Статьи Support
🚨 CVE-2026-112337
Wazuh from 3.7.0 before 4.14.9 contains a server-side request forgery vulnerability in the Azure wodle get_graph_events() function that follows @odata.nextLink without host or HTTPS validation. Attackers who influence the nextLink value can redirect manager requests to...
🚨 CVE-2026-112338
Wazuh from 4.3.0 before 4.14.9 contains a server-side request forgery vulnerability in the GitHub module (wm_github.c) that trusts unvalidated Link rel="next" pagination URLs. Attackers controlling the next-page URL can make the manager send requests with the GitHub API token...
🚨 CVE-2026-112339
Wazuh from 3.9.0 before 4.14.9 contains a missing TLS hostname verification vulnerability in the fluent-forward module's wm_fluent_ssl_ctx() that allows network attackers to impersonate the Fluentd collector by presenting any certificate chaining to the configured ca_file...
🚨 CVE-2026-112340
Wazuh dashboard plugins from 4.9.0 before 4.14.9 contain an authorization bypass vulnerability that allows authenticated dashboard users to override the Manager API Authorization header via the /api/request proxy endpoint. Attackers can supply nested body.headers.Authorization...
🚨 CVE-2026-112341
Wazuh versions from 4.0.0 before 4.14.9 contain a sql injection vulnerability in WazuhDBBackend._substitute_params due to sequential regex placeholder cross-contamination. Authenticated users with agent:read on one agent can inject UNION SELECT via the q and search parameters...
🚨 CVE-2026-123488
Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an unauthenticated SQL injection vulnerability in the element search endpoint because the attribute parameter is concatenated into the query unsanitized and emulated PDO prepares allow stacked statements. Remote...
🚨 CVE-2026-123489
Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains a blind SQL injection vulnerability because the sandbox-exposed getNext() and getPrev() methods pass arbitrary criteria arrays to Craft::configure() without removing SQL-bearing properties such as orderBy and where...
🚨 CVE-2026-123490
Craft CMS from 5.8.17 before 5.11.2 contains a privilege escalation vulnerability because getOwners() applies caller criteria without cleansing the query configuration. Authenticated control panel users can invoke attacker-selected static PHP callables via crafted criteria to...
🚨 CVE-2026-123491
Craft CMS 4.0.0 before 4.18.9 and 5.0.0 before 5.11.2 contains an SQL injection vulnerability in GraphQL eager-loading: arguments on eager-loadable nodes absent from the public schema are copied into EagerLoadPlan criteria without cleansing. Unauthenticated attackers can supply...
🚨 CVE-2026-123833
In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projects
🚨 CVE-2026-123834
In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account
🚨 CVE-2026-123835
In JetBrains Datalore before 2026.4 code execution was possible in another user's computation via an init script upload race condition
🚨 CVE-2026-123836
In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backup
🚨 CVE-2026-123837
In JetBrains IntelliJ IDEA before 2026.3,
2026.2.1 command injection was possible in untrusted projects via Tomcat run configurations on WSL
🚨 CVE-2026-123838
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible in Safe Mode via UI Designer form file
🚨 CVE-2026-123839
In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote Development port forwarding model
🚨 CVE-2026-123840
In JetBrains IntelliJ IDEA before 2026.3 hTML injection was possible in Remote Development editor tabs
🚨 CVE-2026-123841
In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via symlinks in an imported settings archive
🚨 CVE-2026-123843
In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration
🚨 CVE-2026-123844
In JetBrains IntelliJ IDEA before 2026.3 sSRF was possible via custom plugin repositories
Независимый арбитраж: В случае возникновения споров или несоответствия товара описанию, сервис выступает в качестве арбитра, принимая объективное решение на основе заранее оговоренных условий.