Статьи Support
🚨 CVE-2026-106148
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL can inject additional HTML attributes...
🚨 CVE-2026-106157
In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional...
🚨 CVE-2026-106158
In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted event wrapper attributes without proper encoding. An attacker who can control a resource color can inject additional HTML...
🚨 CVE-2026-106159
In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization. An attacker who can control a button URL can supply an otherwise allowed HTTPS...
🚨 CVE-2026-106160
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths containing __proto__, constructor, or prototype. An attacker who can supply data accepted by an affected model can...
🚨 CVE-2026-106161
In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including values supplied through text binding. An attacker who can modify data bound to a Badge can supply...
🚨 CVE-2026-106162
In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names as HTML in its default drag hint even though the corresponding list items are encoded. An attacker who can control an...
🚨 CVE-2026-106163
In Progress® Kendo® UI for jQuery versions starting with v2023.1.117 and prior to v2026.3.1015, the FileBrowser and ImageBrowser components render remotely supplied file and directory names as HTML without proper encoding. An attacker-controlled name containing script-related...
🚨 CVE-2026-106149
In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript...
🚨 CVE-2026-106151
In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from data-msg-* attributes and parses the resulting text as HTML. An attacker who can modify a validation message can cause HTML that was...
🚨 CVE-2026-106153
In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML attribute encoding. An attacker with low privileges who can control the URL option...
🚨 CVE-2026-108116
In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.
🚨 CVE-2026-55453
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr()...
🚨 CVE-2026-55467
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to...
🚨 CVE-2026-55480
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without O_EXCL...
🚨 CVE-2026-57488
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, raw_to_int in upnp/src/genlib/net/http/httpparser.c parses Content-Length with strtol and casts the resulting long to a 32-bit int before the caller stores it as unsigned int. On LP64...
🚨 CVE-2026-77630
pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parse_hostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parse_uri is processing attacker-supplied hostnames from inbound HTTP request targets in...
🚨 CVE-2026-111946
Plack::Middleware::ETag versions from 0.04 before 0.06 for Perl disclose file inode numbers in the default ETag header.
When the response body is a filehandle and the file_etag option is not set, the ETag is built from the file's inode number, modification time and size...
🚨 CVE-2026-112300
A vulnerability was identified in DiffSK configobj up to 5.0.9. Affected by this vulnerability is the function _sectionmarker of the file configobj/__init__.py. The manipulation leads to inefficient regular expression complexity. Remote exploitation of the attack is possible...
🚨 CVE-2026-112301
A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php. The manipulation of the argument fontFile results in os command injection. The attack can be executed remotely. The...
Защита от мошенничества: Использование посредника минимизирует риски столкнуться с «продавцами-однодневками» или недобросовестными заказчиками, которые исчезают после получения предоплаты или результата работы.