Свежие уязвимости · Страница 166

CVE-2026-88941

Kaspersky has fixed a vulnerability in the Network Agent for Windows module of Kaspersky Security Center. The vulnerability could potentially cause the Network Agent module of Kaspersky Security Center to malfunction. There are no evidence of the vulnerability exploitation in-the-wild.

Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow

A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper causes an integer underflow during buffer length calculation, resulting in an out-of-bounds memory read. An attacker capable of supplying crafted input can trigger this flaw, potentially causing an application crash and resulting in a Denial of Service (DoS).

• Обновитесь до 0.105-33ubuntu0.2
• Обновитесь до 124-2ubuntu1.24.04.4
• Обновитесь до 127-2ubuntu1.1

Reflected Cross-Site Scripting in ICT Innovations’ PHP-CGI/PHP-FPM configuration

A cross-site scripting (XSS) vulnerability in the ICTBroadcast software, which affects the demo environment. The vulnerability is found in the ‘login.php’ endpoint, where the ‘editForm[extension_username]’ parameter is reflected in the response without proper filtering. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the victim’s browser once the victim accesses the malicious URL.

Security update for 389-ds

This update for 389-ds fixes the following issues: - CVE-2026-11770: pre-auth LDAP filter injection in CleanAllRUV status check (bsc#1273133). - CVE-2026-18355: heap buffer overflow in the SASL I/O layer allows a remote authenticated attacker to cause a denial of service or potentially achieve remote code execution (bsc#1279864). - CVE-2026-18453: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (bsc#1279572). - CVE-2026-18922: stale identity carried in a Cyrus SASL auxiliary property during SASL PLAIN authentication allows unauthenticated attackers to achieve privilege escal

• Обновитесь до 2.2.11~git12.1e612cde2-150500.3.54.1

Security update for rust-keylime

This update for rust-keylime fixes the following issue: - CVE-2026-115905: zip: security control bypass via parser differential between central directory and local headers (bsc#1287921) - CVE-2026-115906: zip: authentication bypass in AES encrypted entries due to improper HMAC verification (bsc#1287921) - CVE-2026-115907: zip: denial of service via unbounded memory allocation in legacy decoders (bsc#1287921) - CVE-2026-115908: zip: path traversal via lexical symlink validation during extraction (bsc#1287921) - CVE-2026-115909: zip: denial of service via uncontrolled memory allocation on symlink targets (bsc#1287921) Changes for rust-keyli

• Обновитесь до 0.2.10+12-150500.3.22.1

Security update for rust-keylime

This update for rust-keylime fixes the following issue: - CVE-2026-115905: zip: security control bypass via parser differential between central directory and local headers (bsc#1287921) - CVE-2026-115906: zip: authentication bypass in AES encrypted entries due to improper HMAC verification (bsc#1287921) - CVE-2026-115907: zip: denial of service via unbounded memory allocation in legacy decoders (bsc#1287921) - CVE-2026-115908: zip: path traversal via lexical symlink validation during extraction (bsc#1287921) - CVE-2026-115909: zip: denial of service via uncontrolled memory allocation on symlink targets (bsc#1287921) Changes for rust-keyli

• Обновитесь до 0.2.10+12-150400.3.22.1

SQL Injection Vulnerability in Radius Xenia M2M Platform

This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the password recovery functionality in the web management interface. An unauthenticated remote attacker could exploit this vulnerability by supplying crafted SQL query through input fields to the targeted system.  Successful exploitation of this vulnerability could allow the attacker to gain unauthorized access to sensitive information, enumerate database structure or modify database records on the targeted system.

