СИТУАЦИОННЫЙ ОБЗОР
Все уязвимости
Поиск по CVE, продуктам и источникам. Условия фильтра сохраняются в ссылке.
Лента уязвимостей
30| УЯЗВИМОСТЬ / ПРОДУКТ | ПРИОРИТЕТ | CVSS | EPSS | СИГНАЛЫ | ОПУБЛИКОВАНА | Карточка |
|---|---|---|---|---|---|---|
| CVE-2026-115845 Incomplete validation in the run_script Python sandbox in AWS MCP Server AWS / AWS MCP Server | Средний | 5.3 | 0,31 % | 23.10.2026 | ||
| CVE-2026-96196 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability Microsoft / Microsoft Edge (Chromium-based) | Высокий | 8.8 | 0,77 % | Патч | 29.10.2026 | |
| CVE-2026-108471 Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability Microsoft / Windows 10 Version 1809 · Microsoft / Windows Server 2019 | Высокий | 8.8 | 0,37 % | Патч | 13.10.2026 | |
| CVE-2026-69624 Active Directory Certificate Services (AD CS) Tampering Vulnerability Microsoft / Windows 10 Version 1607 · Microsoft / Windows 10 Version 1809 | Средний | 6.5 | 0,74 % | Патч | 08.09.2026 | |
| CVE-2026-70334 Visual Studio Code Security Feature Bypass Vulnerability Microsoft / Visual Studio Code | Высокий | 7.8 | 0,49 % | Патч | 08.09.2026 | |
| CVE-2026-119567 vsftpd through 3.0.5 cmds_denied Bypass via RFC 775 Command Aliases vsftpd / vsftpd | Низкий | 2.3 | 0,22 % | 30.10.2026 | ||
| CVE-2026-114615 Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys authlib / authlib · authlib | Критический | 9.1 | 0,21 % | PoCПатч | 23.10.2026 | |
| CVE-2026-56777 n8n - AST Validator Bypass in Python Code Node n8n / n8n · n8n | Средний | 5.3 | 0,33 % | 01.07.2026 | ||
| CVE-2026-115751 mcp-from-openapi 2.2.0 before 2.9.0 SSRF blockedHosts Bypass via Trailing-Dot Hostname agentfront / mcp-from-openapi | Высокий | 6.3 | 0,25 % | PoCПатч | 23.10.2026 | |
| CVE-2026-61438 PraisonAI before 4.6.78 Remote Code Execution via Broken AST Sandbox MervinPraison / PraisonAI · praisonai | Критический | 7.0 | 0,31 % | PoCПатч | 15.07.2026 | |
| CVE-2026-67615 openEQUELLA < 2026.1.0 Authenticated RCE via Java Deserialization in HTTP Invoker Apereo Foundation / openEQUELLA | Критический | 8.7 | 0,54 % | PoCПатч | 22.09.2026 | |
| CVE-2026-114728 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypa Roundcube / Webmail · roundcube / webmail | Средний | 5.3 | 0,37 % | Патч | 22.10.2026 | |
| CVE-2026-117530 In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation... JetBrains / Junie CLI | Средний | 6.7 | 0,11 % | 27.10.2026 | ||
| CVE-2026-45741 Gotenberg: SSRF deny-list bypass in IsPublicIP via IPv6 6to4 / NAT64 / site-local prefixes gotenberg / gotenberg | Критический | 7.5 | 0,37 % | PoC | 19.08.2026 | |
| CVE-2026-84370 SVGO: removeScripts allows executable links through namespace and control-character bypasses svg / svgo · svgo | Высокий | 8.2 | 0,53 % | Патч | 01.09.2026 | |
| CVE-2026-34430 ByteDance DeerFlow LocalSandboxProvider Host Bash Escape Bytedance Inc. / DeerFlow · deerflow / deerflow | Высокий | 8.6 | 0,41 % | Патч | 01.04.2026 | |
| CVE-2026-26274 October: Safe Mode Bypass via Twig Database Write Operations octobercms / october | Средний | 6.6 | 0,23 % | 21.04.2026 | ||
| CVE-2026-26067 October: Safe Mode Bypass via CSS Preprocessor Compilers octobercms / october | Средний | 4.9 | 0,25 % | 21.04.2026 | ||
| CVE-2026-41264 Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability FlowiseAI / Flowise · flowiseai / flowise | Критический | 9.2 | 1,79 % | PoC | 23.04.2026 | |
| CVE-2026-41206 PySpector has a Plugin Code Execution Bypass via Incomplete Static Analysis in PluginSecurity.validate_plugin_code ParzivalHack / PySpector · parzivalhack / pyspector | Высокий | 6.9 | 0,19 % | PoCПатч | 23.04.2026 | |
| CVE-2026-40077 Beszel has an IDOR in hub API endpoints that read system ID from URL parameter henrygd / beszel · beszel / beszel | Средний | 3.5 | 0,22 % | PoC | 09.04.2026 | |
| CVE-2026-39315 Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe() unjs / unhead · unhead | Высокий | 6.1 | 0,29 % | PoCПатч | 09.04.2026 | |
| CVE-2026-34415 Xerte Online Toolkits File Upload RCE via elfinder Connector thexerteproject / xerteonlinetoolkits | Критический | 9.3 | 3,58 % | PoCПатч | 22.04.2026 | |
| CVE-2026-34177 VM lowlevel restriction bypass via raw.apparmor and raw.qemu.conf Canonical / lxd · canonical / lxd | Критический | 9.1 | 0,36 % | PoCПатч | 09.04.2026 | |
| CVE-2026-31952 Xibo CMS API has SQL Injection via DataSet Filter Parameter xibosignage / xibo-cms · xibosignage / xibo | Высокий | 8.1 | 0,25 % | Патч | 24.04.2026 | |
| CVE-2026-25525 OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module OpenMage / magento-lts · openmage / magento | Высокий | 4.9 | 0,5 % | PoC | 20.04.2026 | |
| CVE-2026-114729 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypa Roundcube / Webmail | Средний | 5.3 | 0,38 % | Патч | 22.10.2026 | |
| CVE-2026-110205 Roo-Code through 3.54.0 Auto-Approve Bypass via Glob Token Discarding Command Substitution RooCodeInc / Roo-Code · roocode / roo_code | Критический | 7.7 | 0,51 % | PoC | 13.10.2026 | |
| CVE-2026-41934 Vvveb < 1.0.8.2 Authenticated RCE via Code Editor givanz / Vvveb | Высокий | 8.7 | 0,55 % | Патч | 06.05.2026 | |
| CVE-2026-116339 iFlytek astron-agent DDL Whitelist exec_ddl.py incomplete blacklist iFlytek / astron-agent | Высокий | 6.9 | 0,48 % | PoC | 26.10.2026 |
Информация справочная. Применимость и автоматические рекомендации проверяйте по первичному бюллетеню.