https://cveradar-ah3.pages.dev Живые CVE и уязвимости на русском: автономный перевод угроз в понятные дайджесты для DevOps и небольшого SecOps ru Thu, 29 Oct 2026 23:46:48 GMT https://cveradar-ah3.pages.dev/item/cve-2026-118664-decode-uri-component-vulnerable-to-denial-of-ser.html https://cveradar-ah3.pages.dev/item/cve-2026-118664-decode-uri-component-vulnerable-to-denial-of-ser.html Thu, 29 Oct 2026 16:41:28 GMT Severity: high. ### Summary `decodeUriComponent()` takes quadratic time on malformed input that has many distinct percent-encoded runs. A single unauthenticated request of about 224 KB can block the Node.js event loop for about 20 seconds. Version 0.5.0, the release that fixed CVE-[phone], is affec https://cveradar-ah3.pages.dev/item/ghsa-vpp8-g58w-m8mp-twisted-unauthenticated-remote-denial-of-ser.html https://cveradar-ah3.pages.dev/item/ghsa-vpp8-g58w-m8mp-twisted-unauthenticated-remote-denial-of-ser.html Thu, 29 Oct 2026 16:41:06 GMT Severity: high. ## Summary An uncontrolled-resource-consumption vulnerability (CWE-400) in the Twisted HTTP/2 server lets any unauthenticated remote client exhaust server CPU over a single connection. A client that sends a request header block with `END_STREAM` and then immediately resets the strea https://cveradar-ah3.pages.dev/item/cve-2026-115907-zip-legacy-shrink-reduce-implode-decoder-denial-.html https://cveradar-ah3.pages.dev/item/cve-2026-115907-zip-legacy-shrink-reduce-implode-decoder-denial-.html Thu, 29 Oct 2026 16:40:19 GMT Severity: high. ### Summary A malicious 149-byte ZIP archive can cause a denial of service in applications that enable `legacy-zip` and use `ZipArchive::extract()`. An attacker-controlled ZIP64 uncompressed size triggers a `capacity overflow` panic in the Shrink decoder in optimized builds, potenti https://cveradar-ah3.pages.dev/item/cve-2026-115908-zip-arbitrary-file-write-outside-the-extraction-.html https://cveradar-ah3.pages.dev/item/cve-2026-115908-zip-arbitrary-file-write-outside-the-extraction-.html Thu, 29 Oct 2026 16:40:12 GMT Severity: high. ### Summary - **Verified version:** zip `9.0.0-pre3` - **Affected versions:** `7.2.0` and later - **Precondition:** The attacker knows (or can guess) the absolute path of the extraction destination The validation applied to symlinks is purely lexical. As a result, an attacker can w https://cveradar-ah3.pages.dev/item/cve-2026-115909-zip-unbounded-symlink-target-handling-can-abort-.html https://cveradar-ah3.pages.dev/item/cve-2026-115909-zip-unbounded-symlink-target-handling-can-abort-.html Thu, 29 Oct 2026 16:40:01 GMT Severity: high. ### Summary The symbolic-link branch of `ZipArchive::extract_internal()` allocates a buffer using an attacker-declared size before reading any entry data. A 112-byte archive terminates the extracting process with `SIGABRT` through this infallible allocation. ### Details ```rust #[ https://cveradar-ah3.pages.dev/item/cve-2026-63414-shopify-app-token-exchange-shop-context-confusion.html https://cveradar-ah3.pages.dev/item/cve-2026-63414-shopify-app-token-exchange-shop-context-confusion.html Thu, 29 Oct 2026 16:39:49 GMT Severity: high. In token-exchange authenticated controllers, `shopify_app` exposes shop context through helpers such as `current_shopify_domain`. Prior to the fix, `current_shopify_domain` could resolve to the sanitized `shop` query parameter instead of the shop identity derived from the verified Sh https://cveradar-ah3.pages.dev/item/cve-2026-62290-cert-manager-direct-acme-challenge-resources-can-.html https://cveradar-ah3.pages.dev/item/cve-2026-62290-cert-manager-direct-acme-challenge-resources-can-.html Thu, 29 Oct 2026 16:39:41 GMT Severity: high. ## Summary `Challenge` resources under `acme.cert-manager.io` can be created directly by namespace users. On create, cert-manager performs no admission validation tying the Challenge to an `Order`, an owner reference, or an Issuer-selected solver. The ACME Challenge controller then https://cveradar-ah3.pages.dev/item/cve-2026-9086-keycloak-vulnerable-to-cross-site-scripting-xss-vi.html https://cveradar-ah3.pages.dev/item/cve-2026-9086-keycloak-vulnerable-to-cross-site-scripting-xss-vi.html Thu, 29 Oct 2026 16:39:03 GMT Severity: high. ### Description A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to client registration endpoints, could bypass client Uniform Resource Identifier (URI) validation. This is achieved by registe https://cveradar-ah3.pages.dev/item/cve-2026-9800-keycloak-vulnerable-to-authorization-bypass-via-in.html https://cveradar-ah3.pages.dev/item/cve-2026-9800-keycloak-vulnerable-to-authorization-bypass-via-in.html Thu, 29 Oct 2026 16:37:26 GMT Severity: high. ### Description A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access-denied page path within a re https://cveradar-ah3.pages.dev/item/ghsa-w9x9-j56r-h98r-eeacms-volto-chatbot-has-unauthenticated-dan.html https://cveradar-ah3.pages.dev/item/ghsa-w9x9-j56r-h98r-eeacms-volto-chatbot-has-unauthenticated-dan.html Thu, 29 Oct 2026 16:35:48 GMT Severity: high. ## Unauthenticated Danswer API Confused Deputy Proxy in @eeacms/volto-chatbot ### Summary `@eeacms/volto-chatbot` exposes an Express middleware route (`**/_v1_da/**`) that accepts unauthenticated HTTP requests from any network client and proxies them to the configured upstream Dans https://cveradar-ah3.pages.dev/item/cve-2026-62264-sylphx-pdf-reader-mcp-http-transport-accepts-unau.html https://cveradar-ah3.pages.dev/item/cve-2026-62264-sylphx-pdf-reader-mcp-http-transport-accepts-unau.html Thu, 29 Oct 2026 16:34:35 GMT Severity: high. ### Impact When `@sylphx/pdf-reader-mcp` is run as an HTTP server (`MCP_TRANSPORT=http`), it reads the `MCP_API_KEY` environment variable and logs `API key authentication enabled (X-API-Key header)` at startup, but it never validated the `X-API-Key` header on incoming requests. The https://cveradar-ah3.pages.dev/item/cve-2026-61438-praisonai-vulnerable-to-remote-code-execution-via.html https://cveradar-ah3.pages.dev/item/cve-2026-61438-praisonai-vulnerable-to-remote-code-execution-via.html Thu, 29 Oct 2026 16:34:26 GMT Severity: high. ### Summary JobWorkflowExecutor._exec_inline_python() is designed to safely execute inline Python expressions from YAML workflow script: steps using AST validation. The function claims to block dangerous operations by (a) checking all AST nodes against an allowlist, and (b) providing https://cveradar-ah3.pages.dev/item/cve-2026-62160-daptin-parseacceptlanguage-separator-bypass-enabl.html https://cveradar-ah3.pages.dev/item/cve-2026-62160-daptin-parseacceptlanguage-separator-bypass-enabl.html Thu, 29 Oct 2026 16:33:09 GMT Severity: high. ### Summary Daptin's `LanguageMiddleware` (registered as a global gin middleware) calls `golang.org/x/text/language.ParseAcceptLanguage` on the raw `Accept-Language` header of every HTTP request without imposing any size or shape filter. The underlying parser has quadratic-time beha https://cveradar-ah3.pages.dev/item/cve-2026-116576-systeminformation-vulnerable-to-windows-command-.html https://cveradar-ah3.pages.dev/item/cve-2026-116576-systeminformation-vulnerable-to-windows-command-.html Wed, 28 Oct 2026 22:42:49 GMT Severity: high. ### Summary On Windows, `systeminformation@5.33.15` builds a PowerShell command using the value passed to `services()`. The default sanitizer removes ASCII quotes but keeps Unicode curly quotes, spaces, and parentheses. A crafted service name can use those characters to break out of https://cveradar-ah3.pages.dev/item/cve-2026-115906-zip-aes-entry-hmac-authentication-bypass-on-prem.html https://cveradar-ah3.pages.dev/item/cve-2026-115906-zip-aes-entry-hmac-authentication-bypass-on-prem.html Thu, 29 Oct 2026 16:40:07 GMT Severity: medium. ### Summary An AES-encrypted (AE-x) entry's authentication code is verified only when the reader's byte counter lands exactly on zero. If the bounded entry reader reaches the archive's actual EOF before the attacker-controlled, header-declared `compressed_size`, the counter remain https://cveradar-ah3.pages.dev/item/cve-2026-118662-vite-server-fs-deny-bypassed-with-queries.html https://cveradar-ah3.pages.dev/item/cve-2026-118662-vite-server-fs-deny-bypassed-with-queries.html Thu, 29 Oct 2026 16:39:56 GMT Severity: medium. ### Summary The contents of files that are specified by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny) can be returned to the browser. This is the same as https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r. ### Impact Only apps that https://cveradar-ah3.pages.dev/item/cve-2026-9083-keycloak-vulnerable-to-information-disclosure-thro.html https://cveradar-ah3.pages.dev/item/cve-2026-9083-keycloak-vulnerable-to-information-disclosure-thro.html Thu, 29 Oct 2026 16:38:31 GMT Severity: medium. ### Description A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrar https://cveradar-ah3.pages.dev/item/cve-2026-9799-keycloak-allows-unauthorized-access-to-resources-v.html https://cveradar-ah3.pages.dev/item/cve-2026-9799-keycloak-allows-unauthorized-access-to-resources-v.html Thu, 29 Oct 2026 16:37:57 GMT Severity: medium. ### Description A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access (UMA) permission ticket for one resource can exploit this by using a specific permission request prefix to bypass per-resource access control. This allows the us https://cveradar-ah3.pages.dev/item/cve-2026-9705-keycloak-attacker-can-re-enable-and-take-over-disa.html https://cveradar-ah3.pages.dev/item/cve-2026-9705-keycloak-attacker-can-re-enable-and-take-over-disa.html Thu, 29 Oct 2026 16:36:21 GMT Severity: medium. ### Description A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token (RAT), could exploit this vulnerability to re-enable a client that an administrator had explicitly disabled. This bypasses securit https://cveradar-ah3.pages.dev/item/cve-2026-61848-crass-non-ascii-characters-cause-superlinear-cpu-.html https://cveradar-ah3.pages.dev/item/cve-2026-61848-crass-non-ascii-characters-cause-superlinear-cpu-.html Thu, 29 Oct 2026 16:35:29 GMT Severity: medium. ### Impact When parsing an input containing non-ASCII characters, inefficiencies in how Crass tracks the positions of multi-byte characters result in superlinear parsing time. An attacker-controlled input consisting of many non-ASCII characters could cause excessive CPU consumptio https://cveradar-ah3.pages.dev/item/cve-2026-61847-crass-a-large-number-of-adjacent-css-comments-can.html https://cveradar-ah3.pages.dev/item/cve-2026-61847-crass-a-large-number-of-adjacent-css-comments-can.html Thu, 29 Oct 2026 16:35:23 GMT Severity: medium. ### Impact When the `:preserve_comments` option is not enabled (which is the default behavior), Crass discards CSS comments by recursively consuming the next token. An attacker who provides a stylesheet containing a very large number of adjacent comments can cause excessive recurs https://cveradar-ah3.pages.dev/item/cve-2026-61846-crass-deeply-nested-css-blocks-and-functions-can-.html https://cveradar-ah3.pages.dev/item/cve-2026-61846-crass-deeply-nested-css-blocks-and-functions-can-.html Thu, 29 Oct 2026 16:35:16 GMT Severity: medium. ### Impact Crass recursively parses CSS simple blocks and functions without a depth guard. An attacker-controlled value containing many deeply nested blocks can recurse until Ruby raises `SystemStackError: stack level too deep`, or can cause excessive memory usage. ### Patches T https://cveradar-ah3.pages.dev/item/cve-2026-55186-multifactor-authentication-for-silverstripe-can-b.html https://cveradar-ah3.pages.dev/item/cve-2026-55186-multifactor-authentication-for-silverstripe-can-b.html