Статьи Support
🚨 CVE-2026-123832
In JetBrains CLion before 2026.2 code execution was possible in Safe Mode via JSON compilation database
🚨 CVE-2026-123837
In JetBrains IntelliJ IDEA before 2026.3,
2026.2.1 command injection was possible in untrusted projects via Tomcat run configurations on WSL
🚨 CVE-2026-123838
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file
🚨 CVE-2026-123841
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive
🚨 CVE-2026-123847
In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completion
🚨 CVE-2026-123848
In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates
🚨 CVE-2026-123849
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in untrusted projects via the Terraform File Watchers
🚨 CVE-2026-123853
In JetBrains IntelliJ IDEA before 2026.3,
2026.2.2 code execution was possible in Safe Mode via project-controlled JVM options of the build process
🚨 CVE-2026-123855
In JetBrains Toolbox App before 3.6.1 command injection was possible via enterprise configuration URLs
🚨 CVE-2026-107155
A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.
🚨 CVE-2026-19868
An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).
🚨 CVE-2026-17362
IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to create, modify, or delete tenants due to missing authorization.
🚨 CVE-2026-105002
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow arbitrary code to be executed by the management service in certain non-default configurations due to improper control of generation of code. Customization content may be evaluated as code...
🚨 CVE-2026-105459
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow an attacker to gain unauthorized access to an organization due to improper verification of a cryptographic signature. A token is accepted without its signature being fully verified, which could...
🚨 CVE-2026-108178
IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a token to be accepted that should be rejected due to an improperly implemented security check. Under certain conditions, token validation is incomplete, so a token may be accepted for a...
🚨 CVE-2026-110534
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 4.5.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
🚨 CVE-2026-110705
The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.16. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...
🚨 CVE-2026-119167
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes...
🚨 CVE-2026-120043
The Affiliate Program Suite — SliceWP Affiliates plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and including, 1.2.14 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on...
🚨 CVE-2026-120477
The Stop Spammers Classic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' POST parameter in versions up to, and including, 2026.6. An unauthenticated POST handled on init stores the attacker-supplied author field (after sanitize_text_field...
Независимый арбитраж: В случае возникновения споров или несоответствия товара описанию, сервис выступает в качестве арбитра, принимая объективное решение на основе заранее оговоренных условий.