<?xml version="1.0" encoding="utf-8"?><feed xmlns="http://www.w3.org/2005/Atom" ><generator uri="https://jekyllrb.com/" version="4.3.4">Jekyll</generator><link href="https://aydinnyunus.github.io/feed.xml" rel="self" type="application/atom+xml" /><link href="https://aydinnyunus.github.io/" rel="alternate" type="text/html" /><updated>2026-05-03T14:52:11+00:00</updated><id>https://aydinnyunus.github.io/feed.xml</id><title type="html">Yunus Aydın Blog</title><subtitle>Security researcher exploring cybersecurity, vulnerability research, and responsible disclosure. Discover CVEs, conference talks, and security research.</subtitle><author><name>Yunus Aydın</name></author><entry xml:lang="tr"><title type="html">CVE-2026-5728: LollMS chat image upload’unda Content-Type spoofing</title><link href="https://aydinnyunus.github.io/2026/05/03/content-type-spoofing-lollms-chat-image-cve-2026-5728-tr/" rel="alternate" type="text/html" title="CVE-2026-5728: LollMS chat image upload’unda Content-Type spoofing" /><published>2026-05-03T00:00:00+00:00</published><updated>2026-05-03T00:00:00+00:00</updated><id>https://aydinnyunus.github.io/2026/05/03/content-type-spoofing-lollms-chat-image-cve-2026-5728-tr</id><author><name>Yunus Aydın</name></author><summary type="html"><![CDATA[CVE-2026-5728: LollMS /api/upload/chat_image endpoint'i sadece istemcinin gönderdiği Content-Type başlığına güveniyor; doğrulanmış kullanıcılar PNG ya da JPEG kılığında görsel olmayan dosyalar yükleyebiliyor.]]></summary></entry><entry xml:lang="en"><title type="html">CVE-2026-5728: Content-Type spoofing on LollMS chat image upload</title><link href="https://aydinnyunus.github.io/2026/05/03/content-type-spoofing-lollms-chat-image-cve-2026-5728/" rel="alternate" type="text/html" title="CVE-2026-5728: Content-Type spoofing on LollMS chat image upload" /><published>2026-05-03T00:00:00+00:00</published><updated>2026-05-03T00:00:00+00:00</updated><id>https://aydinnyunus.github.io/2026/05/03/content-type-spoofing-lollms-chat-image-cve-2026-5728</id><author><name>Yunus Aydın</name></author><summary type="html"><![CDATA[CVE-2026-5728: LollMS /api/upload/chat_image trusts the client Content-Type header only, so authenticated users can upload non-images disguised as PNG or JPEG.]]></summary></entry><entry xml:lang="tr"><title type="html">CPython http.server ve wsgiref’te CRLF Injection</title><link href="https://aydinnyunus.github.io/2026/04/24/crlf-injection-cpython-http-server-wsgiref-tr/" rel="alternate" type="text/html" title="CPython http.server ve wsgiref’te CRLF Injection" /><published>2026-04-24T00:00:00+00:00</published><updated>2026-04-24T00:00:00+00:00</updated><id>https://aydinnyunus.github.io/2026/04/24/crlf-injection-cpython-http-server-wsgiref-tr</id><author><name>Yunus Aydın</name></author><summary type="html"><![CDATA[CPython'ın http.server ve wsgiref modüllerindeki send_header() CRLF injection zafiyeti, kullanıcı girdisi header'lara yansıtıldığında Set-Cookie ve Location gibi keyfi HTTP header'ları eklemeye izin veriyor.]]></summary></entry><entry xml:lang="en"><title type="html">CRLF Injection in CPython’s http.server and wsgiref</title><link href="https://aydinnyunus.github.io/2026/04/24/crlf-injection-cpython-http-server-wsgiref/" rel="alternate" type="text/html" title="CRLF Injection in CPython’s http.server and wsgiref" /><published>2026-04-24T00:00:00+00:00</published><updated>2026-04-24T00:00:00+00:00</updated><id>https://aydinnyunus.github.io/2026/04/24/crlf-injection-cpython-http-server-wsgiref</id><author><name>Yunus Aydın</name></author><summary type="html"><![CDATA[CRLF injection vulnerability in CPython's http.server and wsgiref send_header() allows injecting arbitrary HTTP headers including Set-Cookie and Location when user input is reflected in headers.]]