Search
Find a vulnerability
Search criteria
19 vulnerabilities by TÜBİTAK BİLGEM Software Technologies Research Institute
CVE-2026-16478 (GCVE-0-2026-16478)
Vulnerability from cvelistv5 – Published: 2026-11-10 12:53 – Updated: 2026-11-10 12:53
VLAI
EPSS
VEX
Title
Arbitrary Package Installation in TÜBİTAK BİLGEM's pardus-nvidia-installer
Summary
Permissive list of allowed inputs vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-nvidia-installer allows Privilege Escalation.
This issue affects pardus-nvidia-installer: before 2.0.1.
Severity
CWE
- CWE-183 - Permissive list of allowed inputs
Assigner
TR-CERT
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://siberguvenlik.gov.tr/guvenlik-bildirimler… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TÜBİTAK BİLGEM Software Technologies Research Institute | pardus-nvidia-installer |
Affected:
0 , < 2.0.1
(semver)
|
Date Public
2026-11-10 12:51
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "pardus-nvidia-installer",
"vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute",
"versions": [
{
"lessThan": "2.0.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Namiq Ba\u011f\u0131rzad\u0259"
}
],
"datePublic": "2026-11-10T12:51:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Permissive list of allowed inputs vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute pardus-nvidia-installer allows Privilege Escalation.\u003cp\u003eThis issue affects pardus-nvidia-installer: before 2.0.1.\u003c/p\u003e"
}
],
"value": "Permissive list of allowed inputs vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute pardus-nvidia-installer allows Privilege Escalation.\n\nThis issue affects pardus-nvidia-installer: before 2.0.1."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-183",
"description": "CWE-183 Permissive list of allowed inputs",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T12:53:41.178Z",
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1500"
}
],
"source": {
"advisory": "TR-26-1500",
"defect": [
"TR-26-1500"
],
"discovery": "UNKNOWN"
},
"title": "Arbitrary Package Installation in T\u00dcB\u0130TAK B\u0130LGEM\u0027s pardus-nvidia-installer",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"assignerShortName": "TR-CERT",
"cveId": "CVE-2026-16478",
"datePublished": "2026-11-10T12:53:41.178Z",
"dateReserved": "2026-07-21T14:23:45.640Z",
"dateUpdated": "2026-11-10T12:53:41.178Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121267 (GCVE-0-2026-121267)
Vulnerability from cvelistv5 – Published: 2026-11-10 12:04 – Updated: 2026-11-10 12:04
VLAI
EPSS
VEX
Title
Incorrect Default Permissions Vulnerability in TÜBİTAK BİLGEM's eta-remote
Summary
Incorrect default permissions vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-remote allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects eta-remote: from 0.0.2 before 0.0.3.
Severity
7.8 (High)
CWE
- CWE-276 - Incorrect default permissions
Assigner
TR-CERT
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://siberguvenlik.gov.tr/guvenlik-bildirimler… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TÜBİTAK BİLGEM Software Technologies Research Institute | eta-remote |
Affected:
0.0.2 , < 0.0.3
(semver)
|
Date Public
2026-11-10 12:00
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "eta-remote",
"vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute",
"versions": [
{
"lessThan": "0.0.3",
"status": "affected",
"version": "0.0.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ahmed Emin AYGOREN"
}
],
"datePublic": "2026-11-10T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect default permissions vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute eta-remote allows Accessing Functionality Not Properly Constrained by ACLs.\u003cp\u003eThis issue affects eta-remote: from 0.0.2 before 0.0.3.\u003c/p\u003e"
}
],
"value": "Incorrect default permissions vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute eta-remote allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects eta-remote: from 0.0.2 before 0.0.3."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276 Incorrect default permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T12:04:01.079Z",
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1498"
}
],
"source": {
"advisory": "TR-26-1498",
"defect": [
"TR-26-1498"
],
"discovery": "UNKNOWN"
},
"title": "Incorrect Default Permissions Vulnerability in T\u00dcB\u0130TAK B\u0130LGEM\u0027s eta-remote",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"assignerShortName": "TR-CERT",
"cveId": "CVE-2026-121267",
"datePublished": "2026-11-10T12:04:01.079Z",
"dateReserved": "2026-11-03T11:11:13.612Z",
"dateUpdated": "2026-11-10T12:04:01.079Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121191 (GCVE-0-2026-121191)
Vulnerability from cvelistv5 – Published: 2026-11-10 11:52 – Updated: 2026-11-10 11:52
VLAI
EPSS
VEX
Title
Improper Access Control Vulnerability in TÜBİTAK BİLGEM's eta-remote
Summary
Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-remote allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects eta-remote: from 0.0.2 before 0.0.3.
