Статьи Support
🚨 CVE-2026-110122
PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other stores' product freight templates via PUT /store/goods/goods/freight. GoodsServiceImpl.freight and GoodsSkuServiceImpl.freight update goods...
🚨 CVE-2026-110127
waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticated members to modify or delete other members' cart items. Attackers can enumerate sequential cart ids via PUT /cart, POST /cart/changeNum...
🚨 CVE-2026-108457
Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network.
🚨 CVE-2026-108460
Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
🚨 CVE-2026-108461
Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-108462
Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally.
🚨 CVE-2026-108463
Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.
🚨 CVE-2026-108465
Use after free in Windows Update Delivery Optimization allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-108466
Out-of-bounds read in Windows Kernel allows an unauthorized attacker to deny service over a network.
🚨 CVE-2026-108468
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-108471
Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-110205
Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed next to * or ? glob characters. Attackers using indirect prompt injection can craft commands like echo *$(...) that match allowlisted...
🚨 CVE-2026-49785
Improper resource shutdown or release in Windows UEFI allows an authorized attacker to bypass a security feature locally.
🚨 CVE-2026-69795
Null pointer dereference in Windows Clipboard Server allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-69798
Use after free in Windows Wired AutoConfig Service allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-69830
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
🚨 CVE-2026-69840
Use after free in Windows Certificates allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-69850
Untrusted pointer dereference in Windows Certificates allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-69856
Use after free in Windows Storage allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-69884
Buffer over-read in Windows GDI allows an authorized attacker to elevate privileges locally.
Автоматический гарант это финансовая безопасность: Покупатель может быть уверен, что его деньги не попадут к продавцу до того, как он получит и проверит товар или услугу. Продавец, в свою очередь, защищен от не оплаты, так как гарант подтверждает наличие средств у покупателя до начала выполнения обязательств.