Статьи Support
🚨 CVE-2026-43851
A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system.
🚨 CVE-2026-43852
A vulnerability could allow an authenticated attacker to write files to arbitrary locations on the system.
🚨 CVE-2026-43853
A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash.
🚨 CVE-2026-43854
A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices.
🚨 CVE-2026-43855
A heap-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.
🚨 CVE-2026-43856
A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated attacker to achieve arbitrary code execution via a path longer than 1024 bytes.
🚨 CVE-2026-43857
A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the service.
🚨 CVE-2026-43858
A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution.
🚨 CVE-2026-107597
PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the OIDC discovery document of an allowlisted issuer and then follows the `jwks_uri` contained in that response without parsing it as a URL, comparing it against the approved issuer's origin, or requiring HTTPS...
🚨 CVE-2026-108062
Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated request stalls the whole service.
🚨 CVE-2026-108086
** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Cocoon.
This issue affects Apache Cocoon: all versions. XEE in the fp: form processor could lead to SSRF, including exposing files...
🚨 CVE-2026-108087
** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Cocoon.
This issue affects Apache Cocoon: all versions.
Missing input sanitation would allow arbitrary SQL injection through the...
🚨 CVE-2026-108088
** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user application, cached values for one user could be used when serving content for other users.
This issue affects Apache Cocoon...
🚨 CVE-2026-108089
** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of (verbose) debug logging and...
🚨 CVE-2026-113383
A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This affects an unknown part of the file /v5.0/webapps/pages/public/Login. Performing a manipulation of the argument tz results in cross site scripting. Remote exploitation of the attack is possible. The vendor was...
🚨 CVE-2026-113384
A flaw has been found in Optimal IdM OptimalCloud 5.0. This vulnerability affects unknown code of the file /v5.0/social. Executing a manipulation of the argument state can lead to open redirect. The attack can be executed remotely. The vendor was contacted early about this...
🚨 CVE-2026-9589
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities...
🚨 CVE-2026-113385
A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the file ToggleGeneric.java. The manipulation of the argument Class leads to improper export of android application components. Local access is...
🚨 CVE-2026-113388
A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argument...
🚨 CVE-2026-113389
A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectiontype results in command injection. The...
Независимый арбитраж: В случае возникновения споров или несоответствия товара описанию, сервис выступает в качестве арбитра, принимая объективное решение на основе заранее оговоренных условий.