Severity
6.5 (Medium)
CWE
- CWE-862 - Missing Authorization
Assigner
TR-CERT
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://siberguvenlik.gov.tr/guvenlik-bildirimler… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TÜBİTAK BİLGEM Software Technologies Research Institute | eta-remote |
Affected:
0.0.2 , < 0.0.3
(semver)
|
Date Public
2026-11-10 11:48
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "eta-remote",
"vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute",
"versions": [
{
"lessThan": "0.0.3",
"status": "affected",
"version": "0.0.2",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ahmed Emin AYGOREN"
}
],
"datePublic": "2026-11-10T11:48:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing Authorization vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute eta-remote allows Accessing Functionality Not Properly Constrained by ACLs.\u003cp\u003eThis issue affects eta-remote: from 0.0.2 before 0.0.3.\u003c/p\u003e"
}
],
"value": "Missing Authorization vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute eta-remote allows Accessing Functionality Not Properly Constrained by ACLs.\n\nThis issue affects eta-remote: from 0.0.2 before 0.0.3."
}
],
"impacts": [
{
"capecId": "CAPEC-1",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T11:52:12.493Z",
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1498"
}
],
"source": {
"advisory": "TR-26-1498",
"defect": [
"TR-26-1498"
],
"discovery": "UNKNOWN"
},
"title": "Improper Access Control Vulnerability in T\u00dcB\u0130TAK B\u0130LGEM\u0027s eta-remote",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"assignerShortName": "TR-CERT",
"cveId": "CVE-2026-121191",
"datePublished": "2026-11-10T11:52:12.493Z",
"dateReserved": "2026-11-03T10:21:47.171Z",
"dateUpdated": "2026-11-10T11:52:12.493Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94434 (GCVE-0-2026-94434)
Vulnerability from cvelistv5 – Published: 2026-11-09 12:13 – Updated: 2026-11-09 15:23
VLAI
EPSS
VEX
Title
OS Command Injection Leading to Root Code Execution in TÜBİTAK BİLGEM's Pardus Boot Repair
Summary
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection.
This issue affects Pardus Boot Repair: from 1.0.8 before 1.0.9.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 15:05 UTC
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Assigner
TR-CERT
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://siberguvenlik.gov.tr/guvenlik-bildirimler… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TÜBİTAK BİLGEM Software Technologies Research Institute | Pardus Boot Repair |
Affected:
1.0.8 , < 1.0.9
(semver)
|
Date Public
2026-11-09 12:11
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94434",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T15:05:11.230726Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T15:23:53.113Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Pardus Boot Repair",
"vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute",
"versions": [
{
"lessThan": "1.0.9",
"status": "affected",
"version": "1.0.8",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "\u00d6zcan Ersan"
},
{
"lang": "en",
"type": "finder",
"value": "Serdar \u00c7ATAL"
}
],
"datePublic": "2026-11-09T12:11:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027) vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection.\u003cp\u003eThis issue affects Pardus Boot Repair: from 1.0.8 before 1.0.9.\u003c/p\u003e"
}
],
"value": "Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027) vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection.\n\nThis issue affects Pardus Boot Repair: from 1.0.8 before 1.0.9."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T12:13:34.141Z",
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1486"
}
],
"source": {
"advisory": "TR-26-1486",
"defect": [
"TR-26-1486"
],
"discovery": "UNKNOWN"
},
"title": "OS Command Injection Leading to Root Code Execution in T\u00dcB\u0130TAK B\u0130LGEM\u0027s Pardus Boot Repair",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"assignerShortName": "TR-CERT",
"cveId": "CVE-2026-94434",
"datePublished": "2026-11-09T12:13:34.141Z",
"dateReserved": "2026-09-21T16:19:11.619Z",
"dateUpdated": "2026-11-09T15:23:53.113Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92606 (GCVE-0-2026-92606)
Vulnerability from cvelistv5 – Published: 2026-11-09 08:40 – Updated: 2026-11-09 08:40
VLAI
EPSS
VEX
Title
TOCTOU Race Condition in TÜBİTAK BİLGEM's Pardus MyComputer
Summary
Time-of-check time-of-use (TOCTOU) race condition vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus MyComputer allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions.
This issue affects Pardus MyComputer: from 0.8.0 before 0.8.1.
Severity
6 (Medium)
CWE
- CWE-367 - Time-of-check time-of-use (TOCTOU) race condition
Assigner
TR-CERT
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://siberguvenlik.gov.tr/guvenlik-bildirimler… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TÜBİTAK BİLGEM Software Technologies Research Institute | Pardus MyComputer |
Affected:
0.8.0 , < 0.8.1
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Pardus MyComputer",
"vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute",
"versions": [
{
"lessThan": "0.8.1",
"status": "affected",
"version": "0.8.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "\u00d6zcan Ersan"
},
{
"lang": "en",
"type": "finder",
"value": "Serdar \u00c7ATAL"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Time-of-check time-of-use (TOCTOU) race condition vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Pardus MyComputer allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions.\u003cp\u003eThis issue affects Pardus MyComputer: from 0.8.0 before 0.8.1.\u003c/p\u003e"
}
],
"value": "Time-of-check time-of-use (TOCTOU) race condition vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Pardus MyComputer allows Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions.\n\nThis issue affects Pardus MyComputer: from 0.8.0 before 0.8.1."