></summary></entry><entry xml:lang="tr"><title type="html">CVE-2026-0562: LollMS arkadaşlık isteği yanıtında IDOR zafiyeti</title><link href="https://aydinnyunus.github.io/2026/04/18/idor-lollms-friend-request-cve-2026-0562-tr/" rel="alternate" type="text/html" title="CVE-2026-0562: LollMS arkadaşlık isteği yanıtında IDOR zafiyeti" /><published>2026-04-18T00:00:00+00:00</published><updated>2026-04-18T00:00:00+00:00</updated><id>https://aydinnyunus.github.io/2026/04/18/idor-lollms-friend-request-cve-2026-0562-tr</id><author><name>Yunus Aydın</name></author><summary type="html"><![CDATA[CVE-2026-0562: parisneo/lollms'deki IDOR zafiyeti, herhangi bir kimliği doğrulanmış kullanıcının başkalarının arkadaşlık isteklerini kabul etmesine veya reddetmesine izin veriyor.]]></summary></entry><entry xml:lang="en"><title type="html">CVE-2026-0562: IDOR in LollMS friend request response</title><link href="https://aydinnyunus.github.io/2026/04/18/idor-lollms-friend-request-cve-2026-0562/" rel="alternate" type="text/html" title="CVE-2026-0562: IDOR in LollMS friend request response" /><published>2026-04-18T00:00:00+00:00</published><updated>2026-04-18T00:00:00+00:00</updated><id>https://aydinnyunus.github.io/2026/04/18/idor-lollms-friend-request-cve-2026-0562</id><author><name>Yunus Aydın</name></author><summary type="html"><![CDATA[CVE-2026-0562: IDOR vulnerability in parisneo/lollms allows any authenticated user to accept or reject other users' friend requests by manipulating friendship IDs.]]></summary></entry><entry xml:lang="en"><title type="html">Finding Security Fixes Without CVE: A Changelog and Commit Pipeline</title><link href="https://aydinnyunus.github.io/2026/04/11/finding-security-fixes-without-cve-changelog-analyzer/" rel="alternate" type="text/html" title="Finding Security Fixes Without CVE: A Changelog and Commit Pipeline" /><published>2026-04-11T00:00:00+00:00</published><updated>2026-04-11T00:00:00+00:00</updated><id>https://aydinnyunus.github.io/2026/04/11/finding-security-fixes-without-cve-changelog-analyzer</id><author><name>Yunus Aydın</name></author><summary type="html"><![CDATA[How to surface security fixes without CVE from GitHub changelogs and commits. Pipeline: releases, LLM-based detection, NVD check, and alerts for triage and CVE requests.]]></summary></entry><entry xml:lang="tr"><title type="html">IP adresi sınıflandırmasındaki tutarsızlıklar: diller arası farklar</title><link href="https://aydinnyunus.github.io/2026/03/21/ip-address-classification-inconsistencies-tr/" rel="alternate" type="text/html" title="IP adresi sınıflandırmasındaki tutarsızlıklar: diller arası farklar" /><published>2026-03-21T00:00:00+00:00</published><updated>2026-03-21T00:00:00+00:00</updated><id>https://aydinnyunus.github.io/2026/03/21/ip-address-classification-inconsistencies-tr</id><author><name>Yunus Aydın</name></author><summary type="html"><![CDATA[IP sınıflandırması diller arasında nasıl değişiyor? Loopback ve özel (private) IP'ler Go, Java, Node.js, PHP, Python ve Ruby'de farklı işlenir; SSRF riski.]]></summary></entry><entry xml:lang="en"><title type="html">Understanding Inconsistencies in IP Address Classification Across Programming Languages</title><link href="https://aydinnyunus.github.io/2026/03/21/ip-address-classification-inconsistencies/" rel="alternate" type="text/html" title="Understanding Inconsistencies in IP Address Classification Across Programming Languages" /><published>2026-03-21T00:00:00+00:00</published><updated>2026-03-21T00:00:00+00:00</updated><id>https://aydinnyunus.github.io/2026/03/21/ip-address-classification-inconsistencies</id><author><name>Yunus Aydın</name></author><summary type="html"><![CDATA[IP address classification inconsistencies across programming languages. Learn how loopback and private IPs are handled differently in Go, Java, Node.js, PHP, Python, and Ruby.]]></summary></entry><entry xml:lang="tr"><title type="html">SSRF Zafiyeti: DNS Rebinding Saldırısı ile Bypass</title><link href="https://aydinnyunus.github.io/2026/03/14/ssrf-dns-rebinding-vulnerability-tr/" rel="alternate" type="text/html" title="SSRF Zafiyeti: DNS Rebinding Saldırısı ile Bypass" /><published>2026-03-14T00:00:00+00:00</published><updated>2026-03-14T00:00:00+00:00</updated><id>https://aydinnyunus.github.io/2026/03/14/ssrf-dns-rebinding-vulnerability-tr</id><author><name>Yunus Aydın</name></author><summary type="html"><![CDATA[CVE-2025-69660: simstudioai/sim SSRF zafiyeti, DNS rebinding ile bypass. TOCTOU ve DNS pinning çözümü.]]></summary></entry></feed>