Статьи Support
🚨 CVE-2026-87897
A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT authentication token for another user when...
🚨 CVE-2026-108304
Tanium addressed a local privilege escalation vulnerability in End-User Notifications.
🚨 CVE-2026-108309
Tanium addressed an uncontrolled resource consumption vulnerability in Performance Client Extension.
🚨 CVE-2026-108313
Tanium addressed an incorrect privilege assignment vulnerability in Tanium Server.
🚨 CVE-2026-116647
Tanium addressed an improper output sanitization vulnerability in Comply.
🚨 CVE-2026-116649
Tanium addressed an improper output sanitization vulnerability in Enforce.
🚨 CVE-2026-116658
Tanium addressed a denial of service vulnerability in Enforce.
🚨 CVE-2026-116660
Tanium addressed an improper access controls vulnerability in Enforce.
🚨 CVE-2026-118131
GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL) inheritance on the C:\ProgramData directory allows members of the BUILTIN\Users group to create arbitrary subdirectories under this path. An attacker with...
🚨 CVE-2026-16491
Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder.
This...
🚨 CVE-2026-87086
Tanium addressed a denial of service vulnerability in Provision.
🚨 CVE-2026-116247
When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one could not be found, pgAdmin left the parameter out of the connection and libpq fell back to the defaults of the operating-system account running pgAdmin...
🚨 CVE-2026-49912
In multiple functions of MediaCarouselController.kt, there is a possible way for media to show up after disablement due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed...
🚨 CVE-2026-55292
In rw_ci_data_cback of rw_ci.cc, there is a possible memory safety issue due to integer underflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
🚨 CVE-2026-58814
In parseContentType of PduParser.java, there is a possible denial of service due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
🚨 CVE-2026-58949
In parseMetaData of StagefrightMetadataRetriever.cpp, there is a possible denial of service due to a stack buffer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
🚨 CVE-2026-90628
An uncontrolled memory access in the PDF export code of Apache OpenOffice versions through 4.1.16 allows a crafted CFF font to cause a stack overflow problem, causing program crash or memory corruption, or even running other code.
Users are recommended to upgrade to version...
🚨 CVE-2026-90629
An uncontrolled memory access in the WMF import code of Apache OpenOffice versions through 4.1.16 allows a crafted WMF file to cause an invalid memory access, causing program crash or memory corruption.
Users are recommended to upgrade to version 4.1.17, which fixes this issue.
🚨 CVE-2026-121964
FreeRDP before 3.32.2 contains a heap-based buffer overflow in the RD Gateway RPC client, where rpc_client_recv_fragment writes BIND_ACK and ALTER_CONTEXT_RESP fragments into a persistent PDU stream after checking only total capacity rather than remaining capacity from the...
🚨 CVE-2026-121927
A vulnerability has been found in InfiniFlow RAGFlow up to 0.27.3. Affected by this issue is the function _account_get of the file common/data_source/seafile_connector.py of the component Seafile Connector. Such manipulation of the argument seafile_url leads to server-side...
Независимый арбитраж: В случае возникновения споров или несоответствия товара описанию, сервис выступает в качестве арбитра, принимая объективное решение на основе заранее оговоренных условий.