}
],
"impacts": [
{
"capecId": "CAPEC-29",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-29 Leveraging Time-of-Check and Time-of-Use (TOCTOU) Race Conditions"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "CWE-367 Time-of-check time-of-use (TOCTOU) race condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T08:40:23.219Z",
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1485"
}
],
"source": {
"advisory": "TR-26-1485",
"defect": [
"TR-26-1485"
],
"discovery": "UNKNOWN"
},
"title": "TOCTOU Race Condition in T\u00dcB\u0130TAK B\u0130LGEM\u0027s Pardus MyComputer",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"assignerShortName": "TR-CERT",
"cveId": "CVE-2026-92606",
"datePublished": "2026-11-09T08:40:23.219Z",
"dateReserved": "2026-09-16T13:51:12.021Z",
"dateUpdated": "2026-11-09T08:40:23.219Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-94249 (GCVE-0-2026-94249)
Vulnerability from cvelistv5 – Published: 2026-11-09 08:20 – Updated: 2026-11-09 16:26
VLAI
EPSS
VEX
Title
Missing Authorization in TÜBİTAK BİLGEM's Liderahenk
Summary
Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows Privilege Abuse.
This issue affects Liderahenk: before 2.0.3.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 15:12 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
TR-CERT
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://siberguvenlik.gov.tr/guvenlik-bildirimler… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TÜBİTAK BİLGEM Software Technologies Research Institute | Liderahenk |
Affected:
0 , < 2.0.3
(semver)
|
Date Public
2026-11-09 08:17
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-94249",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T15:12:05.518639Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T16:26:58.303Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Liderahenk",
"vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute",
"versions": [
{
"lessThan": "2.0.3",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Burak Korkmaz"
}
],
"datePublic": "2026-11-09T08:17:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing Authorization vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Liderahenk allows Privilege Abuse.\u003cp\u003eThis issue affects Liderahenk: before 2.0.3.\u003c/p\u003e"
}
],
"value": "Missing Authorization vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Liderahenk allows Privilege Abuse.\n\nThis issue affects Liderahenk: before 2.0.3."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T08:20:47.815Z",
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1484"
}
],
"source": {
"advisory": "TR-26-1484",
"defect": [
"TR-26-1484"
],
"discovery": "UNKNOWN"
},
"title": "Missing Authorization in T\u00dcB\u0130TAK B\u0130LGEM\u0027s Liderahenk",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"assignerShortName": "TR-CERT",
"cveId": "CVE-2026-94249",
"datePublished": "2026-11-09T08:20:47.815Z",
"dateReserved": "2026-09-21T08:42:00.644Z",
"dateUpdated": "2026-11-09T16:26:58.303Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92080 (GCVE-0-2026-92080)
Vulnerability from cvelistv5 – Published: 2026-11-06 13:01 – Updated: 2026-11-09 06:57
VLAI
EPSS
VEX
Title
Path Traversal Leading to Arbitrary Mount in TÜBİTAK BİLGEM's pardus-boot-repair
Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-boot-repair allows Path Traversal.
This issue affects pardus-boot-repair: from 1.0.8 before 1.1.0.
Severity
4.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 14:56 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
TR-CERT
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://siberguvenlik.gov.tr/guvenlik-bildirimler… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TÜBİTAK BİLGEM Software Technologies Research Institute | pardus-boot-repair |
Affected:
1.0.8 , < 1.1.0
(semver)
|
Date Public
2026-11-06 12:58
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92080",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T14:56:18.550669Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:21:11.390Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "pardus-boot-repair",
"vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute",
"versions": [
{
"lessThan": "1.1.0",
"status": "affected",
"version": "1.0.8",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "\u00d6zcan Ersan"
},
{
"lang": "en",
"type": "finder",
"value": "Serdar \u00c7ATAL"
}
],
"datePublic": "2026-11-06T12:58:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute pardus-boot-repair allows Path Traversal.\u003cp\u003eThis issue affects pardus-boot-repair: from 1.0.8 before 1.1.0.\u003c/p\u003e"
}
],
"value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute pardus-boot-repair allows Path Traversal.\n\nThis issue affects pardus-boot-repair: from 1.0.8 before 1.1.0."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T06:57:00.879Z",
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1477"
}
],
"source": {
"advisory": "TR-26-1477",
"defect": [
"TR-26-1477"
],
"discovery": "UNKNOWN"
},
"title": "Path Traversal Leading to Arbitrary Mount in T\u00dcB\u0130TAK B\u0130LGEM\u0027s pardus-boot-repair",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"assignerShortName": "TR-CERT",
"cveId": "CVE-2026-92080",
"datePublished": "2026-11-06T13:01:29.523Z",
"dateReserved": "2026-09-15T12:40:29.202Z",
"dateUpdated": "2026-11-09T06:57:00.879Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-105422 (GCVE-0-2026-105422)
Vulnerability from cvelistv5 – Published: 2026-11-06 12:40 – Updated: 2026-11-10 14:44
VLAI
EPSS
VEX
Title
Path Traversal in TÜBİTAK BİLGEM's pardus-boot-repair
Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-boot-repair allows Path Traversal.
This issue affects pardus-boot-repair: from 1.0.9 before 1.1.0.
