Свежие уязвимости · Страница 63

Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary commands due to improper control of code generation.

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

• Обновитесь до 154.0.4258.37

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

• Обновитесь до 154.0.4258.37

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

• Обновитесь до 154.0.4258.37

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

• Обновитесь до 154.0.4258.37

Improper certificate validation in Szafir

Szafir accepts any client or server certificate without performing certificate and hostname validation, allowing HTTPS connections without authenticating the remote server. An attacker can provide an arbitrary SSL/TLS certificate and cause the application to download an update file from their server. This issue was fixed in version 2.0 build 708.

Path Traversal in Szafir

Szafir is vulnerable to Path Traversal in the uploaded filename. A man-in-the-middle attacker who can reroute update request to their server can prepare arbitrary XML file that will be saved in location chosen by attacker.  This issue was fixed in version 2.0 build 708.

XML External Entity injection in Szafir and Szafir Weryfikująca

Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injection. When a user signs or verify a crafted XML file containing a `DOCTYPE` with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem. This issue was fixed in Szafir version 2.0 build 708. Szafir Weryfikująca is no longer supported (End of Life) and has not been fixed.

WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.This issue affects Kirki: from n/a through 6.4.0.

• Обновитесь до 6.4.1

WordPress Document Library Lite plugin <= 1.3.0 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve Embedded Sensitive Data.This issue affects Document Library Lite: from n/a through 1.3.0.

• Обновитесь до 1.3.1

WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Innovations The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Stored XSS.This issue affects The Plus Addons for Elementor Page Builder Lite: from n/a through 6.5.3.

• Обновитесь до 6.6.0

WordPress Happy Addons for Elementor plugin <= 3.50.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through 3.50.1.

• Обновитесь до 3.51.0

Security update for rsyslog

This update for rsyslog fixes the following issues: - CVE-2026-19654: imptcp regex-framing remote denial of service (bsc#1271910). - CVE-2026-61548: crafted RFC 5424 messages to mmpstrucdata can lead to a stack overwrite (bsc#1272414). - CVE-2026-78002: RainerScript replace() heap buffer overflow (bsc#1275926). - CVE-2026-92709: `omfile` `dynaFile` template uses a value influenced by untrusted input as a path component without explicit secure-path handling, which can lead to arbitrary code execution (bsc#1286926). - RainerScript replace() length wrap (bsc#1285036). Changes for rsyslog: - added new rsyslog (imdtls/omdtls) DTLS modules (js

• Обновитесь до 8.2608.0-160000.1.1

Security update for python-Brotli

This update for python-Brotli fixes the following issues: - CVE-2025-6176: denial of service (DoS) due to a flaw in its brotli decompression (bsc#1252945). - CVE-2026-111497: Brotli decoder out-of-bounds write permits remote code execution (bsc#1287779). Update to 1.2.1: - **decoder / encoder: added static initialization to reduce binary size** - python: allow limiting decoder output (see SECURITY section) - python: modernize extension / allow multi-phase module initialization - decoder / encoder: static tables use "small" model (allows 2GiB+ binaries)

• Обновитесь до 1.2.1-160000.1.1

WordPress WP ERP plugin <= 1.17.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through 1.17.10.

• Обновитесь до 1.17.11

WordPress EventPrime plugin <= 4.3.6.0 - Broken Access Control vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime eventprime-event-calendar-management allows Privilege Abuse.This issue affects EventPrime: from n/a through 4.3.6.0.

• Обновитесь до 4.3.6.1

WordPress Page Restriction WordPress (WP) plugin <= 1.6.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Restriction WordPress (WP): from n/a through 1.6.1.

• Обновитесь до 1.6.2

WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

• Обновитесь до 4.0.3

WordPress Flash & HTML5 Video plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & HTML5 Video html5-video-player allows Stored XSS.This issue affects Flash & HTML5 Video: from n/a through 2.14.0.

• Обновитесь до 2.14.1

Security update for python-CairoSVG

This update for python-CairoSVG fixes the following issue: - CVE-2026-107378: rendering an attacker-controlled SVG with a path containing many segments can lead to quadratic CPU consumption (bsc#1284832).

• Обновитесь до 2.7.1-160000.4.1