Why this deserves its current priority

CVSS is 8.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps TUBITAK BILGEM Software Technologies Research Institute/pardus-software (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for TUBITAK BILGEM Software Technologies Research Institute/pardus-software.
2. 2Review the reported fix. Update TUBITAK BILGEM Software Technologies Research Institute/pardus-software to 1.0.5 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Jul 3, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Jul 6, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Jul 3, 2026

Sources and claim methodology

• Source referencesiberguvenlik.gov.tr

Related CVEs

• ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' ParameterSame generic ecosystem
• VikAppointments – Services Booking Calendar <= 1.2.19 - Unauthenticated SQL InjectionSame generic ecosystem
• Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL InjectionSame generic ecosystem
• VikRentItems Flexible Rental Management System <= 1.2.1 - Unauthenticated Stored Cross-Site ScriptingSame generic ecosystem
• Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to AdministratorSame generic ecosystem
• Baserow 2FA Verify Endpoint views.py verify improper authenticationSame generic ecosystem

Why this deserves its current priority

CVSS is 8.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps TUBITAK BILGEM Software Technologies Research Institute/pardus-software (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for TUBITAK BILGEM Software Technologies Research Institute/pardus-software.
2. 2Review the reported fix. Update TUBITAK BILGEM Software Technologies Research Institute/pardus-software to 1.0.5 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Jul 3, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Jul 6, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Jul 3, 2026

Sources and claim methodology

• Source referencesiberguvenlik.gov.tr

Related CVEs

• ERP: Complete HR, Accounting & CRM Suite with WooCommerce CRM Support <= 1.17.4 - Authenticated (Custom+) SQL Injection via 'erpadvancefilter' ParameterSame generic ecosystem
• VikAppointments – Services Booking Calendar <= 1.2.19 - Unauthenticated SQL InjectionSame generic ecosystem
• Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL InjectionSame generic ecosystem
• VikRentItems Flexible Rental Management System <= 1.2.1 - Unauthenticated Stored Cross-Site ScriptingSame generic ecosystem
• Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to AdministratorSame generic ecosystem
• Baserow 2FA Verify Endpoint views.py verify improper authenticationSame generic ecosystem