Severity
6.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-10 14:43 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
TR-CERT
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://siberguvenlik.gov.tr/guvenlik-bildirimler… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TÜBİTAK BİLGEM Software Technologies Research Institute | pardus-boot-repair |
Affected:
1.0.9 , < 1.1.0
(semver)
|
Date Public
2026-11-06 12:37
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-105422",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-10T14:43:45.695696Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-10T14:44:18.218Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "pardus-boot-repair",
"vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute",
"versions": [
{
"lessThan": "1.1.0",
"status": "affected",
"version": "1.0.9",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Recep Ya\u011fmur"
}
],
"datePublic": "2026-11-06T12:37:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute pardus-boot-repair allows Path Traversal.\u003cp\u003eThis issue affects pardus-boot-repair: from 1.0.9 before 1.1.0.\u003c/p\u003e"
}
],
"value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute pardus-boot-repair allows Path Traversal.\n\nThis issue affects pardus-boot-repair: from 1.0.9 before 1.1.0."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T12:40:09.029Z",
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1477"
}
],
"source": {
"advisory": "TR-26-1477",
"defect": [
"TR-26-1477"
],
"discovery": "UNKNOWN"
},
"title": "Path Traversal in T\u00dcB\u0130TAK B\u0130LGEM\u0027s pardus-boot-repair",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"assignerShortName": "TR-CERT",
"cveId": "CVE-2026-105422",
"datePublished": "2026-11-06T12:40:09.029Z",
"dateReserved": "2026-10-05T12:14:39.969Z",
"dateUpdated": "2026-11-10T14:44:18.218Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-95652 (GCVE-0-2026-95652)
Vulnerability from cvelistv5 – Published: 2026-11-05 12:15 – Updated: 2026-11-05 21:26
VLAI
EPSS
VEX
Title
Improper Device Validation Allows Privileged Disk Formatting in TÜBİTAK BİLGEM's pardus-usb-formatter
Summary
Execution with unnecessary privileges vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-usb-formatter allows Privilege Abuse.
This issue affects pardus-usb-formatter: from 0.7.0 before 0.7.2.
Severity
6.6 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-05 21:26 UTC
CWE
- CWE-250 - Execution with unnecessary privileges
Assigner
TR-CERT
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://siberguvenlik.gov.tr/guvenlik-bildirimler… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TÜBİTAK BİLGEM Software Technologies Research Institute | pardus-usb-formatter |
Affected:
0.7.0 , < 0.7.2
(semver)
|
Date Public
2026-11-05 11:42
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-95652",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-05T21:26:12.812927Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T21:26:19.862Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "pardus-usb-formatter",
"vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute",
"versions": [
{
"lessThan": "0.7.2",
"status": "affected",
"version": "0.7.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "\u0130brahim ARI"
}
],
"datePublic": "2026-11-05T11:42:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Execution with unnecessary privileges vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute pardus-usb-formatter allows Privilege Abuse.\u003cp\u003eThis issue affects pardus-usb-formatter: from 0.7.0 before 0.7.2.\u003c/p\u003e"
}
],
"value": "Execution with unnecessary privileges vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute pardus-usb-formatter allows Privilege Abuse.\n\nThis issue affects pardus-usb-formatter: from 0.7.0 before 0.7.2."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-250",
"description": "CWE-250 Execution with unnecessary privileges",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-05T12:15:43.942Z",
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1466"
}
],
"source": {
"advisory": "TR-26-1466",
"defect": [
"TR-26-1466"
],
"discovery": "UNKNOWN"
},
"title": "Improper Device Validation Allows Privileged Disk Formatting in T\u00dcB\u0130TAK B\u0130LGEM\u0027s pardus-usb-formatter",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"assignerShortName": "TR-CERT",
"cveId": "CVE-2026-95652",
"datePublished": "2026-11-05T12:15:43.942Z",
"dateReserved": "2026-09-22T12:24:58.862Z",
"dateUpdated": "2026-11-05T21:26:19.862Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19731 (GCVE-0-2026-19731)
Vulnerability from cvelistv5 – Published: 2026-11-04 08:15 – Updated: 2026-11-09 21:20
VLAI
EPSS
VEX
Title
Path Traversal in TÜBİTAK BİLGEM's İmzager
Summary
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute İmzager allows Path Traversal.
This issue affects İmzager: from 2.10.5 before 2.10.7.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 21:20 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
TR-CERT
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://siberguvenlik.gov.tr/guvenlik-bildirimler… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TÜBİTAK BİLGEM Software Technologies Research Institute | İmzager |
Affected:
2.10.5 , < 2.10.7
(semver)
|
Date Public
2026-11-04 08:13
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19731",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T21:20:18.395105Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T21:20:30.118Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "\u0130mzager",
"vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute",
"versions": [
{
"lessThan": "2.10.7",
"status": "affected",
"version": "2.10.5",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mustafa An\u0131l YILDIRIM"
}
],
"datePublic": "2026-11-04T08:13:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute \u0130mzager allows Path Traversal.\u003cp\u003eThis issue affects \u0130mzager: from 2.10.5 before 2.10.7.\u003c/p\u003e"
}
],
"value": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027) vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute \u0130mzager allows Path Traversal.\n\nThis issue affects \u0130mzager: from 2.10.5 before 2.10.7."
