Статьи Support
🚨 CVE-2026-111135
libfwsi through 20260522 contains a heap out-of-bounds read vulnerability in libfwsi_mtp_volume_values_read_data() that allows attackers to read past buffer bounds via crafted MTP volume shell items. Attackers can embed a 10 to 53 byte shell item with item data size of 44 or...
🚨 CVE-2026-111140
libregf through 20260526 contains a heap out-of-bounds read in libregf_value_item_read_value_data() because it bounds value data size without subtracting the 4-byte old-format cell offset. Attackers can supply a crafted version 1.0/1.1 REGF hive with a value data cell ending...
🚨 CVE-2026-111145
ytnef through 2.1.2 contains a heap out-of-bounds read vulnerability in DecompressRTF() in lib/ytnef.c that never validates uncompressedSize for uncompressed RTF streams. Attackers can supply a crafted winmail.dat TNEF attachment with a malicious PT_BINARY MAPI property to...
🚨 CVE-2026-111155
libTiMidity through 0.2.8 contains a heap out-of-bounds read vulnerability in the SoundFont loader in src/sndfont.c that uses unvalidated sampleId and instrument generator values as table indices. Attackers can supply a crafted .sf2 file loaded through mid_set_soundfont() to...
🚨 CVE-2026-111150
ValleyBell libvgm through commit a6eed945 contains a heap out-of-bounds read vulnerability in the PCM data-block decompressor caused by an unbounded compression-table index. Attackers can supply a crafted .vgm file with a small type 0x7F table and wider compressed values...
🚨 CVE-2026-111160
LightLLM through 1.2.0 contains a denial of service vulnerability that allows unauthenticated attackers to crash the inference worker by supplying the internal pd_kv_trans_params field to the /generate endpoint. Attackers can send a single request whose parameters cause...
🚨 CVE-2026-111165
libmikmod through 3.3.15 contains a global out-of-bounds read vulnerability in the MultiTracker loader MTM_Load() because the module channel count is never clamped. Attackers can supply a crafted .mtm file with a channel count above 32 to read past the static pat array...
🚨 CVE-2026-111170
kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the dataset directory by supplying absolute plot names. Because validate_sub_path() strips leading slashes while pathlib's...
🚨 CVE-2026-111270
libmodplug through 0.8.9.1 contains a heap-based out-of-bounds write in CSoundFile::ReadDSM() in src/load_dsm.cpp because nPat is never checked against MAX_PATTERNS. Attackers can supply a crafted DSM file with over 240 PATT chunks or a wrapping patt_len value to corrupt heap...
🚨 CVE-2026-111275
nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via nifti_image_read() to crash...
🚨 CVE-2026-111281
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an...
🚨 CVE-2026-111313
JobOps through 0.13.1 contains a server-side request forgery vulnerability in the POST /api/manual-jobs/fetch handler that allows authenticated users, or unauthenticated clients in demo mode, to make the server fetch internal destinations. Attackers can supply loopback...
🚨 CVE-2026-111324
rustdesk-api through 2.7 contains an authorization bypass vulnerability that allows unauthenticated attackers to overwrite existing peer records by supplying only a target device ID to POST /api/sysinfo. Attackers can overwrite hostname, username, OS and uuid without uuid...
🚨 CVE-2026-111343
pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users' profiles via GET /admin/user/details/{id}. Low-privilege attackers can enumerate sequential user ids to obtain usernames, real...
🚨 CVE-2026-111348
Likeshop through 3.5.1 contains an insecure direct object reference vulnerability in AfterSale.php and AfterSaleLogic.php that lets authenticated users access other customers' after-sale records by supplying their ids. Attackers with self-registered accounts can call the...
🚨 CVE-2026-111353
Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests to /api/v1/time/new or...
🚨 CVE-2026-111359
CRMEB 5.6.1 through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated storefront users to read and claim other users' orders via the gift-order API. Attackers can enumerate sequential order IDs in gift_detail to harvest buyer identities...
🚨 CVE-2026-111237
A weakness has been identified in Ultralytics FastSAM up to b4ed20c2fed75eadc5aa7d8b09fedd137b873b52. This affects the function session.get_modelmeta.custom_metadata_map of the file ultralytics/nn/autobackend.py of the component AutoBackend Model Loading. This manipulation of...
🚨 CVE-2026-111375
FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles. Attackers can send a full-length WINDOW_ORDER_FIELD_TITLE update...
🚨 CVE-2026-95183
An issue in the context-compaction feature of DeepSeek Harness (dsh) commit c291e796 allows attackers to execute a prompt injection attack via crafted external content.
Защита от мошенничества: Использование посредника минимизирует риски столкнуться с «продавцами-однодневками» или недобросовестными заказчиками, которые исчезают после получения предоплаты или результата работы.