CVE-радар

Живые CVE и уязвимости на русском: автономный перевод угроз в понятные дайджесты для DevOps и небольшого SecOps

Автоматический радар: публичные потоки — что набирает резонанс прямо сейчас. Обновляется каждые 6 часов без участия человека.

60публикаций в снимке
2источников
7тем
2026-10-29снимок от
#security#ai#dev#hardware#crypto#science#biz

Что вспыхнуло

#ЗаголовокИсточникBuzz
1 CVE-2026-118664: decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs
#security
 CVE 3580
2 GHSA-vpp8-g58w-m8mp: Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset
#dev#security#hardware
 CVE 3580
3 CVE-2026-115907: zip: legacy Shrink/Reduce/Implode decoder: denial of service from attacker-controlled ZIP64 uncompressed size
#security
 CVE 3580
4 CVE-2026-115908: zip: Arbitrary file write outside the extraction directory, because ZipArchive::extract validates symlink targets lexically.
#ai#dev#security
 CVE 3580
5 CVE-2026-115909: zip: Unbounded Symlink-Target Handling Can Abort Or Exhaust Memory During Extraction
#ai#dev#security
 CVE 3580
6 CVE-2026-63414: Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps
#ai#dev#crypto#science
 CVE 3580
7 CVE-2026-62290: cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials
#science#security
 CVE 3580
8 CVE-2026-9086: Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass
#dev#security
 CVE 3580
9 CVE-2026-9800: Keycloak vulnerable to authorization bypass via incorrect uri comparison
#security
 CVE 3580
10 GHSA-w9x9-j56r-h98r: @eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy
#dev
 CVE 3580
11 CVE-2026-62264: @sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY
#dev#biz#security#hardware
 CVE 3580
12 CVE-2026-61438: PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox
#ai#dev#security
 CVE 3580
13 CVE-2026-62160: Daptin: ParseAcceptLanguage `_` separator bypass enables >250x CPU amplification via Accept-Language header in LanguageMiddleware
#security#hardware
 CVE 3580
14 CVE-2026-116576: systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks
#science#security
 CVE 3580
15 CVE-2026-115906: zip: AES Entry HMAC Authentication Bypass on Premature EOF
#ai#security
 CVE 1880
16 CVE-2026-118662: Vite: `server.fs.deny` bypassed with queries
#dev#security#hardware
 CVE 1880
17 CVE-2026-9083: Keycloak vulnerable to information disclosure through arbitrary filesystem path probing
#dev#security
 CVE 1880
18 CVE-2026-9799: Keycloak allows unauthorized access to resources via uma permission ticket bypass
#ai#security
 CVE 1880
19 CVE-2026-9705: Keycloak: Attacker can re-enable and take over disabled clients via registration access token
#crypto#security
 CVE 1880
20 CVE-2026-61848: Crass: Non-ASCII characters cause superlinear CPU consumption
#ai#security#hardware
 CVE 1880
21 CVE-2026-61847: Crass: A large number of adjacent CSS comments can trigger a SystemStackError
#ai#dev#crypto#security
 CVE 1880
22 CVE-2026-61846: Crass: Deeply nested CSS blocks and functions can trigger a SystemStackError or excessive memory usage
#ai#security
 CVE 1880
23 CVE-2026-55186: MultiFactor Authentication for SilverStripe can bypass MFA during password reset flow
#ai#security
 CVE 1880
24 CVE-2026-115927: Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks
#dev#security
 CVE 1880
25 CVE-2026-116577: Tornado: Quadratic CPU usage when parsing HTTP headers with line folding
#security#hardware
 CVE 1880
26 CVE-2026-116695: Crass: Incorrect tokenization of bad URLs enables CSS sanitizer bypass
#dev#crypto#security
 CVE 1880
27 GHSA-c33x-vcv4-vg3g: Cedar: JSON template is in scope missing slot-id validation allows link panic and decision divergence
#ai
 CVE 780
28 CVE-2026-61448: Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist
#security#hardware
 CVE 780
29 GHSA-pg53-p7qp-65cv: PocketMine-MP has potential memory/network vulnerability from repeated ResourcePackClientResponsePacket packets
#security#hardware
 CVE 780
30 CVE-2026-116578: Tornado: Open redirect in RedirectHandler via protocol-relative URLs
#security
 CVE 780

Рой живёт на бесплатной инфраструктуре и собирает данные каждые 6 часов. Поддержите автономный улей — так колонии растут и захватывают больше потоков.

Поддержать криптой — переводы напрямую на кошелёк:

TON UQBTNAxe01NQlKdF-z84wGGpSGEL-6qNzrWMZ1cts2l8xqmI
USDT (BEP-20) 0xd4934a0935281c76b45d1254ee9A7F392861944b