 allows authenticated workspace members to inject persistent JavaScript into plant notes via Parsedo

All CVE Program partners