}
],
"impacts": [
{
"capecId": "CAPEC-126",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-126 Path Traversal"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T08:15:49.216Z",
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1456"
}
],
"source": {
"advisory": "TR-26-1456",
"defect": [
"TR-26-1456"
],
"discovery": "UNKNOWN"
},
"title": "Path Traversal in T\u00dcB\u0130TAK B\u0130LGEM\u0027s \u0130mzager",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"assignerShortName": "TR-CERT",
"cveId": "CVE-2026-19731",
"datePublished": "2026-11-04T08:15:49.216Z",
"dateReserved": "2026-08-13T13:11:47.793Z",
"dateUpdated": "2026-11-09T21:20:30.118Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19721 (GCVE-0-2026-19721)
Vulnerability from cvelistv5 – Published: 2026-11-04 08:12 – Updated: 2026-11-09 21:20
VLAI
EPSS
VEX
Title
XXE in TÜBİTAK BİLGEM's İmzager
Summary
Improper restriction of XML external entity reference vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute İmzager allows Serialized Data External Linking.
This issue affects İmzager: from 2.10.5 before 2.10.7.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-09 21:20 UTC
CWE
- CWE-611 - Improper restriction of XML external entity reference
Assigner
TR-CERT
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://siberguvenlik.gov.tr/guvenlik-bildirimler… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TÜBİTAK BİLGEM Software Technologies Research Institute | İmzager |
Affected:
2.10.5 , < 2.10.7
(semver)
|
Date Public
2026-11-04 08:10
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19721",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-09T21:20:46.542555Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-09T21:20:55.401Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "\u0130mzager",
"vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute",
"versions": [
{
"lessThan": "2.10.7",
"status": "affected",
"version": "2.10.5",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mustafa An\u0131l YILDIRIM"
}
],
"datePublic": "2026-11-04T08:10:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper restriction of XML external entity reference vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute \u0130mzager allows Serialized Data External Linking.\u003cp\u003eThis issue affects \u0130mzager: from 2.10.5 before 2.10.7.\u003c/p\u003e"
}
],
"value": "Improper restriction of XML external entity reference vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute \u0130mzager allows Serialized Data External Linking.\n\nThis issue affects \u0130mzager: from 2.10.5 before 2.10.7."
}
],
"impacts": [
{
"capecId": "CAPEC-201",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-201 Serialized Data External Linking"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 Improper restriction of XML external entity reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T08:12:53.235Z",
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1456"
}
],
"source": {
"advisory": "TR-26-1456",
"defect": [
"TR-26-1456"
],
"discovery": "UNKNOWN"
},
"title": "XXE in T\u00dcB\u0130TAK B\u0130LGEM\u0027s \u0130mzager",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"assignerShortName": "TR-CERT",
"cveId": "CVE-2026-19721",
"datePublished": "2026-11-04T08:12:53.235Z",
"dateReserved": "2026-08-13T11:58:15.092Z",
"dateUpdated": "2026-11-09T21:20:55.401Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-92886 (GCVE-0-2026-92886)
Vulnerability from cvelistv5 – Published: 2026-11-02 12:45 – Updated: 2026-11-02 16:53
VLAI
EPSS
VEX
Title
Local Privilege Escalation via Polkit Misconfiguration in TÜBİTAK BİLGEM's eta-register
Summary
Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-register allows Privilege Escalation.
This issue affects eta-register: from 2.0.8 before 2.0.9.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-02 16:53 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
TR-CERT
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://siberguvenlik.gov.tr/guvenlik-bildirimler… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TÜBİTAK BİLGEM Software Technologies Research Institute | eta-register |
Affected:
2.0.8 , < 2.0.9
(semver)
|
Date Public
2026-11-02 12:41
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-92886",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-02T16:53:35.636485Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T16:53:46.465Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "eta-register",
"vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute",
"versions": [
{
"lessThan": "2.0.9",
"status": "affected",
"version": "2.0.8",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Burak Korkmaz"
}
],
"datePublic": "2026-11-02T12:41:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Missing Authorization vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute eta-register allows Privilege Escalation.\u003cp\u003eThis issue affects eta-register: from 2.0.8 before 2.0.9.\u003c/p\u003e"
}
],
"value": "Missing Authorization vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute eta-register allows Privilege Escalation.\n\nThis issue affects eta-register: from 2.0.8 before 2.0.9."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-02T12:45:23.938Z",
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1440"
}
],
"source": {
"advisory": "TR-26-1440",
"defect": [
"TR-26-1440"
],
"discovery": "UNKNOWN"
},
"title": "Local Privilege Escalation via Polkit Misconfiguration in T\u00dcB\u0130TAK B\u0130LGEM\u0027s eta-register",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"assignerShortName": "TR-CERT",
"cveId": "CVE-2026-92886",
"datePublished": "2026-11-02T12:45:23.938Z",
"dateReserved": "2026-09-17T08:47:20.448Z",
"dateUpdated": "2026-11-02T16:53:46.465Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-79617 (GCVE-0-2026-79617)
Vulnerability from cvelistv5 – Published: 2026-09-09 14:11 – Updated: 2026-09-09 19:16
VLAI
EPSS
VEX
Title
Improper Access Control Leading to Display Exposure in TÜBİTAK BİLGEM's Pardus LightDM Greeter
Summary
Incorrect Permission Assignment for Critical Resource vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus LightDM Greeter allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Pardus LightDM Greeter: before 0.4.15.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-09 19:15 UTC
CWE
- CWE-732 - Incorrect Permission Assignment for Critical Resource
Assigner
TR-CERT
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://siberguvenlik.gov.tr/guvenlik-bildirimler… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TÜBİTAK BİLGEM Software Technologies Research Institute | Pardus LightDM Greeter |
Affected:
0 , < 0.4.15
(custom)
|
Date Public
2026-09-09 14:07
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-79617",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-09T19:15:55.138813Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T19:16:09.062Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Pardus LightDM Greeter",
"vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute",
"versions": [
{
"lessThan": "0.4.15",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Alperen ERGEL"
}
],
"datePublic": "2026-09-09T14:07:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Incorrect Permission Assignment for Critical Resource vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Pardus LightDM Greeter allows Exploiting Incorrectly Configured Access Control Security Levels.\u003cp\u003eThis issue affects Pardus LightDM Greeter: before 0.4.15.\u003c/p\u003e"
}
],
"value": "Incorrect Permission Assignment for Critical Resource vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Pardus LightDM Greeter allows Exploiting Incorrectly Configured Access Control Security Levels.\n\nThis issue affects Pardus LightDM Greeter: before 0.4.15."
