Статьи Support
🚨 CVE-2026-83791
Improper authorization in Windows Virtual Input allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-83792
Incorrect authorization in Windows Device Install Service allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-83793
Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-83842
Double free in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-83843
Out-of-bounds read in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.
🚨 CVE-2026-87707
Heap-based buffer overflow in Windows Fax and Scan Service allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-87708
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-87709
Improper access control in Windows Host Guardian Service allows an authorized attacker to perform tampering locally.
🚨 CVE-2026-88107
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-88113
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-54683
NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. Prior to 3.0.3, both the getDocumentContent GraphQL query and GET...
🚨 CVE-2026-55240
Tianji is an open source analytics, uptime monitoring, and server status platform. Prior to 1.31.29, formatString() in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to lodash template(), while the default evaluate pattern remains...
🚨 CVE-2026-55587
AliasVault is a privacy-first password manager with built-in email aliasing. Prior to 0.29.4, the AliasVault browser extension passkey provider does not bind passkey requests to the actual webpage origin or verify that the requested relying-party identifier matches the current...
🚨 CVE-2026-57183
Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, checkApiAuth() in src/main/java/com/erudika/scoold/utils/ScooldUtils.java accepts a JWT signed with app_secret_key or para_secret_key for /api/config and /api/stats without requiring a registered...
🚨 CVE-2026-62322
Python Social Auth is a social authentication/registration mechanism. Prior to 5.0.2, the LINE backend exchanges an authorization code without validating the returned OAuth state. An attacker can begin authorization for an attacker-controlled LINE account and induce a victim to...
🚨 CVE-2026-112188
MISP contains a vulnerability in its server settings lookup mechanism that allows an authenticated user to retrieve sensitive configuration data that should have been redacted.
The settings lookup function resolves a dotted setting name to a node in the configuration tree...
🚨 CVE-2025-7043
The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition...
🚨 CVE-2026-112407
Incorrect privilege assignment in the IAM policy of AWS CICD-toolchain-for-serverless-applications 1.0.7 through 1.0.10 allows remote authenticated users with push access to the application source repository to escalate privileges and access or modify resources outside the...
🚨 CVE-2026-28763
A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated...
🚨 CVE-2026-33568
A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An attacker can make an authenticated HTTP...
Независимый арбитраж: В случае возникновения споров или несоответствия товара описанию, сервис выступает в качестве арбитра, принимая объективное решение на основе заранее оговоренных условий.