CVE-2026-5141

Improper Access Control in TUBITAK BILGEM's Pardus Software Center

Improper Privilege Management, Improper Access Control, Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software Center allows Hijacking a privileged process. This issue affects Pardus Software Center: from 1.0.2 before 1.0.3.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Tubitak Bilgem Software Technologies Research Institute

Products

Pardus Software Center

CVE-2026-5161

Improper Authentication in TUBITAK BILGEM's Pardus About

Improper link resolution before file access ('link following') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus About allows Symlink Attack. This issue affects Pardus About: before 1.2.2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Tubitak Bilgem Software Technologies Research Institute

Products

Pardus About

CVE-2026-5166

Path Traversal in TUBITAK BILGEM's Pardus Software Center

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software Center allows Path Traversal. This issue affects Pardus Software Center: before 0.6.4.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed

Vendors

Tubitak Bilgem Software Technologies Research Institute

Products

Pardus Software Center

CVE-2026-6849

OS Command Injection in TUBITAK BILGEM's Pardus OS My Computer

Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus OS My Computer allows OS Command Injection. This issue affects Pardus OS My Computer: from <=0.7.5 before 0.8.0.

CVSS 3.1 · 8.8 High EPSS 1.0% KEV · Not listed

Vendors

Tubitak Bilgem Software Technologies Research Institute

Products

Pardus Os My Computer

CVE-2026-7382

Information Disclosure in MeWare Software's PDKS

Exposure of Sensitive Information to an Unauthorized Actor, Exposure of private personal information to an unauthorized actor vulnerability in MeWare Software Development Inc. PDKS allows Excavation. This issue affects PDKS: from V16.20200313 before VMYR_3.5.2025117.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Meware Software Development

Products

Pdks

CVE-2026-7399

IDOR in MeWare Software's PDKS

Authorization bypass through User-Controlled key vulnerability in MeWare Software Development Inc. PDKS allows Privilege Abuse. This issue affects PDKS: from V16.20200313 before VMYR_3.5.2025117.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Meware Software Development

Products

Pdks

CVE-2026-7402

Improper Rate Limiting in MeWare Software's PDKS

Improper Control of Interaction Frequency vulnerability in MeWare Software Development Inc. PDKS allows Flooding. This issue affects PDKS: from V16.20200313 before VMYR_3.5.2025117.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Meware Software Development

Products

Pdks

CVE-2025-0419

XSS in Mikrogrup's Zirve Nova

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zirve Information Technologies Inc. Zirve Nova allows Cross-Site Scripting (XSS). This issue affects Zirve Nova: from 235 through 20250131.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-0420

XSS in Mikrogrup's Paraşüt

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Paraşüt Software Paraşüt allows Cross-Site Scripting (XSS). This issue affects Paraşüt: from 0.0.0.65efa44e through 20250204.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Parasut Software

Products

Parasut

CVE-2025-0421

iFrame Injection in Mikrogrup's Shopside

Improper Restriction of Rendered UI Layers or Frames vulnerability in Shopside Software Technologies Inc. Shopside allows iFrame Overlay. This issue affects Shopside: through 05022025.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Shopside

Products

Shopside

CVE-2025-0545

XSS in Tekrom Technology's T-Soft E-Commerce

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tekrom Technology T-Soft E-Commerce allows Cross-Site Scripting (XSS). This issue affects T-Soft E-Commerce: before v5.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-0546

XSS in Mevzuattr Software's MevzuatTR

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting'), Improper Restriction of Rendered UI Layers or Frames vulnerability in Mevzuattr Software MevzuatTR allows Phishing, iFrame Overlay, Clickjacking, Forceful Browsing. This issue needs high privileges.  This issue affects MevzuatTR: before 12.02.2025.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-0547

XSS in Mikrogrup's Bizmu

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Paraşüt Software Bizmu allows Cross-Site Scripting (XSS). This issue affects Bizmu: from 2.27.0 through 20250212.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Parasut Software

Products

Bizmu

CVE-2025-0603

SQLi in Callvision Healthcare's Callvision Emergency Code

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Callvision Healthcare Callvision Emergency Code allows SQL Injection, Blind SQL Injection. This issue affects Callvision Emergency Code: before V3.0.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Callvision Healthcare

Products

Callvision Emergency Code

CVE-2025-0606

IDOR in Logo Software's Logo Cloud

Authorization Bypass Through User-Controlled Key vulnerability in Logo Software Inc. Logo Cloud allows Forceful Browsing, Resource Leak Exposure. This issue affects Logo Cloud: before 0.67.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Logo Software

Products

Logo Cloud

CVE-2025-0607

HTML Injection in Logo Software's Logo Cloud

Improper Encoding or Escaping of Output vulnerability in Logo Software Inc. Logo Cloud allows Phishing. This issue affects Logo Cloud: before 2.57.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Logo Software

Products

Logo Cloud

CVE-2025-0608

Open Redirect in Logo Software's Logo Cloud

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Logo Software Inc. Logo Cloud allows Phishing, Forceful Browsing. This issue affects Logo Cloud: before 2025.R6.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Logo Software

Products

Logo Cloud

CVE-2025-0609

XSS in Logo Software's Logo Cloud

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Logo Software Inc. Logo Cloud allows Cross-Site Scripting (XSS). This issue affects Logo Cloud: before 1.18.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Logo Software

Products

Logo Cloud

CVE-2025-0610

CSRF in Akinsoft's QR Menu

Cross-Site Request Forgery (CSRF) vulnerability in Akınsoft QR Menü allows Cross Site Request Forgery. This issue affects QR Menü: from s1.05.06 before v1.05.12.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Akinsoft

Products

Qr Menu

CVE-2025-0616

SQLi in Teknolojik Center Telecommunication's B2B - Netsis Panel

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Teknolojik Center Telecommunication Industry Trade Co. Ltd. B2B - Netsis Panel allows SQL Injection. This issue affects B2B - Netsis Panel: through 20251003. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Teknolojik Center

Products

Netsis Panel