Статьи Support
🚨 CVE-2026-119176
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject' parameter in all versions up to, and including, 1.4.43 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
🚨 CVE-2026-119620
A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This vulnerability affects the function move_uploaded_file of the file admin/add_logs.php. Executing a manipulation of the argument File can lead to unrestricted...
🚨 CVE-2026-119762
Axigen Mail Server before 10.5.69, 10.6.x before 10.6.40, and 10.7.x before 10.7.2 contains an unauthenticated denial of service vulnerability caused by unbounded nesting depth when parsing SOAP/XML and JSON request bodies before authentication. Attackers can send a single...
🚨 CVE-2026-119764
Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows attackers controlling target endpoint files to run JavaScript in the Mythic UI origin by planting HTML in .pdf-named files. When an operator downloads the file and clicks Preview...
🚨 CVE-2026-119979
LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to write files outside the models directory using backslash-separated traversal filenames. Attackers can trick users into downloading a...
🚨 CVE-2026-69446
Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.
🚨 CVE-2026-96894
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Inbound Email Body in all versions up to, and including, 1.17.10 due to insufficient input sanitization and output escaping. This makes it...
🚨 CVE-2026-97638
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.57.3.1 via the 'previous_draft_id' parameter due to missing validation on a user controlled key...
🚨 CVE-2026-9239
The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
🚨 CVE-2026-104674
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31.
🚨 CVE-2026-105077
Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions.
🚨 CVE-2026-107868
Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 versions.
🚨 CVE-2026-114711
Subscriber Cross Site Scripting (XSS) in MultiVendorX <= 5.0.20 versions.
🚨 CVE-2026-115604
Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions.
🚨 CVE-2026-115947
Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.
🚨 CVE-2026-116386
Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions.
🚨 CVE-2026-116401
Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions.
🚨 CVE-2026-116405
Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions.
🚨 CVE-2026-116410
Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions.
🚨 CVE-2026-116847
Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions.
Защита от мошенничества: Использование посредника минимизирует риски столкнуться с «продавцами-однодневками» или недобросовестными заказчиками, которые исчезают после получения предоплаты или результата работы.