Статьи Support
🚨 CVE-2026-61953
Unauthenticated Server Side Request Forgery (SSRF) in Simple Link Directory Pro <= 15.0.6 versions.
🚨 CVE-2026-61957
Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions.
🚨 CVE-2026-65438
Unauthenticated Cross Site Scripting (XSS) in Message Filter for Contact Form 7 <= 1.6.3.9 versions.
🚨 CVE-2026-65439
Unauthenticated Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <=3.5.45 versions.
🚨 CVE-2026-65440
Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions.
🚨 CVE-2026-65441
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions.
🚨 CVE-2026-65442
Unauthenticated Server Side Request Forgery (SSRF) in FormCraft <= 3.9.15 versions.
🚨 CVE-2026-65443
Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions.
🚨 CVE-2026-65445
Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions.
🚨 CVE-2026-65446
Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions.
🚨 CVE-2026-66473
Unauthenticated Broken Access Control in Xendit Payment <= 7.1.0 versions.
🚨 CVE-2026-11756
A Deserialization of Untrusted Data vulnerability affecting Station Launcher App in 3DEXPERIENCE platform from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2026x could lead to an unauthenticated remote code execution.
🚨 CVE-2026-55977
Successful exploitation of this vulnerability
could allow an attacker with local network access to bypass the application's
rate-limiting mechanism, enabling brute-forcing of the screen-sharing code and
potentially displaying harmful content on the affected screen.
🚨 CVE-2026-9680
Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpoint listening on all network interfaces by default.
🚨 CVE-2026-16462
In PROCON-WEB SCADA the endpoint 'GetGridData' is not properly sanitized. This allows a remote unauthenticated attacker to execute arbitrary SQL commands.
🚨 CVE-2026-58246
SAP NetWeaver Application Server for ABAP and ABAP Platform writes sensitive session identifier information into a diagnostic trace when the trace is activated by a privileged user. An attacker with access to the resulting trace data could obtain identifiers that allow...
🚨 CVE-2026-59248
Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service.
The HPACK and QPACK prefixed-integer decoder...
🚨 CVE-2026-65624
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1.
The HTTP/1.1 handler in cowboy_http enforces the max_headers limit by counting the number of...
🚨 CVE-2026-18028
The "quick setup" view presented to users after they first create an
event allows to set up the most critical parts of an event in just a few
clicks. This view did not properly check that the user has permission
to change configuration for the given event. An attacker could...
🚨 CVE-2026-18029
Our payment integration with GiroCheckout did not properly validate
payment status responses. An attacker could use a successful payment
status response from one payment and supply it to the system for a
different payment, gaining access to multiple valid tickets with only...
Независимый арбитраж: В случае возникновения споров или несоответствия товара описанию, сервис выступает в качестве арбитра, принимая объективное решение на основе заранее оговоренных условий.