СИТУАЦИОННЫЙ ОБЗОР
Все уязвимости
Поиск по CVE, продуктам и источникам. Условия фильтра сохраняются в ссылке.
Лента уязвимостей
30| УЯЗВИМОСТЬ / ПРОДУКТ | ПРИОРИТЕТ | CVSS | EPSS | СИГНАЛЫ | ОПУБЛИКОВАНА | Карточка |
|---|---|---|---|---|---|---|
| CVE-2026-70175 ASP.NET Core Elevation of Privilege Vulnerability Microsoft / ASP.NET Core 10.0 · Microsoft / ASP.NET Core 8.0 | Высокий | 8.1 | 0,73 % | Патч | 13.10.2026 | |
| CVE-2026-72772 n8n before 2.32.1 Authentication Bypass via Token Exchange n8n-io / n8n · n8n / n8n | Высокий | 8.9 | 0,45 % | 11.08.2026 | ||
| CVE-2026-58202 OpenReception: Confirmation-email links built from the request Host enable pending-account takeover via `POST /api/auth/resend-confirmation` open-reception / appointment-booking-software | Критический | 8.3 | 0,24 % | PoC | 23.10.2026 | |
| CVE-2026-119127 ZITADEL 4.0.0 before 4.19.5 Account Takeover via Login V2 Host Header Injection zitadel / zitadel | Высокий | 8.6 | 0,28 % | 29.10.2026 | ||
| CVE-2026-115973 FaveoSuite Faveo Helpdesk ForgotPasswordController.php reset password recovery FaveoSuite / Faveo Helpdesk | Высокий | 6.9 | 0,28 % | PoC | 24.10.2026 | |
| CVE-2026-46347 Goobi viewer: Predictable Replacement Password Allows Account Takeover After Password Reset intranda / goobi-viewer-core | Средний | 6.8 | 0,25 % | 23.10.2026 | ||
| CVE-2026-86055 Part-DB: Password Reset Link Poisoning via Host Header Injection leads to pre-authentication Account Takeover Part-DB / Part-DB-server | Критический | 8.7 | 0,59 % | PoC | 23.10.2026 | |
| CVE-2026-63159 Omnispace Agora Project < 26.10.0 Predictable Password-Reset Token Account Takeover Omnispace / Agora Project | Критический | 9.1 | 0,33 % | Патч | 13.10.2026 | |
| CVE-2026-7554 D-Link M60 httpd password recovery D-Link / M60 · dlink / m60_firmware | Высокий | 6.3 | 1,1 % | PoC | 01.05.2026 | |
| CVE-2026-40585 blueprintUE: Password Reset Tokens Have No Expiry Window blueprintue / blueprintue-self-hosted-edition | Критический | 7.4 | 0,26 % | PoC | 21.04.2026 | |
| CVE-2026-34751 Payload has Unvalidated Input in Password Recovery Endpoints payloadcms / payload · payload | Критический | 9.1 | 0,31 % | 01.04.2026 | ||
| CVE-2026-33707 Weak Password Recovery Mechanism for Forgotten Password in chamilo/chamilo-lms chamilo / chamilo-lms · chamilo / chamilo_lms | Критический | 9.8 | 0,43 % | Патч | 10.04.2026 | |
| CVE-2026-116214 MacCMS v10 before 2026.1000.4054 Account Takeover via Unbound Password Recovery Code maccmspro / maccms10 · magicblack / maccms10 | Критический | 9.3 | 0,46 % | Патч | 26.10.2026 | |
| CVE-2026-94380 Host Header Injection in HAVELSAN's Liman MYS HAVELSAN Inc. / Liman MYS | Высокий | 8.1 | 0,32 % | 26.10.2026 | ||
| CVE-2026-35676 phpMyFAQ - Unauthenticated Password Reset via User Password Update Endpoint thorsten / phpMyFAQ | Критический | 8.8 | 0,3 % | PoC | 28.05.2026 | |
| CVE-2026-46346 Goobi viewer: Predictable Password Reset Token Allows Unauthorized Password Reset intranda / goobi-viewer-core | Средний | 6.5 | 0,33 % | 23.10.2026 | ||
| CVE-2026-18963 Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass Red Hat / Red Hat build of Keycloak 26.4 · Red Hat / Red Hat build of Keycloak 26.4.15 | Критический | 9.1 | 4,68 % | 18.08.2026 | ||
| CVE-2026-43845 A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication Advantech / ADAM-3600 | Критический | 9.2 | 0,45 % | 20.10.2026 | ||
| CVE-2026-112035 aircheng-org iWebShop-5 simple.php send_message_mobile password recovery aircheng-org / iWebShop-5 | Высокий | 5.3 | 0,35 % | PoC | 19.10.2026 | |
| CVE-2026-109204 LogicalDOC Community Edition through 9.3 Forced Password Reset via Unbound PswRecovery Ticket LogicalDOC / LogicalDOC Community Edition | Средний | 5.3 | 0,2 % | Патч | 12.10.2026 | |
| CVE-2026-108337 Password Reset Code Accessible in User Listing API Hitachi Vantara / Remot Ops Agent | Высокий | 7.4 | 0,28 % | 15.10.2026 | ||
| CVE-2026-16437 An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz Mitsubishi Electric Corporation / GENESIS · Mitsubishi Electric Iconics Digital Solutions / GENESIS | Высокий | 7.1 | 0,09 % | 15.10.2026 | ||
| CVE-2026-16436 An authentication bypass vulnerability in GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz Mitsubishi Electric Corporation / GENESIS · Mitsubishi Electric Iconics Digital Solutions / GENESIS | Критический | 9.2 | 0,32 % | 15.10.2026 | ||
| CVE-2026-108335 Password Reset Functionality Missing Brute-Force Protection Hitachi Vantara / Remote Ops Agent | Критический | 9.1 | 0,24 % | 15.10.2026 | ||
| CVE-2026-53997 Netherman Portal del Hermano Account Takeover via Password Reset Oracle NetHerman / Portal del Hermano (portaldelhermano.es) | Критический | 9.1 | 0,4 % | 12.10.2026 | ||
| CVE-2026-108737 Traccar through 6.16.0 Weak Password Recovery via TokenManager Token Purpose Confusion Traccar / Traccar | Критический | 7.6 | 0,32 % | PoC | 11.10.2026 | |
| CVE-2026-107640 Integrics Enswitch 3.13 through 4.4 Authentication Bypass via Password Reset API Integrics / Enswitch | Критический | 9.3 | 0,36 % | PoC | 08.10.2026 | |
| CVE-2026-80196 Kimai before 2.58.0 Authentication Bypass via Password Reset Link kimai / kimai | Критический | 8.7 | 0,48 % | PoC | 26.08.2026 | |
| CVE-2026-50635 LimeSurvey Password Reset Host Header Injection Discloses Reset Token LimeSurvey / LimeSurvey | Высокий | 8.7 | 0,37 % | 09.06.2026 | ||
| CVE-2026-19218 Password Reset Code Brute Force Leading to Account Takeover in AKIN Software's MyRezzta AKIN Software Computer Import-Export Industry and Trade Co. Ltd. / MyRezzta | Критический | 9.1 | 0,23 % | 08.10.2026 |
Информация справочная. Применимость и автоматические рекомендации проверяйте по первичному бюллетеню.