Статьи Support
🚨 CVE-2026-8147
In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any authenticated user to bypass experiment-level authorization controls on all trace operations, including reading, deleting...
🚨 CVE-2026-9563
In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consumed while parsing a single JSON document. Applications that parse attacker- controlled JSON can be forced to consume...
🚨 CVE-2026-13369
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attach_files() function in versions up to, and including, 3.3.29. This is due to the get_files_for_attachment() function accepting a raw attacker-controlled 'files' array when the...
🚨 CVE-2026-14336
PIA's OIDC issuer allowlist for Jenkins tokens uses a bare string-prefix check (issuer.startswith(' https://ci.eclipse.org ') in is_issuer_known, pia/models.py:139) instead of validating the issuer as a properly host-bounded URL. An attacker can craft an issuer such as...
🚨 CVE-2026-8441
The WP Review Slider Pro plugin for WordPress is vulnerable to SQL Injection via the 'notinstring' parameter of the wprp_load_more_revs AJAX action in versions up to, and including, 12.7.2. The parameter is read via $_POST['notinstring'] and passed through sanitize_text_field() —...
🚨 CVE-2026-54430
liboauth2 is vulnerable to Server-Side Request Forgery in oauth2_jose_jwks_aws_alb_resolve() function. The AWS ALB verifier reads both signer and kid from the unverified JWT
header. If signer matches the configured ARN, kid is appended to
alb_base_url without URL encoding or...
🚨 CVE-2026-54431
In liboauth2 the Demonstrating Proof-of-Possession (DPoP) verifier accepts a proof whose JSON Web Key (jwk) header contains private key material. RFC 9449 section 4.3 step 7 requires the verifier to reject such a proof but oauth2_token_verify() function returns success for a...
🚨 CVE-2026-11946
An unauthenticated remote attacker can exhaust
server memory via the GetEndpoints Discovery Service in open62541. The
endpointUrl field of GetEndpointsRequest is not validated for length. An
attacker can declare an arbitrarily large string (up to ~4.09 GB via the UInt32
length...
🚨 CVE-2026-27060
Deserialization of Untrusted Data vulnerability in Repute Infosystems ARMember Premium allows Object Injection.
This issue affects ARMember Premium: from n/a before 7.6.
🚨 CVE-2026-27402
Unauthenticated Cross Site Scripting (XSS) in Kids Life | Children School WordPress <= 5.2 versions.
🚨 CVE-2026-27404
Unauthenticated Cross Site Scripting (XSS) in LMS <= 9.7 versions.
🚨 CVE-2026-27408
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imithemes NativeChurch nativechurch allows Reflected XSS.This issue affects NativeChurch: from n/a before 4.9.5.
🚨 CVE-2026-27412
Unauthenticated Local File Inclusion in Pearl - Corporate Business <= 3.4.10 versions.
🚨 CVE-2026-27414
Contributor PHP Object Injection in Werkstatt <= 4.8.3 versions.
🚨 CVE-2026-27419
Subscriber Arbitrary File Upload in Zegen <= 1.1.9 versions.
🚨 CVE-2026-27425
Unauthenticated Cross Site Scripting (XSS) in Automotive Listings <= 18.6 versions.
🚨 CVE-2026-27426
Unauthenticated Cross Site Scripting (XSS) in Automotive Car Dealership Business <= 13.3.3 versions.
🚨 CVE-2026-27430
Unauthenticated Cross Site Scripting (XSS) in TheFox <= 3.9.76 versions.
🚨 CVE-2026-27433
Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a before 5.6.85.
🚨 CVE-2026-27436
Editor Arbitrary Code Execution in Five Star Business Profile and Schema <= 2.3.19 versions.
Защита от мошенничества: Использование посредника минимизирует риски столкнуться с «продавцами-однодневками» или недобросовестными заказчиками, которые исчезают после получения предоплаты или результата работы.