Thu, 29 Oct 2026 16:32:39 GMT Severity: medium. ### Impact In CMS 5, the password reset flow let a user with multi-factor authentication enabled change their password and get a logged-in session before completing multi-factor authentication. Exploiting this requires access to the user's email account. CMS 6 is not affected. https://cveradar-ah3.pages.dev/item/cve-2026-115927-tornado-event-loop-blocking-and-excess-memory-us.html https://cveradar-ah3.pages.dev/item/cve-2026-115927-tornado-event-loop-blocking-and-excess-memory-us.html Wed, 28 Oct 2026 22:43:50 GMT Severity: medium. ### Summary When Tornado reads an HTTP/1.1 body that uses chunked transfer encoding, it processes all chunks that have already arrived without yielding to the event loop. A client can send a body made of millions of 1-byte chunks, which blocks the event loop (and therefore every o https://cveradar-ah3.pages.dev/item/cve-2026-116577-tornado-quadratic-cpu-usage-when-parsing-http-he.html https://cveradar-ah3.pages.dev/item/cve-2026-116577-tornado-quadratic-cpu-usage-when-parsing-http-he.html Wed, 28 Oct 2026 22:43:41 GMT Severity: medium. ### Summary Tornado's HTTP header parser takes quadratic time (O(n²)) when a header value is continued across many "obsolete line folding" (obs-fold) lines. An unauthenticated attacker can send a request whose header block is mostly short continuation lines. Parsing it uses a larg https://cveradar-ah3.pages.dev/item/cve-2026-116695-crass-incorrect-tokenization-of-bad-urls-enables.html https://cveradar-ah3.pages.dev/item/cve-2026-116695-crass-incorrect-tokenization-of-bad-urls-enables.html Wed, 28 Oct 2026 22:42:53 GMT Severity: medium. ## Summary Crass's tokenizer didn't terminate a bad URL token at a `)` that followed an escaped backslash (`\\`). As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it cou https://cveradar-ah3.pages.dev/item/ghsa-c33x-vcv4-vg3g-cedar-json-template-is-in-scope-missing-slot.html https://cveradar-ah3.pages.dev/item/ghsa-c33x-vcv4-vg3g-cedar-json-template-is-in-scope-missing-slot.html Thu, 29 Oct 2026 16:35:04 GMT Severity: low. Cedar users must be using all of the following features to be affected by this advisory: JSON format policies, policy templates, and the `is in` scope condition. This advisory only affects JSON-formatted Cedar policy templates containing `is in` scope conditions that are **malformed** https://cveradar-ah3.pages.dev/item/cve-2026-61448-parse-server-vulnerable-to-stored-xss-via-malform.html https://cveradar-ah3.pages.dev/item/cve-2026-61448-parse-server-vulnerable-to-stored-xss-via-malform.html Thu, 29 Oct 2026 16:33:48 GMT Severity: low. ### Impact Parse Server's file upload validation uses the `fileUpload.fileExtensions` option (enabled by default with a blocklist) to reject files that browsers may render as active content, mitigating stored cross-site scripting (XSS). When an uploaded file's extension is not recogn https://cveradar-ah3.pages.dev/item/ghsa-pg53-p7qp-65cv-pocketmine-mp-has-potential-memory-network-v.html https://cveradar-ah3.pages.dev/item/ghsa-pg53-p7qp-65cv-pocketmine-mp-has-potential-memory-network-v.html Thu, 29 Oct 2026 16:32:58 GMT Severity: low. ### Summary During the resource pack stage of logging in, after the server sends `ResourcePackStackPacket`, a malicious client can send a batch of multiple `ResourcePackClientResponsePacket` packets with status `ResourcePackClientResponsePacket::STATUS_COMPLETED` causing the server to https://cveradar-ah3.pages.dev/item/cve-2026-116578-tornado-open-redirect-in-redirecthandler-via-pro.html https://cveradar-ah3.pages.dev/item/cve-2026-116578-tornado-open-redirect-in-redirecthandler-via-pro.html Wed, 28 Oct 2026 22:43:45 GMT Severity: low. ### Summary `tornado.web.RedirectHandler` builds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open r