Türkiye'de Aktif Sömürülen ZafiyetlerKnown Exploited Vulnerabilities in Turkey
SiberKapan'ın Türkiye'deki honeypot ve gerçek web sunucusu sensörlerinin, internette sömürü denemesi olarak gördüğü zafiyetler. Liste günde bir kez güncellenir ve makine tarafından okunabilir GCVE BCP-07 biçiminde de yayınlanır.Vulnerabilities that SiberKapan honeypot and production web server sensors in Turkey see being exploited in the wild. Updated daily and also published in the machine readable GCVE BCP-07 format.
| CVE | ZafiyetVulnerability | DurumStatus | Farklı IP (90 gün)Distinct IPs (90d) | Deneme (90 gün)Attempts (90d) | İlk görülmeFirst seen | Son görülmeLast seen |
|---|---|---|---|---|---|---|
| CVE-2021-41773 | Apache HTTP Server path traversal | confirmed | 216 | 291 | 2026-08-09 | 2026-11-06 |
| CVE-2017-9841 | PHPUnit eval-stdin RCE | confirmed | 163 | 322 | 2026-08-09 | 2026-11-06 |
| CVE-2024-3721 | TBK DVR command injection | confirmed | 22 | 1349 | 2026-08-09 | 2026-11-07 |
| CVE-2023-1389 | TP-Link Archer AX21 command injection | confirmed | 8 | 31 | 2026-08-17 | 2026-11-05 |
| CVE-2018-13379 | Fortinet FortiOS SSL VPN path traversal | confirmed | 4 | 4 | 2026-09-02 | 2026-10-14 |
| CVE-2018-20062 | ThinkPHP RCE | confirmed | 2 | 2 | 2026-09-06 | 2026-10-30 |
| CVE-2024-4577 | PHP-CGI argument injection | confirmed | 2 | 2 | 2026-10-06 | 2026-10-06 |
| CVE-2015-2051 | D-Link HNAP command injection | suspected | 2 | 2 | 2026-08-27 | 2026-09-02 |
| CVE-2021-42013 | Apache HTTP Server path traversal (bypass) | confirmed | 1 | 1 | 2026-10-20 | 2026-10-20 |
| CVE-2019-19781 | Citrix ADC path traversal | confirmed | 1 | 1 | 2026-09-16 | 2026-09-16 |
| CVE-2018-10562 | GPON router command injection | confirmed | 1 | 1 | 2026-08-27 | 2026-08-27 |
| CVE-2021-44228 | Apache Log4j Log4Shell | confirmed | 1 | 1 | 2026-08-19 | 2026-08-19 |
| CVE-2022-40684 | Fortinet FortiOS auth bypass | suspected | 1 | 2 | 2026-08-15 | 2026-08-15 |
| CVE-2022-22947 | Spring Cloud Gateway code injection | suspected | 1 | 1 | 2026-08-11 | 2026-08-11 |
"confirmed" kayıtlar, sömürüye özgü istek imzalarıyla tespit edilir. "suspected" kayıtlar keşif amaçlı da olabilecek yollarla eşleşir. Honeypot'ta sömürü denemesi görülmüştür, gerçek bir ele geçirme anlamına gelmez. Makine tarafından okunabilir feed /api/v1/kev.json. "confirmed" entries are detected with exploit specific request signatures. "suspected" entries match paths that may also be used for reconnaissance. Exploitation attempts were observed on sensors, which does not imply a successful compromise. Machine readable feed /api/v1/kev.json.