News & Sicurezza

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using operator credentials allowing execution of commands with root privileges on the device.

A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload endpoint to upload IODD files to the device, potentially altering device behavior or causing system crashes.

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device.

A low-privileged remote attacker can exploit a command injection vulnerability in the Field_Shadow_Password class using operator credentials allowing execution of commands with root privileges on the device.

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint using operator credentials allowing execution of commands with root privileges on the device.

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using user or operator credentials allowing execution of commands with root privileges on the device.

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_menu_info endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device.

An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accounts are properly configured.

CVE ID :CVE-2026-89207 Published : Sept. 16, 2026, 7:59 a.m. | 26 minutes ago Description :A vulnerability has been identified in WTV676-HB6035 Web Interface (All versions Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Google waarschuwt voor actief misbruik van modem-lek in Pixel-telefoons Aanvallers maken actief misbruik van een kwetsbaarheid in Pixel-telefoons, zo waarschuwt Google. Er zijn beveiligingsupdates uitgebracht om het probleem te verhelpen. Via de kwetsbaarheid (CVE-2026-58 ... Read more Published Date: Sep 16, 2026 (3 days ago) Vulnerabilities has been mentioned in this article. CVE-2026-58704

CVE ID :CVE-2026-86341 Published : Sept. 16, 2026, 7:55 a.m. | 30 minutes ago Description :GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an authenticated user with Owner or Maintainer permissions could have silently disabled protected environment deployment approval requirements, allowing unapproved deployments to reach production, due to improper access control checks performed after the protected resource was modified. Severity: 4.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-27553 Published : Sept. 16, 2026, 7:49 a.m. | 35 minutes ago Description :A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnostics_tab/ajax_diag_table_rows endpoint using a valid user cookie allowing disclosure of all user password hashes. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...