Статьи Support
🚨 CVE-2026-22110
The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting.
🚨 CVE-2026-22114
HTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace is exhaustible.
🚨 CVE-2026-85268
A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase Authentication versions prior to 2026-08-14 on iOS allows an unauthenticated remote attacker to execute arbitrary JavaScript using a malicious iOS bundle ID.
🚨 CVE-2026-110681
Cpanel::JSON::XS versions before 4.80 for Perl use the parent interpreter's scalars from a parser object cloned into a new ithread.
A parser object holds its callbacks and its incremental parse buffer as raw scalar pointers. When a thread is created, these are copied into the...
🚨 CVE-2026-86413
When using an *ambient user* in a first transfer doing Negotiate
authentication and asked to follow redirects, curl could pass on its
credential details to an unrelated second origin when asked to redirect there.
🚨 CVE-2026-86414
An HTTP proxy can trick libcurl into sending the origin's credentials (Basic
password, or a Negotiate/Kerberos ticket) to the proxy itself, by answering
the `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the
expected 407 `Proxy-Authenticate:`.
🚨 CVE-2026-86415
libcurl's connection cache match function never considers the automatic client
certificate option, so a cached, already authenticated Schannel connection can
be handed to a transfer that got redirected to a different origin, even though
the code explicitly switched off the auto...
🚨 CVE-2026-87861
When using ambient user credentials, an HTTP request directed to one origin
may be dispatched over a connection previously authenticated via Negotiate for
a different origin, leaving the request's intended credentials unused.
🚨 CVE-2026-87862
Importing a `includeSubDomains` parent HSTS entry before a longer-lived child
entry, silently drops the child. Consequently, when the parent expires, the
child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP
requests rather than upgrading to HTTPS.
🚨 CVE-2026-87863
An authenticated HTTPS origin can supply an HSTS `max-age` value that the
parser accepts, but time serialization later fails to process. On 64-bit
systems, extreme max-age values compute an absolute expiry within standard
time integer limits that exceeds calendar time structure...
🚨 CVE-2026-87864
Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in
the `IMAP APPEND {N}` literal while transmitting line-ending expanded data.
The server reads only $N$ bytes for the payload, causing the remaining
overflow bytes to be interpreted and executed as...
🚨 CVE-2026-87865
When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated
initial entry can cause host key validation to report a key *mismatch* as a
*missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback.
🚨 CVE-2025-68391
ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to arbitrary file upload. Any user is able to upload arbitrary file and override existing files in a temporary folder. This vulnerability might lead to execution of embedded JavaScript scripts when an authenticated...
🚨 CVE-2025-68392
ARKETEAM Protectel modules PROTECTELMAJ and BDF allow low privileged users to use some of the functionalities reserved for admin users by forging direct requests to a specific endpoint.
This issue has been fixed in: PROTECTELMAJ v6.5.19 and BDF v6.4.67
🚨 CVE-2025-68393
ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user into "Utilisateur" parameter allows for SQL Injection attacks.
This issue has been fixed in: PROTECTELMAJ v6.5.19 and...
🚨 CVE-2025-68394
ARKETEAM Protectel modules PROTECTELMAJ and BDF are vulnerable to SQL injection vulnerability. Improper neutralization of input provided by a low privileged user into "profilInput" parameter allows for SQL Injection attacks.
This issue has been fixed in: PROTECTELMAJ v6.5.19 and...
🚨 CVE-2025-68395
ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored XSS. A low privileged attacker can inject arbitrary HTML and JS into notes, which will be rendered/executed when a user visits this module.
This issue has been fixed in...
🚨 CVE-2026-101209
Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Server-Side Request Forgery (SSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure.
🚨 CVE-2026-101210
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to...
🚨 CVE-2026-101213
Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Privilege Management vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges.
Автоматический гарант это финансовая безопасность: Покупатель может быть уверен, что его деньги не попадут к продавцу до того, как он получит и проверит товар или услугу. Продавец, в свою очередь, защищен от не оплаты, так как гарант подтверждает наличие средств у покупателя до начала выполнения обязательств.