СИТУАЦИОННЫЙ ОБЗОР
Все уязвимости
Поиск по CVE, продуктам и источникам. Условия фильтра сохраняются в ссылке.
Лента уязвимостей
30| УЯЗВИМОСТЬ / ПРОДУКТ | ПРИОРИТЕТ | CVSS | EPSS | СИГНАЛЫ | ОПУБЛИКОВАНА | Карточка |
|---|---|---|---|---|---|---|
| CVE-2026-62057 WordPress Divi Contact Form 7 plugin <= 4.1.0 - Content Injection vulnerability Fahim Reza / Divi Contact Form 7 | Средний | 5.3 | 0,3 % | 30.10.2026 | ||
| CVE-2026-52710 WordPress GIFTiT – Free Gifts for WooCommerce plugin <= 4.5 - Content Injection vulnerability ithemelandco / GIFTiT – Free Gifts for WooCommerce | Средний | 5.3 | 0,3 % | 30.10.2026 | ||
| CVE-2026-42694 WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerability Themeum / Kirki | Средний | 4.3 | 0,17 % | 29.10.2026 | ||
| CVE-2026-119479 WordPress JetFormBuilder plugin <= 3.6.7.1 - Content Injection vulnerability Crocoblock / JetFormBuilder | Средний | 5.3 | 0,31 % | 30.10.2026 | ||
| CVE-2026-48202 WordPress Brave plugin <= 0.8.8 - Content Injection vulnerability Brave / Brave | Средний | 5.3 | 0,29 % | 29.10.2026 | ||
| CVE-2026-25467 WordPress User Registration plugin <= 5.3.0 - Content Injection vulnerability ThemeGrill / User Registration | Средний | 5.3 | 0,27 % | 29.10.2026 | ||
| CVE-2026-116402 WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerability Brainstorm Force / SureForms | Средний | 5.3 | 0,3 % | 29.10.2026 | ||
| CVE-2026-10511 Jupiter X Core <= 4.61.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'forget_password_link' Parameter artbees / Jupiter X Core | Средний | 6.4 | 0,19 % | 27.10.2026 | ||
| CVE-2026-112945 Vite: Cross origin script execution through Vite custom middleware vitejs / vite · vitejs / vite-plus | Средний | 2.1 | 0,67 % | PoC | 20.10.2026 | |
| CVE-2026-39425 MaxKB: Stored XSS via Unsanitized html_rander Tags in Markdown Rendering 1Panel-dev / MaxKB · maxkb / maxkb | Средний | 5.1 | 0,18 % | 14.04.2026 | ||
| CVE-2026-20170 A vulnerability in the Desktop Agent functionality of Cisco Webex Contact Center could have allowed Cisco / Cisco Webex Contact Center · cisco / webex_contact_center | Средний | 6.1 | 0,22 % | 15.04.2026 | ||
| CVE-2026-40875 mailcow: dockerized vulnerable to stored XSS in user login history real_rip mailcow / mailcow-dockerized | Критический | 7.0 | 0,24 % | PoC | 21.04.2026 | |
| CVE-2026-40873 mailcow: dockerized vulnerable to stored XSS in Quarantine attachment filenames mailcow / mailcow-dockerized | Критический | 8.9 | 0,42 % | PoC | 21.04.2026 | |
| CVE-2026-40872 mailcow: dockerized vulnerable to stored XSS in autodiscover logs email address field mailcow / mailcow-dockerized | Критический | 9.3 | 0,36 % | PoC | 21.04.2026 | |
| CVE-2026-40105 XWiki has Reflected Cross-Site Scripting (XSS) in its page history compare functionality xwiki / xwiki-platform · xwiki / xwiki | Средний | 6.5 | 0,55 % | Патч | 15.04.2026 | |
| CVE-2026-39941 ChurchCRM has an XSS vulnerability ChurchCRM / CRM · churchcrm / churchcrm | Высокий | 5.3 | 0,26 % | PoCПатч | 09.04.2026 | |
| CVE-2026-1564 Pega Platform versions 8.1.0 through 25.1.1 are affected by an HTML Injection vulnerability in a user interface component. Requires a high privileged user with a developer role. Pegasystems / Pega Infinity · pega / pega_platform | Средний | 5.1 | 0,19 % | 16.04.2026 | ||
| CVE-2026-44264 Weblate is vulnerable to XSS via crafted Markdown WeblateOrg / weblate · weblate / weblate | Средний | 4.3 | 0,28 % | Патч | 07.05.2026 | |
| CVE-2026-116394 WordPress WpEvently plugin <= 5.7.9 - Content Injection vulnerability Magepeople inc. / WpEvently | Средний | 5.3 | 0,3 % | 26.10.2026 | ||
| CVE-2026-41611 Visual Studio Code Remote Code Execution Vulnerability Microsoft / Visual Studio Code · microsoft / visual_studio_code | Высокий | 7.8 | 0,42 % | Патч | 12.05.2026 | |
| CVE-2026-44259 efw4.X: Stored XSS via previewServlet efwGrp / efw4.X | Высокий | 4.6 | 0,17 % | PoC | 13.05.2026 | |
| CVE-2026-4418 IBM Cloud Pak System HTML Injection IBM / Cloud Pak System | Средний | 5.4 | 0,17 % | Патч | 19.10.2026 | |
| CVE-2026-108925 Cohesity - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Cohesity / NetBackup Administration Console web interface | Средний | 6.1 | 0,21 % | 11.10.2026 | ||
| CVE-2026-106163 Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser Progress Software / Kendo UI for jQuery | Средний | 6.5 | 0,18 % | 15.10.2026 | ||
| CVE-2026-106162 Cross-Site Scripting in FileManager Drag Hints in Kendo UI for jQuery Progress Software / Kendo UI for jQuery | Средний | 4.7 | 0,14 % | 15.10.2026 | ||
| CVE-2026-106157 Cross-Site Scripting via PanelBar Item URLs in Kendo UI for jQuery Progress Software / Kendo UI for jQuery | Средний | 4.7 | 0,17 % | 15.10.2026 | ||
| CVE-2026-106158 Cross-Site Scripting via Scheduler Resource Colors in Kendo UI for jQuery Progress Software / Kendo UI for jQuery | Средний | 4.7 | 0,17 % | 15.10.2026 | ||
| CVE-2026-106159 Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo UI for jQuery Progress Software / Kendo UI for jQuery | Средний | 4.7 | 0,17 % | 15.10.2026 | ||
| CVE-2026-106161 Cross-Site Scripting via Badge Text Binding in Kendo UI for jQuery Progress Software / Kendo UI for jQuery | Средний | 5.4 | 0,18 % | 15.10.2026 | ||
| CVE-2026-106139 Cross-Site Scripting via Chart Tooltip in Kendo UI for Vue Progress Software / Kendo UI for Vue | Средний | 5.4 | 0,13 % | 10.10.2026 |
Информация справочная. Применимость и автоматические рекомендации проверяйте по первичному бюллетеню.