Статьи Support
🚨 CVE-2026-100220
Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute code over a network.
🚨 CVE-2026-100222
Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
🚨 CVE-2026-100225
Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-102186
Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally.
🚨 CVE-2026-64959
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin...
🚨 CVE-2026-111713
tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a...
🚨 CVE-2026-111723
LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the...
🚨 CVE-2026-111999
Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the...
🚨 CVE-2026-112004
Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users to rename folders in other bases by supplying a foreign folderId. The PATCH /api/base/:baseId/node/folder/:folderId endpoint checks base|update only against...
🚨 CVE-2026-112014
LobsterAI before 2026.10.16 contains a hardcoded password vulnerability that allows attackers to decrypt exported provider API keys encrypted with the constant 'lobsterai-APP'. Attackers who obtain a providers export file can derive the AES-GCM key via PBKDF2 using the embedded...
🚨 CVE-2026-112048
libspatialite through 5.1.0 fails to validate the polygon ring count in ParseWkbPolygon, allowing attackers to trigger uncontrolled interior-ring allocation via crafted geometry BLOBs. Attackers can supply a crafted polygon in a SpatiaLite database or ST_GeomFromWKB input to...
🚨 CVE-2026-100200
Use after free in Windows Update Service allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-100201
Heap-based buffer overflow in Windows Client License Service allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-100202
Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.
🚨 CVE-2026-100203
Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-100215
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.
🚨 CVE-2026-100216
Stack-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-100217
Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-100218
Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
🚨 CVE-2026-100219
Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
Независимый арбитраж: В случае возникновения споров или несоответствия товара описанию, сервис выступает в качестве арбитра, принимая объективное решение на основе заранее оговоренных условий.