Security update for 389-ds

This update for 389-ds fixes the following issues: - CVE-2026-11770: pre-auth LDAP filter injection in CleanAllRUV status check (bsc#1273133). - CVE-2026-18355: heap buffer overflow in the SASL I/O layer allows a remote authenticated attacker to cause a denial of service or potentially achieve remote code execution (bsc#1279864). - CVE-2026-18453: pre-authentication NULL pointer dereference via paged results and USE_ONE_BACKEND control in op_shared_search (bsc#1279572). - CVE-2026-18922: stale identity carried in a Cyrus SASL auxiliary property during SASL PLAIN authentication allows unauthenticated attackers to achieve privilege escal

• Обновитесь до 2.2.11~git12.1e612cde2-150600.8.38.1

Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 153.6.0 ESR (MFSA 2026-112, MFSA 2026-120, bsc#1286385): - CVE-2026-100801: Privilege escalation in the DLL Services component. - CVE-2026-113470: Cryptographic issue in the Security Block-lists, Allow-lists, and other State component (bsc#1286261). - CVE-2026-117860: Same-origin policy bypass in the DOM: Navigation component. - CVE-2026-117861: Sandbox escape in the DOM: Navigation component. - CVE-2026-117862: Privilege escalation due to incorrect boundary conditions in the Networking component. - CVE-2026-117863: Information disclosure

• Обновитесь до 153.6.0-118.19.2

Security update for libapr1, libtcnative-1-0, tomcat

This update for libapr1, libtcnative-1-0, tomcat fixes the following issues: - CVE-2026-73581: OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs when certificate uses a keystore (bsc#1282631). - CVE-2026-74048: Cryptographic policy bypass via FIPS activation failure (bsc#1286502). - CVE-2026-74049: Jasper JSTL <c:redirect> plug-in implementation omits page abort (bsc#1286555). - CVE-2026-75973: improper authentication when Jakarta authentication is configured with `SimpleAuthConfigProvider` (bsc#1282630). - CVE-2026-76183: security constraints for any WebSocket endpoint can be bypassed (bsc#1282629). - CVE-2026-77756: inconsistent

• Обновитесь до 1.3.9-3.9.1
• Обновитесь до 1.6.5-4.13.1
• Обновитесь до 9.0.123-3.182.2

XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+

XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application resource prefix when Jetty 12 or later decodes the request path. The affected lookup is replaced with Environment.getResourceAsStream(String, String), which constrains a resource to its expected prefix. An unauthenticated remote attacker can use the vulnerable behavior to read arbitrary resources permitted to the Jetty process, including WEB-INF/xwiki.cfg and, depending on deployment depth and operating-system permissions, hos

Check & Log Email < 2.0.15 - Admin+ SQL Injection via d and s Parameters

The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks.

• Обновитесь до 2.0.15

eXtplorer<= 2.1.14 - Authentication Bypass & Remote Code Execution (RCE)

eXtplorer 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without a password by manipulating the login request. Attackers can exploit this flaw to upload malicious PHP files and execute remote commands on the vulnerable file management system.

Contact Form by Supsystic < 1.11.1 - Unauthenticated CRLF / Email Header Injection via Reply-To Field Mapping

The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted field values before concatenating them into outgoing email headers when a form is configured to map a submitted field into its Reply-To, From or Cc header, allowing unauthenticated users to inject arbitrary email headers such as additional Bcc or Cc recipients into the notification email.

• Обновитесь до 1.11.1

ESX insufficient logging vulnerability

VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged.

• Обновитесь до 5.2.4

Hard-coded Cryptographic Key #2

An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: HBS 3 Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.1.563 and later

• Обновитесь до 26.4.1.563

Hard-coded Cryptographic Key #1

An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid Backup Sync. If exploited, the vulnerability could allow remote attackers to compromise the security of the system. We have already fixed the vulnerability in the following version: HBS 3 Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.0.521 and later Hybrid Backup Sync 26.4.1.563 and later

• Обновитесь до 26.4.1.563

CVE-2025-48595

In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-2598

A flaw was found in the fixed buffer registration code for io_uring (io_sqe_buffer_register in io_uring/rsrc.c) in the Linux kernel that allows out-of-bounds access to physical memory beyond the end of the buffer. This flaw enables full local privilege escalation.

ScadaBR Authenticated Remote Code Execution

Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complete system compromise as commands are executed as root.