CVE Уведомления

Мониторинг уязвимостей, аналитика угроз и оперативные CVE-оповещения. База данных актуальных уязвимостей (Common Vulnerabilities and Exposures) с подробным описанием рисков, оценкой критичности по шкале CVSS и официальными рекомендациями по устранению.

  • CVE-2026-55464

    🚨 CVE-2026-55464 Snipe-IT is an IT asset/license management system. Prior to 8.6.2, CommonMark escapes raw HTML but does not sanitize javascript...

  • CVE-2026-55474

    🚨 CVE-2026-55474 Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route...

  • CVE-2026-55476

    🚨 CVE-2026-55476 Snipe-IT is an IT asset/license management system. Prior to 8.6.0, POST...

  • CVE-2026-55478

    🚨 CVE-2026-55478 Snipe-IT is an IT asset/license management system. Prior to 8.6.2, POST /api/v1/kits/{kit_id}/licenses checks whether the caller...

  • CVE-2026-55516

    🚨 CVE-2026-55516 Snipe-IT is an IT asset/license management system. Prior to 8.6.2, PATCH or PUT /api/v1/maintenances/{maintenance_id} checks...

  • CVE-2026-55843

    🚨 CVE-2026-55843 Snipe-IT is an IT asset/license management system. Prior to 8.6.0, UsersController::update() passes a missing permission request...

  • CVE-2026-59151

    🚨 CVE-2026-59151 Prowler is a cloud security platform. Prior to 5.30.3, Prowler's SAML authentication flow trusted the email domain asserted in a...

  • CVE-2026-5801

    🚨 CVE-2026-5801 Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Semtek Informatics Software...

  • CVE-2026-61459

    🚨 CVE-2026-61459 MCP Server Kubernetes before 3.9.0 contains an argument injection vulnerability in structured tools (kubectl_get...

  • CVE-2026-61460

    🚨 CVE-2026-61460 Krayin CRM through 2.2.3 contains an insecure direct object reference vulnerability in LeadController, PersonController...

  • CVE-2026-61461

    🚨 CVE-2026-61461 Dify before 1.16.0-rc1 contains a SQL injection vulnerability in the MyScale vector store backend that allows attackers to...

  • CVE-2026-6212

    🚨 CVE-2026-6212 Authorization bypass through User-Controlled key vulnerability in Teracity Software Technologies Inc. TeraMIS allows Privilege...

  • CVE-2026-11321

    🚨 CVE-2026-11321 The DataInjection plugin for GLPI 2.15.6 (GLPI 11 builds) concatenates user-supplied CSV field values directly into SQL queries...

  • CVE-2026-54714

    🚨 CVE-2026-54714 Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, @logto/core reflected the SAML...

  • CVE-2026-55370

    🚨 CVE-2026-55370 Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's existing TOTP verification...

  • CVE-2026-55377

    🚨 CVE-2026-55377 Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 1.41.0, Logto's Account Center step-up check...

  • CVE-2026-55452

    🚨 CVE-2026-55452 Snipe-IT is an IT asset/license management system. Prior to 8.5.0, Actionlog::logaction() stores the request User-Agent header...

  • CVE-2026-55461

    🚨 CVE-2026-55461 Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the user edit flow stores url()->previous() from the...

Статистика статей

Статьи
53,092
Просмотры
273,024
Независимый арбитраж: В случае возникновения споров или несоответствия товара описанию, сервис выступает в качестве арбитра, принимая объективное решение на основе заранее оговоренных условий.
Назад
Сверху