News & Sicurezza

Cisco Warns of New Zero-Day ISE Auth Bypass (CVSS 10.0) Exploited in Active Attacks Cisco has warned of a fresh maximum-severity security flaw impacting Identity Services Engine (ISE) that has come under active exploitation. The vulnerability, tracked as CVE-2026-76460 (CVSS score: 1 ... Read more Published Date: Sep 17, 2026 (5 jours, 3 heures ago) Vulnerabilities has been mentioned in this article. CVE-2026-76460 CVE-2026-76428 CVE-2026-76427 CVE-2026-76426 CVE-2026-76425 CVE-2026-76424 CVE-2026-76413 CVE-2026-76412 CVE-2026-76409 CVE-2026-20360 CVE-2026-20344 CVE-2026-20343 CVE-2026-20342 CVE-2026-20340 CVE-2026-20336 CVE-2026-20335 CVE-2026-20334 CVE-2026-20333 CVE-2026-20332 CVE-2026-20287 CVE-2026-20284 CVE-2026-20283 CVE-2026-20282 CVE-2026-76423 CVE-2026-20361 CVE-2026-20341 CVE-2026-20330 CVE-2026-20329 CVE-2026-20326 CVE-2026-20325 CVE-2026-20324 CVE-2026-20322 CVE-2026-20242 CVE-2026-20237 CVE-2026-20211 CVE-2026-20194 CVE-2026-20192 CVE-2026-20176 CVE-2026-20130 CVE-2026-76420 CVE-2026-20331 CVE-2026-20307 CVE-2026-20306 CVE-2026-20305 CVE-2026-20234 CVE-2026-76461 CVE-2026-76443 CVE-2026-76442 CVE-2026-76441 CVE-2026-76440 CVE-2026-20353

CVE ID :CVE-2026-91019 Published : Sept. 17, 2026, 6:16 a.m. | 3 hours, 15 minutes ago Description :The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-91010 Published : Sept. 17, 2026, 6:16 a.m. | 3 hours, 15 minutes ago Description :The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message deletion AJAX action, and only tests that a nonce parameter is present rather than validating it, allowing any authenticated user, such as a subscriber, to permanently delete every form submission the Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 has stored. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-91014 Published : Sept. 17, 2026, 6:16 a.m. | 3 hours, 15 minutes ago Description :The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allowing unauthenticated attackers to run arbitrary web scripts in a visitor's browser if they can trick the visitor into following a crafted link (reflected XSS). Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-91011 Published : Sept. 17, 2026, 6:16 a.m. | 3 hours, 15 minutes ago Description :The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of any user who later views the affected page. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-91016 Published : Sept. 17, 2026, 6:16 a.m. | 3 hours, 15 minutes ago Description :The Motors WordPress plugin before 1.4.121 does not verify that a request is authorized to view a user's non-published listings before returning them, allowing unauthenticated attackers to read any author's draft, pending and private car listings - including titles, prices, media URLs and seller notes - by supplying only the target's numeric user id. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-91015 Published : Sept. 17, 2026, 6:16 a.m. | 3 hours, 15 minutes ago Description :The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup on the site. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-91008 Published : Sept. 17, 2026, 6:16 a.m. | 3 hours, 15 minutes ago Description :The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details, allowing unauthenticated attackers to retrieve registered attendees' personal information (full name, email address, phone number, and custom registration fields) by supplying an enumerable booking reference. Exploitation is limited to sites configured to use the Event Booking Manager for WooCommerce WordPress plugin before 5.3.8's native (non-WooCommerce) checkout, which is not the default. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-90922 Published : Sept. 17, 2026, 6 a.m. | 25 minutes ago Description :The Paid Membership Subscriptions WordPress plugin before 3.0.9 does not verify that the amount and currency reported by the payment provider match the pending payment before completing it, allowing unauthenticated users to obtain a paid membership by paying an arbitrary lower amount. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-90923 Published : Sept. 17, 2026, 6:16 a.m. | 3 hours, 15 minutes ago Description :The Autopay WordPress plugin before 5.0.1 does not enforce the signature on one of its payment callbacks, allowing unauthenticated users to disclose and delete the stored payment parameters of other customers' orders. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-88904 Published : Sept. 17, 2026, 6 a.m. | 25 minutes ago Description :The PuppyFW WordPress plugin through 0.4.4 does not have proper authorisation on one of its REST routes, which tests the caller against a capability taken from the request itself, allowing any authenticated user, including subscribers, to add, modify and delete arbitrary blog options and thereby escalate their privileges. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-91009 Published : Sept. 17, 2026, 6:16 a.m. | 3 hours, 15 minutes ago Description :The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actions, allowing any authenticated users, such as subscriber, to change the title of arbitrary posts, pages and products. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...