}
],
"impacts": [
{
"capecId": "CAPEC-180",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-732",
"description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T14:11:10.836Z",
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1051"
}
],
"source": {
"advisory": "TR-26-1051",
"defect": [
"TR-26-1051"
],
"discovery": "UNKNOWN"
},
"title": "Improper Access Control Leading to Display Exposure in T\u00dcB\u0130TAK B\u0130LGEM\u0027s Pardus LightDM Greeter",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"assignerShortName": "TR-CERT",
"cveId": "CVE-2026-79617",
"datePublished": "2026-09-09T14:11:10.836Z",
"dateReserved": "2026-08-25T07:51:26.587Z",
"dateUpdated": "2026-09-09T19:16:09.062Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19702 (GCVE-0-2026-19702)
Vulnerability from cvelistv5 – Published: 2026-08-31 13:54 – Updated: 2026-08-31 14:25
VLAI
EPSS
VEX
Title
OS Command Injection in TÜBİTAK BİLGEM's Pardus Boot Repair
Summary
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection.
This issue affects Pardus Boot Repair: from 1.0.7 before 1.0.8.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 14:25 UTC
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Assigner
TR-CERT
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://siberguvenlik.gov.tr/guvenlik-bildirimler… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TÜBİTAK BİLGEM Software Technologies Research Institute | Pardus Boot Repair |
Affected:
1.0.7 , < 1.0.8
(custom)
|
Date Public
2026-08-31 13:31
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19702",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T14:25:40.472879Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T14:25:48.846Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Pardus Boot Repair",
"vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute",
"versions": [
{
"lessThan": "1.0.8",
"status": "affected",
"version": "1.0.7",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mert Durum"
}
],
"datePublic": "2026-08-31T13:31:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027) vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection.\u003cp\u003eThis issue affects Pardus Boot Repair: from 1.0.7 before 1.0.8.\u003c/p\u003e"
}
],
"value": "Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027) vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Pardus Boot Repair allows OS Command Injection.\n\nThis issue affects Pardus Boot Repair: from 1.0.7 before 1.0.8."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T13:54:45.791Z",
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0956"
}
],
"source": {
"advisory": "TR-26-0956",
"defect": [
"TR-26-0956"
],
"discovery": "UNKNOWN"
},
"title": "OS Command Injection in T\u00dcB\u0130TAK B\u0130LGEM\u0027s Pardus Boot Repair",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"assignerShortName": "TR-CERT",
"cveId": "CVE-2026-19702",
"datePublished": "2026-08-31T13:54:45.791Z",
"dateReserved": "2026-08-13T08:07:57.415Z",
"dateUpdated": "2026-08-31T14:25:48.846Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-19271 (GCVE-0-2026-19271)
Vulnerability from cvelistv5 – Published: 2026-08-26 13:44 – Updated: 2026-08-26 15:43
VLAI
EPSS
VEX
Title
Blind LDAP Injection in Sign-In Endpoint in TÜBİTAK BİLGEM's Liderahenk
Summary
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows LDAP Injection.
This issue affects Liderahenk: from 3.4.0 before 3.5.5.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 15:43 UTC
CWE
- CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
Assigner
TR-CERT
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://siberguvenlik.gov.tr/guvenlik-bildirimler… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TÜBİTAK BİLGEM Software Technologies Research Institute | Liderahenk |
Affected:
3.4.0 , < 3.5.5
(custom)
|
Date Public
2026-08-26 13:36
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19271",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T15:43:25.301919Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T15:43:48.093Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Liderahenk",
"vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute",
"versions": [
{
"lessThan": "3.5.5",
"status": "affected",
"version": "3.4.0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Emre DO\u011eAN"
}
],
"datePublic": "2026-08-26T13:36:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027) vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Liderahenk allows LDAP Injection.\u003cp\u003eThis issue affects Liderahenk: from 3.4.0 before 3.5.5.\u003c/p\u003e"
}
],
"value": "Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027) vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Liderahenk allows LDAP Injection.\n\nThis issue affects Liderahenk: from 3.4.0 before 3.5.5."
