Статьи Support
🚨 CVE-2026-66428
Unauthenticated Cross Site Request Forgery (CSRF) in WP Google Review Slider <= 18.4 versions.
🚨 CVE-2026-66433
Contributor Cross Site Scripting (XSS) in Location Weather <= 3.0.6 versions.
🚨 CVE-2026-66434
Contributor Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.33 versions.
🚨 CVE-2026-66437
Contributor Server Side Request Forgery (SSRF) in Feedzy <= 5.2.4 versions.
🚨 CVE-2026-66438
Unauthenticated Sensitive Data Exposure in Exclusive Addons Elementor <= 2.8.0 versions.
🚨 CVE-2026-66442
Subscriber Broken Access Control in YayPricing <= 3.5.6 versions.
🚨 CVE-2026-66445
Contributor Cross Site Scripting (XSS) in Open User Map <= 1.4.46 versions.
🚨 CVE-2026-66448
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions.
🚨 CVE-2026-66474
Unauthenticated Cross Site Request Forgery (CSRF) in Insert Headers and Footers Code – HT Script <= 1.1.8 versions.
🚨 CVE-2026-66475
Shop manager Cross Site Scripting (XSS) in Checkout Field Editor for WooCommerce – Checkout Manager <= 3.0.5 versions.
🚨 CVE-2026-66476
Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions.
🚨 CVE-2026-66477
Unauthenticated Broken Access Control in Gillion <= 4.13 versions.
🚨 CVE-2026-16812
VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator...
🚨 CVE-2026-17530
A security flaw has been discovered in AstrBotDevs AstrBot up to 4.25.5. Affected by this vulnerability is the function _build_handoff_toolset of the file AstrBot/astrbot/core/astr_agent_tool_exec.py of the component Subagent. The manipulation results in incorrect authorization...
🚨 CVE-2026-17572
Heap-based buffer overflow in the SOHM list-index deserialization code in HDF5 through 2.1.1 on all platforms allows attackers to cause a denial of service (crash) via a crafted HDF5 file whose shared-message list index declares a num_messages count exceeding list_max...
🚨 CVE-2026-17573
A double free vulnerability was discovered in the HDF5 library. Processing a crafted HDF5 file containing an oversized chunk size field via h5repack may cause the application to abort due to a double free.
🚨 CVE-2026-17574
HDF5 contains a NULL pointer dereference vulnerability. Processing a crafted HDF5 file containing an attribute with an invalid variable-length datatype type field may cause the application to crash when the attribute is read.
🚨 CVE-2026-42792
Improper Handling of Exceptional Conditions vulnerability in Erlang OTP erts (epmd) allows an unauthenticated remote attacker to permanently terminate the Erlang Port Mapper Daemon (epmd) via connection slot exhaustion.
The do_accept function in erts/epmd/src/epmd_srv.c calls...
🚨 CVE-2026-47078
Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive.
zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:check_dir_level/2, which tracks directory depth as...
🚨 CVE-2026-54890
Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation. This vulnerability is associated with program files erts/emulator/beam/external.c...
Защита от мошенничества: Использование посредника минимизирует риски столкнуться с «продавцами-однодневками» или недобросовестными заказчиками, которые исчезают после получения предоплаты или результата работы.