Статьи Support
🚨 CVE-2026-50663
Relative path traversal in Age of Empires II: Definitive Edition Game allows an unauthorized attacker to execute code over a network.
🚨 CVE-2026-54058
Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path, attacker-controlled header words can set a row stride smaller than the natural row width, causing pixel access such as...
🚨 CVE-2026-54432
Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS). The issue occurs because the attachment MIME type is not properly escaped on the attachment-validation warning page.
🚨 CVE-2026-54433
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message. The attacker-controlled JavaScript executes within the victim's authenticated session simply by opening or previewing the message...
🚨 CVE-2026-55011
Integer underflow (wrap or wraparound) in Microsoft Defender allows an unauthorized attacker to execute code locally.
🚨 CVE-2026-55012
Integer overflow or wraparound in Microsoft Defender allows an unauthorized attacker to execute code locally.
🚨 CVE-2026-55014
Improper access control in Windows Remote Help Defense allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-56169
Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
🚨 CVE-2026-56185
Improper authentication in Windows Admin Center allows an authorized attacker to disclose information over a network.
🚨 CVE-2026-57107
Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-57969
Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
🚨 CVE-2026-58279
Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
🚨 CVE-2026-58595
Improper restriction of rendered ui layers or frames in Microsoft Bing App for IOS allows an unauthorized attacker to perform spoofing over a network.
🚨 CVE-2026-58631
Improper authorization in Windows Admin Center allows an authorized attacker to execute code locally.
🚨 CVE-2026-58636
Improper link resolution before file access ('link following') in Window PC Manager allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-58647
Improper neutralization of input during web page generation ('cross-site scripting') in Power BI allows an authorized attacker to perform spoofing over a network.
🚨 CVE-2026-59197
Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before rank-filter size...
🚨 CVE-2026-59200
Pillow is a Python imaging library. From 5.1.0 until 12.3.0, PdfParser.PdfStream.decode() in PIL/PdfParser.py calls zlib.decompress() with bufsize set to the PDF stream Length field without bounding the decompressed output size, allowing a crafted FlateDecode PDF stream to...
🚨 CVE-2026-59888
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because...
🚨 CVE-2026-59891
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.1, getRegistryCredentials() reads credentials from the Docker config file and selects an entry by checking whether any configured auth key contains the target registry string. Because...
Независимый арбитраж: В случае возникновения споров или несоответствия товара описанию, сервис выступает в качестве арбитра, принимая объективное решение на основе заранее оговоренных условий.