Статьи Support
🚨 CVE-2026-116851
Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions.
🚨 CVE-2026-116852
Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.
🚨 CVE-2026-116853
Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions.
🚨 CVE-2026-116854
Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions.
🚨 CVE-2026-116861
Unauthenticated Sensitive Data Exposure in Flexible Chat <= 1.1.0 versions.
🚨 CVE-2026-116862
Unauthenticated Broken Access Control in WP REST Cache <= 2026.3.1 versions.
🚨 CVE-2026-118089
Shop manager PHP Object Injection in Product Feed Manager <= 7.14.1 versions.
🚨 CVE-2026-118090
Subscriber PHP Object Injection in MasterStudy LMS <= 3.7.55 versions.
🚨 CVE-2026-119117
Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application...
🚨 CVE-2026-119526
Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection.
This issue affects Royal Event: from n/a through 2.0.
🚨 CVE-2026-119727
A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation...
🚨 CVE-2026-119728
A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of partially allocated internal...
🚨 CVE-2026-119729
A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded...
🚨 CVE-2026-119842
A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the application to crash when a user opens or plays media with a malformed MicroDVD (.sub) subtitle file.
🚨 CVE-2026-120007
NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submit an empty email at the /register/complete interstitial to clear a victim's...
🚨 CVE-2026-120046
Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service. Attackers can delete their own service via POST /api/v1/batch-delete/service, leaving...
🚨 CVE-2026-27061
Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions.
🚨 CVE-2026-28160
Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.10 versions.
🚨 CVE-2026-39732
Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.
🚨 CVE-2026-39734
Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.
Независимый арбитраж: В случае возникновения споров или несоответствия товара описанию, сервис выступает в качестве арбитра, принимая объективное решение на основе заранее оговоренных условий.