Статьи Support
🚨 CVE-2026-62298
mouse07410/asn1c is an ASN.1 compiler. Prior to 1.2.5, `OPEN TYPE` decoding can dereference an unallocated member pointer and crash the consuming program. `OPEN_TYPE_aper_get` in `OPEN_TYPE_aper.c`, `OPEN_TYPE_ber_get` in `OPEN_TYPE_ber.c`, `OPEN_TYPE_oer_get` in...
🚨 CVE-2026-62303
Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, `SegmentTreeNode::sanitizeResource()` in `src/server/router.cc` uses `std::regex_replace()` with the `//+` expression to collapse consecutive slashes. With libstdc++, a path containing tens of...
🚨 CVE-2026-62331
praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI. Prior to 0.9.1, both Telegram upload sites in `internal/telegram/bot.go` concatenate the attacker-controlled document filename into a destination path...
🚨 CVE-2026-73186
Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.
🚨 CVE-2026-73322
Incorrect Authorization vulnerability in the single-stage query engine of Apache Pinot.
When broker access control is enabled, the single-stage query engine authorizes only the table named in the query's FROM clause. The lookup() transform function identifies its dimension...
🚨 CVE-2026-78527
Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.
🚨 CVE-2026-7003
WIT SynApps Runtime through 1.4.11 contains a hardcoded credentials vulnerability that allows unauthenticated attackers to recover static OAuth clientId and clientSecret values embedded in JavaScript delivered to the frontend, such as in parameters.js. Attackers can extract these...
🚨 CVE-2026-7004
WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter to the /System/Session-1 endpoint. Attackers...
🚨 CVE-2026-7005
WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows attackers to supply an arbitrary target address during controller onboarding, causing the victim's browser to issue discovery requests to attacker-specified hosts...
🚨 CVE-2026-90888
Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.
🚨 CVE-2026-94175
Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.
🚨 CVE-2026-81627
A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset D_LCK protection...
🚨 CVE-2026-100517
Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30.
🚨 CVE-2026-109763
Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.
🚨 CVE-2026-95117
Buffer Overflow vulnerability in zserge jsmn jsmn HEAD 25647e6 allows a remote attacker to cause a denial of service via the jsmn.h, jsmn_parse(), example/jsondump.c, dump() components
🚨 CVE-2026-85919
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-88081
Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network.
🚨 CVE-2026-88082
Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-88083
Stack-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network.
🚨 CVE-2026-88084
Allocation of resources without limits or throttling in SQL Server allows an authorized attacker to deny service over a network.
Независимый арбитраж: В случае возникновения споров или несоответствия товара описанию, сервис выступает в качестве арбитра, принимая объективное решение на основе заранее оговоренных условий.