}
],
"impacts": [
{
"capecId": "CAPEC-136",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-136 LDAP Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-90",
"description": "CWE-90 Improper Neutralization of Special Elements used in an LDAP Query (\u0027LDAP Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T13:44:57.748Z",
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0916"
}
],
"source": {
"advisory": "TR-26-0916",
"defect": [
"TR-26-0916"
],
"discovery": "UNKNOWN"
},
"title": "Blind LDAP Injection in Sign-In Endpoint in T\u00dcB\u0130TAK B\u0130LGEM\u0027s Liderahenk",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"assignerShortName": "TR-CERT",
"cveId": "CVE-2026-19271",
"datePublished": "2026-08-26T13:44:57.748Z",
"dateReserved": "2026-08-07T14:23:01.592Z",
"dateUpdated": "2026-08-26T15:43:48.093Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-75896 (GCVE-0-2026-75896)
Vulnerability from cvelistv5 – Published: 2026-08-26 13:35 – Updated: 2026-08-26 17:10
VLAI
EPSS
VEX
Title
Use of Hard-coded LDAP Credentials in TÜBİTAK BİLGEM's Liderahenk
Summary
Use of Hard-coded Credentials vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows Try Common or Default Usernames and Passwords.
This issue affects Liderahenk: before 3.5.5.
Severity
9.1 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-26 17:10 UTC
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
TR-CERT
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://siberguvenlik.gov.tr/guvenlik-bildirimler… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TÜBİTAK BİLGEM Software Technologies Research Institute | Liderahenk |
Affected:
0 , < 3.5.5
(custom)
|
Date Public
2026-08-26 13:28
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-75896",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-26T17:10:20.417348Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T17:10:29.246Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Liderahenk",
"vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute",
"versions": [
{
"lessThan": "3.5.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ehlullah Albayrak"
}
],
"datePublic": "2026-08-26T13:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Use of Hard-coded Credentials vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Liderahenk allows Try Common or Default Usernames and Passwords.\u003cp\u003eThis issue affects Liderahenk: before 3.5.5.\u003c/p\u003e"
}
],
"value": "Use of Hard-coded Credentials vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute Liderahenk allows Try Common or Default Usernames and Passwords.\n\nThis issue affects Liderahenk: before 3.5.5."
}
],
"impacts": [
{
"capecId": "CAPEC-70",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-70 Try Common or Default Usernames and Passwords"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-26T13:35:05.852Z",
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0916"
}
],
"source": {
"advisory": "TR-26-0916",
"defect": [
"TR-26-0916"
],
"discovery": "UNKNOWN"
},
"title": "Use of Hard-coded LDAP Credentials in T\u00dcB\u0130TAK B\u0130LGEM\u0027s Liderahenk",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"assignerShortName": "TR-CERT",
"cveId": "CVE-2026-75896",
"datePublished": "2026-08-26T13:35:05.852Z",
"dateReserved": "2026-08-18T14:06:46.512Z",
"dateUpdated": "2026-08-26T17:10:29.246Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15599 (GCVE-0-2026-15599)
Vulnerability from cvelistv5 – Published: 2026-08-06 12:37 – Updated: 2026-08-06 14:42
VLAI
EPSS
VEX
Title
Arbitrary Process Termination in TÜBİTAK BİLGEM's pardus-domain-joiner
Summary
Unverified ownership vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-domain-joiner allows Privilege Abuse.
This issue affects pardus-domain-joiner: before 0.5.5.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-06 14:42 UTC
CWE
- CWE-283 - Unverified ownership
Assigner
TR-CERT
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://siberguvenlik.gov.tr/guvenlik-bildirimler… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TÜBİTAK BİLGEM Software Technologies Research Institute | pardus-domain-joiner |
Affected:
0 , < 0.5.5
(custom)
|
Date Public
2026-08-06 12:24
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15599",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T14:42:03.910991Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T14:42:17.468Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "pardus-domain-joiner",
"vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute",
"versions": [
{
"lessThan": "0.5.5",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Namiq Ba\u011f\u0131rzad\u0259"
}
],
"datePublic": "2026-08-06T12:24:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unverified ownership vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute pardus-domain-joiner allows Privilege Abuse.\u003cp\u003eThis issue affects pardus-domain-joiner: before 0.5.5.\u003c/p\u003e"
}
],
"value": "Unverified ownership vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute pardus-domain-joiner allows Privilege Abuse.\n\nThis issue affects pardus-domain-joiner: before 0.5.5."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 3.3,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-283",
"description": "CWE-283 Unverified ownership",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T12:37:22.123Z",
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0770"
}
],
"source": {
"advisory": "TR-26-0770",
"defect": [
"TR-26-0770"
],
"discovery": "UNKNOWN"
},
"title": "Arbitrary Process Termination in T\u00dcB\u0130TAK B\u0130LGEM\u0027s pardus-domain-joiner",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"assignerShortName": "TR-CERT",
"cveId": "CVE-2026-15599",
"datePublished": "2026-08-06T12:37:22.123Z",
"dateReserved": "2026-07-13T14:13:50.482Z",
"dateUpdated": "2026-08-06T14:42:17.468Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18915 (GCVE-0-2026-18915)
Vulnerability from cvelistv5 – Published: 2026-08-06 07:33 – Updated: 2026-08-06 12:32
VLAI
EPSS
VEX
Title
Exposure of OTP Secret Through Process Command-Line Arguments in TÜBİTAK BİLGEM's eta-otp-lock
Summary
Invocation of process using visible sensitive information vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-otp-lock allows System Footprinting.
