СИТУАЦИОННЫЙ ОБЗОР
Все уязвимости
Поиск по CVE, продуктам и источникам. Условия фильтра сохраняются в ссылке.
Лента уязвимостей
29| УЯЗВИМОСТЬ / ПРОДУКТ | ПРИОРИТЕТ | CVSS | EPSS | СИГНАЛЫ | ОПУБЛИКОВАНА | Карточка |
|---|---|---|---|---|---|---|
| CVE-2026-105008 Windows Schannel Spoofing Vulnerability Microsoft / Windows 10 Version 1607 · Microsoft / Windows 10 Version 1809 | Критический | 9.0 | 0,66 % | Патч | 13.10.2026 | |
| CVE-2026-40217 LiteLLM has a sandbox escape in custom-code guardrail BerriAI / LiteLLM · Red Hat / Red Hat Ansible Automation Platform 2.6 | Критический | 8.8 | 15,53 % | PoC | 10.04.2026 | |
| CVE-2026-40435 BIG-IP httpd access control vulnerability F5 / BIG-IP · f5 / big-ip_access_policy_manager | Средний | 6.9 | 0,23 % | Патч | 13.05.2026 | |
| CVE-2025-53967 figma-developer-mcp vulnerable to command injection in get_figma_data tool Framelink / Figma MCP Server · figma-developer-mcp | Высокий | 8.0 | 6,12 % | 08.10.2025 | ||
| CVE-2026-102134 Kiteworks Core Unprotected Alternate Channel Kiteworks / Core | Средний | 5.4 | 0,21 % | 30.09.2026 | ||
| CVE-2026-61909 An issue was discovered in Cyrus IMAP before 3.12.4. CalDAV/CardDAV multiget bypasses a per-href ACL cyrusimap / Cyrus IMAP | Низкий | 3.5 | 0,2 % | 09.09.2026 | ||
| CVE-2026-77639 Tor before 0.4.9.9 was prone to a compression bomb bypass where an attacker could concatenate many g torproject / Tor | Средний | 5.3 | 0,39 % | 20.08.2026 | ||
| CVE-2025-67303 ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420) n/a / n/a · comfyui-manager | Высокий | 7.5 | 1,39 % | 05.01.2026 | ||
| CVE-2026-43505 An issue was discovered in Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5, when mod_pr Prosody / Prosody | Средний | 6.5 | 0,2 % | 01.05.2026 | ||
| CVE-2024-4444 LearnPress – WordPress LMS Plugin <= 4.2.6.5 - Unauthenticated Bypass to User Registration thimpress / LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | Средний | 5.3 | 0,71 % | 10.05.2024 | ||
| CVE-2024-6099 LearnPress – WordPress LMS Plugin <= 4.2.6.8.1 - Unauthenticated Bypass to User Registration thimpress / LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · thimpress / learnpress | Средний | 5.3 | 0,42 % | 02.07.2024 | ||
| CVE-2026-35388 OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions. OpenBSD / OpenSSH | Низкий | 2.5 | 0,13 % | 02.04.2026 | ||
| CVE-2025-1095 IBM Personal Communications command execution IBM / Personal Communications | Высокий | 8.8 | 0,15 % | Патч | 08.04.2025 | |
| CVE-2026-25916 Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not Roundcube / Webmail | Средний | 4.3 | 0,76 % | 09.02.2026 | ||
| CVE-2025-41727 Beckhoff: Performing privileged operations and gaining administrator access Beckhoff Automation / Beckhoff.Device.Manager.XAR · Beckhoff Automation / MDP software package for TwinCAT/BSD | Высокий | 7.8 | 0,18 % | 27.01.2026 | ||
| CVE-2025-62001 BullWall Ransomware Containment hard-coded folder exclusions BullWall / Ransomware Containment | Высокий | 8.7 | 0,35 % | 18.12.2025 | ||
| CVE-2025-56558 The Dyson MQTT server (2022 and possibly later) allows publications and subscriptions by a client th Dyson / MQTT server | Низкий | 3.0 | 0,38 % | 29.10.2025 | ||
| CVE-2025-66432 In Oxide control plane 15 through 17 before 17.1, API tokens can be renewed past their expiration da Oxide / Omicron | Средний | 5.0 | 0,24 % | 30.11.2025 | ||
| CVE-2025-13315 Unauthenticated log access in Twonky Server Lynxtechnology / Twonky Server | Критический | 9.3 | 31,18 % | 19.11.2025 | ||
| CVE-2025-59033 The Microsoft vulnerable driver block list is implemented as Windows Defender Application Control (W Microsoft / Windows | Высокий | 7.4 | 0,29 % | 08.09.2025 | ||
| CVE-2024-10081 codechecker vulnerable to authentication bypass when using specifically crafted URLs Ericsson / CodeChecker · ericsson / codechecker | Критический | 10.0 | 39,92 % | 06.11.2024 | ||
| CVE-2025-62820 Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source I Slack / Nebula | Средний | 4.9 | 0,22 % | 23.10.2025 | ||
| CVE-2025-54309 CrushFTP Unprotected Alternate Channel Vulnerability CrushFTP / CrushFTP | Критический | 9.0 | 93,47 % | KEV | 18.07.2025 | |
| CVE-2024-6242 Rockwell Automation Chassis Restrictions Bypass Vulnerability in Select Logix Devices Rockwell Automation / ControlLogix® 5580 (1756-L8z) · Rockwell Automation / GuardLogix® 5580 (1756-L8zS) | Критический | 7.3 | 11,1 % | 01.08.2024 | ||
| CVE-2025-8557 An internal product security audit of Lenovo XClarity Orchestrator (LXCO) discovered the below vulne Lenovo / XClarity Orchestrator (LXCO) | Высокий | 8.7 | 0,26 % | 11.09.2025 | ||
| CVE-2025-54351 In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in re ES / iperf3 | Высокий | 8.9 | 0,44 % | 03.08.2025 | ||
| CVE-2025-52968 xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can freedesktop / xdg-utils | Низкий | 2.7 | 0,21 % | 23.06.2025 | ||
| CVE-2025-52921 In Innoshop through 0.4.1, an authenticated attacker could exploit the File Manager functions in the InnoShop / InnoShop | Критический | 9.9 | 0,54 % | 23.06.2025 | ||
| CVE-2024-8038 Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsibl Canonical Ltd. / Juju | Высокий | 7.9 | 0,21 % | 02.10.2024 |
Информация справочная. Применимость и автоматические рекомендации проверяйте по первичному бюллетеню.