Статьи Support
🚨 CVE-2026-104309
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.
🚨 CVE-2026-104316
IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to cancel any victim's running background workflow job by sending a single HTTP request, resulting in loss of in-progress compute work with no flow-level permission check.
🚨 CVE-2026-104339
IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.
🚨 CVE-2026-107042
Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows unauthorized attackers to move or overwrite files in another user's private storage via supplying a crafted content URI.
🚨 CVE-2026-108494
Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 versions.
🚨 CVE-2026-110193
IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker with a low-privileged authenticated account to cause the Agentic Assistant to generate or submit component code using these unblocked patterns, resulting in arbitrary operating system command execution on the...
🚨 CVE-2026-110309
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code generation.
🚨 CVE-2026-116868
Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions.
🚨 CVE-2026-118076
Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions.
🚨 CVE-2026-118081
Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions.
🚨 CVE-2026-18894
IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component code in a public workflow, executing it under the flow owner's runtime context within the server process. This bypasses the intended trust boundary where public...
🚨 CVE-2026-42692
Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions.
🚨 CVE-2026-54859
Unauthenticated PHP Object Injection in Preservation <= 1.15 versions.
🚨 CVE-2026-61988
Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site <= 8.4.0 versions.
🚨 CVE-2026-61995
Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions.
🚨 CVE-2026-62002
Unauthenticated PHP Object Injection in Meals & Wheels <= 1.1.13 versions.
🚨 CVE-2026-62013
Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.
🚨 CVE-2026-62018
Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.
🚨 CVE-2026-107047
Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data.
🚨 CVE-2026-107052
Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily reead files outside of the sandbox via providing an absolute path.
Автоматический гарант это финансовая безопасность: Покупатель может быть уверен, что его деньги не попадут к продавцу до того, как он получит и проверит товар или услугу. Продавец, в свою очередь, защищен от не оплаты, так как гарант подтверждает наличие средств у покупателя до начала выполнения обязательств.