News & Sicurezza

CVE ID :CVE-2026-87831 Published : Sept. 17, 2026, 8:17 a.m. | 2 hours, 44 minutes ago Description :The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before deleting it, allowing any authenticated user such as a customer to delete arbitrary media attachments belonging to other users. Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-86320 Published : Sept. 17, 2026, 8:17 a.m. | 2 hours, 44 minutes ago Description :A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary code execution with the privileges of the user running flatpak-builder. Severity: 7.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-50607 Published : Sept. 17, 2026, 8:17 a.m. | 2 hours, 44 minutes ago Description :A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. A WebSocket service was configured to listen on all network interfaces, which may expose the service to unintended network access. Severity: 2.7 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-50606 Published : Sept. 17, 2026, 8:17 a.m. | 2 hours, 44 minutes ago Description :A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded AES encryption key within the software. Under certain circumstances, a local attacker may be able to use the embedded key to access protected information or perform unauthorized actions. Severity: 1.2 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-50605 Published : Sept. 17, 2026, 8:17 a.m. | 2 hours, 44 minutes ago Description :A vulnerability has been identified in the Acer Agent Service component included with NitroSense and PredatorSense. Insufficient access controls within a privileged service may allow an authenticated local user to perform unauthorized registry operations. In certain situations, this could lead to privilege escalation or compromise of the affected system. Severity: 7.4 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

BIND 9 Update Fixes 14 Flaws, Including an Unauthenticated Crash Over DNS-over-HTTPS The Internet Systems Consortium (ISC) has released BIND 9.20.29 and 9.21.26 to fix fourteen security flaws it disclosed on 16 September in BIND 9, its open-source DNS server software. One of them affe ... Read more Published Date: Sep 17, 2026 (5 days, 5 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-80274 CVE-2026-77119 CVE-2026-76163 CVE-2026-75029 CVE-2026-19668 CVE-2026-19666 CVE-2026-19033 CVE-2026-81736 CVE-2026-81563 CVE-2026-78301 CVE-2026-77692 CVE-2026-19941 CVE-2026-19667 CVE-2026-19662

Cisco waarschuwt voor misbruik van kritiek lek in Identity Services Engine Cisco waarschuwt organisaties voor een kritieke kwetsbaarheid in de Identity Services Engine (ISE) waar aanvallers actief misbruik van maken. De CVSS-impactscore van het beveiligingslek is met de maxi ... Read more Published Date: Sep 17, 2026 (5 days, 6 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-76460 CVE-2025-20337 CVE-2025-20281

CVE ID :CVE-2026-44940 Published : Sept. 17, 2026, 7:16 a.m. | 2 hours, 15 minutes ago Description :The rancher-extension-stackstate extension in SUSE Observability exposes service tokens in plain configuration or insecure locations rather than managing them securely. An attacker with minimal access could obtain the token to gain unauthorized access or escalate privileges within the observability environment. Severity: 5.7 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-91017 Published : Sept. 17, 2026, 7:16 a.m. | 3 hours, 44 minutes ago Description :The Robokassa payment gateway for Woocommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled, allowing unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders as paid or on-hold without payment or a valid signature. Severity: 3.7 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-86801 Published : Sept. 17, 2026, 7:16 a.m. | 2 hours, 15 minutes ago Description :The To Do List Member WordPress plugin from 1.4 through 1.6 ships a file upload endpoint that does not load WordPress and therefore applies no authentication, capability or nonce check of any kind, and validates only the name of an uploaded file rather than its content, allowing unauthenticated users to store active content served from the site's own origin, and to list and delete the files already staged there. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-90982 Published : Sept. 17, 2026, 7:16 a.m. | 3 hours, 44 minutes ago Description :@fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensitive filesystem such as Windows or the default macOS volume, a route guard or allowedPath restriction can be bypassed by altering the letter case of a path segment. The route matcher is case-sensitive while the filesystem is not, so a request that changes the case of a protected segment does not match the guarded route and falls through to the static handler, yet the filesystem resolves it to the same protected file. As a result, an unauthenticated request can read a file that a route guard or allowedPath was configured to protect. The issue does not affect case-sensitive filesystems and is not a directory traversal, since nothing is served from outside the configured root. The issue is fixed in @fastify/static 10.1.4, which validates the requested path against its actual on-disk spelling and rejects case-aliased paths before authorization. As a workaround, serve static files from a case-sensitive filesystem, or ensure route guards and allowedPath rules account for every letter-case variant of the protected paths. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-87963 Published : Sept. 17, 2026, 7:16 a.m. | 3 hours, 44 minutes ago Description :The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL query, and reads it before WordPress applies its request escaping, allowing unauthenticated attackers to perform SQL injection and read arbitrary database contents including administrator password hashes. Severity: 8.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...