СИТУАЦИОННЫЙ ОБЗОР
Все уязвимости
Поиск по CVE, продуктам и источникам. Условия фильтра сохраняются в ссылке.
Лента уязвимостей
30| УЯЗВИМОСТЬ / ПРОДУКТ | ПРИОРИТЕТ | CVSS | EPSS | СИГНАЛЫ | ОПУБЛИКОВАНА | Карточка |
|---|---|---|---|---|---|---|
| CVE-2026-116825 YesWiki from 4.6.2 before 4.7.0 HTTP Signature Replay via ActivityPub Inbox YesWiki / yeswiki | Критический | 8.3 | 0,23 % | PoC | 27.10.2026 | |
| CVE-2026-84003 Microsoft Authentication Library (MSAL) for Node.js Spoofing Vulnerability Microsoft / Microsoft Authentication Library | Высокий | 7.4 | 0,6 % | Патч | 08.09.2026 | |
| CVE-2026-69676 Windows Kerberos Remote Code Execution Vulnerability Microsoft / Windows 10 Version 1607 · Microsoft / Windows 10 Version 1809 | Высокий | 8.8 | 0,78 % | Патч | 08.09.2026 | |
| CVE-2026-103314 Stackrox: stackrox: saml response replay allows multiple central authentication tokens Red Hat / Red Hat Advanced Cluster Security for Kubernetes 4.10 · Red Hat / Red Hat Advanced Cluster Security for Kubernetes 4.11 | Высокий | 7.4 | 0,41 % | 19.10.2026 | ||
| CVE-2026-89209 A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), M Siemens / Mendix SAML (Mendix 10 compatible) · Siemens / Mendix SAML (Mendix 11 compatible) | Высокий | 7.6 | 0,26 % | 26.10.2026 | ||
| CVE-2026-65824 OpenReception: invite confirmation token is replayable within its validity window and re-issues a registration-bootstrap cookie open-reception / appointment-booking-software | Высокий | 7.4 | 0,25 % | 23.10.2026 | ||
| CVE-2026-62911 Microsoft Exchange Server Elevation of Privilege Vulnerability Microsoft / Microsoft Exchange Server 2016 Cumulative Update 23 · Microsoft / Microsoft Exchange Server 2019 Cumulative Update 14 | Критический | 8.0 | 0,69 % | PoCПатч | 11.08.2026 | |
| CVE-2026-114617 Authlib: ID token can disable its own nonce validation via the nonce_supported claim authlib / authlib · authlib | Высокий | 4.2 | 0,27 % | PoCПатч | 23.10.2026 | |
| CVE-2026-116201 Snipe-IT before 8.5.0 SAML Assertion Replay via Race Condition grokability / snipe-it · snipeitapp / snipe-it | Высокий | 8.7 | 0,3 % | 25.10.2026 | ||
| CVE-2026-100834 http4k before 6.48.0.0 Digest Authentication Replay Protection Bypass http4k / http4k | Высокий | 8.2 | 0,32 % | Патч | 27.09.2026 | |
| CVE-2026-37982 Keycloak: org.keycloak.authentication: keycloak: unauthorized account takeover via webauthn token replay Red Hat / Red Hat build of Keycloak 26.4 · Red Hat / Red Hat build of Keycloak 26.4.12 | Средний | 6.8 | 0,44 % | 19.05.2026 | ||
| CVE-2026-104381 Fireware OS Missing Authentication in FireCluster State Sync Allows BOVPN Tunnel Denial of Service WatchGuard / Fireware OS | Средний | 6.0 | 0,13 % | 27.10.2026 | ||
| CVE-2025-61480 An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically n/a / n/a | Высокий | 7.5 | 0,18 % | 26.08.2026 | ||
| CVE-2025-61479 An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically n/a / n/a | Высокий | 7.5 | 0,43 % | 26.08.2026 | ||
| CVE-2026-41020 Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated... Eaton / easyE4 | Высокий | 7.5 | 0,23 % | 27.10.2026 | ||
| CVE-2026-117470 WebAuthn assertion replay permits second-factor bypass in Psono Server esaqa GmbH / Psono | Средний | 6.5 | 0,41 % | Патч | 27.10.2026 | |
| CVE-2026-27855 Dovecot OTP authentication is vulnerable to replay attack under specific conditions. If auth cache i Open-Xchange GmbH / OX Dovecot Pro · dovecot / dovecot | Средний | 6.8 | 0,32 % | 27.03.2026 | ||
| CVE-2026-42602 azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay open-telemetry / opentelemetry-collector-contrib · opentelemetry / opentelemetry_collector_contrib | Критический | 8.1 | 0,22 % | PoC | 13.05.2026 | |
| CVE-2026-87952 SAML SSO - Service Provider - Moderately critical - Insufficient replay protection - SA-CONTRIB-2026-150 Drupal / SAML SSO - Service Provider | Низкий | 3.1 | 0,22 % | 22.10.2026 | ||
| CVE-2026-55167 LDAP Account Manager: WebAuthn authentication challenge is kept in the PHP session LDAPAccountManager / lam | Средний | 4.2 | 0,21 % | 14.10.2026 | ||
| CVE-2026-92120 Apache Allura: Oauth1 Replay Attack Apache Software Foundation / Apache Allura | Критический | 9.1 | 0,27 % | 12.10.2026 | ||
| CVE-2026-12655 1732E ArmorBlock® - Multiple Vulnerabilities Rockwell Automation / 1732E ArmorBlock® I/O | Высокий | 8.8 | 0,27 % | 13.10.2026 | ||
| CVE-2026-104105 FileRise: TOTP codes are not single-use — valid 6-digit code can be replayed within its window (capture-replay) error311 / FileRise | Высокий | 6.4 | 0,27 % | PoC | 14.10.2026 | |
| CVE-2026-89070 MOVEit Transfer OIDC Authentication Replay Vulnerability Progress / MOVEit Transfer | Высокий | 7.5 | 0,44 % | 14.10.2026 | ||
| CVE-2026-72780 Craft CMS before 5.10.5 WebAuthn Assertion Replay via login-with-passkey craftcms / cms | Высокий | 7.1 | 0,39 % | 11.08.2026 | ||
| CVE-2026-9226 Authentication bypass in the Azure AD external login flow in Devolutions Server 2026.3.7.0 and earli Devolutions / Server | Средний | 6.8 | 0,21 % | 06.10.2026 | ||
| CVE-2026-105485 Authentication bypass OAuth device authorization flow in Devolutions Server 2026.3.7.0 and earlier a Devolutions / Server | Средний | 6.8 | 0,4 % | 06.10.2026 | ||
| CVE-2026-73636 Apache HTTP Server: mod_auth_digest one-time-nonce replay attack Apache Software Foundation / Apache HTTP Server | Высокий | 8.1 | 0,4 % | 01.10.2026 | ||
| CVE-2026-103655 MISP TOTP Code Replay Allows Duplicate Authentication Within Validity Period MISP / MISP | Критический | 9.3 | 0,39 % | Патч | 01.10.2026 | |
| CVE-2026-73312 XenForo < 2.3.13 Refresh Token Replay via Expired Access Token XenForo / XenForo | Критический | 9.1 | 0,47 % | PoCПатч | 08.09.2026 |
Информация справочная. Применимость и автоматические рекомендации проверяйте по первичному бюллетеню.