This issue affects eta-otp-lock: before 1.0.4.
Severity
5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-06 12:32 UTC
CWE
- CWE-214 - Invocation of process using visible sensitive information
Assigner
TR-CERT
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://siberguvenlik.gov.tr/guvenlik-bildirimler… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TÜBİTAK BİLGEM Software Technologies Research Institute | eta-otp-lock |
Affected:
0 , < 1.0.4
(custom)
|
Date Public
2026-08-06 07:28
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18915",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-06T12:32:46.054101Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T12:32:52.449Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "eta-otp-lock",
"vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute",
"versions": [
{
"lessThan": "1.0.4",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Emirhan Y\u00dcCEL"
}
],
"datePublic": "2026-08-06T07:28:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Invocation of process using visible sensitive information vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute eta-otp-lock allows System Footprinting.\u003cp\u003eThis issue affects eta-otp-lock: before 1.0.4.\u003c/p\u003e"
}
],
"value": "Invocation of process using visible sensitive information vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute eta-otp-lock allows System Footprinting.\n\nThis issue affects eta-otp-lock: before 1.0.4."
}
],
"impacts": [
{
"capecId": "CAPEC-580",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-580 System Footprinting"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-214",
"description": "CWE-214 Invocation of process using visible sensitive information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-06T07:33:16.330Z",
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0753"
}
],
"source": {
"advisory": "TR-26-0753",
"defect": [
"TR-26-0753"
],
"discovery": "UNKNOWN"
},
"title": "Exposure of OTP Secret Through Process Command-Line Arguments in T\u00dcB\u0130TAK B\u0130LGEM\u0027s eta-otp-lock",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"assignerShortName": "TR-CERT",
"cveId": "CVE-2026-18915",
"datePublished": "2026-08-06T07:33:16.330Z",
"dateReserved": "2026-08-05T07:31:21.423Z",
"dateUpdated": "2026-08-06T12:32:52.449Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18806 (GCVE-0-2026-18806)
Vulnerability from cvelistv5 – Published: 2026-08-04 12:38 – Updated: 2026-08-10 11:33
VLAI
EPSS
VEX
Title
Arbitrary Block Device Write via Missing Validation in TÜBİTAK BİLGEM's pardus-image-writer
Summary
External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer allows Removing Important Client Functionality.
This issue affects pardus-image-writer: before 0.9.0.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-04 15:37 UTC
CWE
- CWE-73 - External control of file name or path
Assigner
TR-CERT
CNA
References
1 reference
| URL | Tags |
|---|---|
| https://siberguvenlik.gov.tr/guvenlik-bildirimler… | government-resource |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| TÜBİTAK BİLGEM Software Technologies Research Institute | pardus-image-writer |
Affected:
0 , < 0.9.0
(custom)
|
Date Public
2026-08-04 12:26
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-18806",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-04T15:37:37.919419Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-04T15:37:47.429Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "pardus-image-writer",
"vendor": "T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute",
"versions": [
{
"lessThan": "0.9.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Emirhan Y\u00dcCEL"
}
],
"datePublic": "2026-08-04T12:26:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "External control of file name or path vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute pardus-image-writer allows Removing Important Client Functionality.\u003cp\u003eThis issue affects pardus-image-writer: before 0.9.0.\u003c/p\u003e"
}
],
"value": "External control of file name or path vulnerability in T\u00dcB\u0130TAK B\u0130LGEM Software Technologies Research Institute pardus-image-writer allows Removing Important Client Functionality.\n\nThis issue affects pardus-image-writer: before 0.9.0."
}
],
"impacts": [
{
"capecId": "CAPEC-207",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-207 Removing Important Client Functionality"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-73",
"description": "CWE-73 External control of file name or path",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:33:53.118Z",
"orgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"shortName": "TR-CERT"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0740"
}
],
"source": {
"advisory": "TR-26-0740",
"defect": [
"TR-26-0740"
],
"discovery": "UNKNOWN"
},
"title": "Arbitrary Block Device Write via Missing Validation in T\u00dcB\u0130TAK B\u0130LGEM\u0027s pardus-image-writer",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "ca940d4e-fea4-4aa2-9a58-591a58b1ce21",
"assignerShortName": "TR-CERT",
"cveId": "CVE-2026-18806",
"datePublished": "2026-08-04T12:38:14.831Z",
"dateReserved": "2026-08-04T12:12:44.857Z",
"dateUpdated": "2026-08-10T11:33:53.118Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}