News & Sicurezza

CVE ID :CVE-2026-92069 Published : Sept. 15, 2026, 1:17 p.m. | 1 hour, 21 minutes ago Description :Spoofing issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-92067 Published : Sept. 15, 2026, 1:17 p.m. | 1 hour, 21 minutes ago Description :Use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-92066 Published : Sept. 15, 2026, 1:17 p.m. | 1 hour, 21 minutes ago Description :Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 156. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-92068 Published : Sept. 15, 2026, 1:17 p.m. | 1 hour, 21 minutes ago Description :Site isolation issue in the Reader Mode component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-92070 Published : Sept. 15, 2026, 1:17 p.m. | 1 hour, 21 minutes ago Description :Information disclosure in the Networking component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-92071 Published : Sept. 15, 2026, 1:17 p.m. | 1 hour, 21 minutes ago Description :Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156 and Firefox ESR 153.3. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.16. This is due to a combination of two flaws: (1) the masterstudy_ms_stm_set_discard_transient AJAX endpoint in admin/admin-notices/classes/STMHandler.php accepts an arbitrary transient key without capability checks or nonce validation, and (2) the developer access login mechanism in admin/classes/stm-theme-support.php authenticates users based on a transient value without proper cryptographic validation when in legacy string mode. This makes it possible for authenticated attackers, with subscriber-level access and above, to set the stm_developer_access_token transient to a known value (1), then authenticate as any existing user including administrators by visiting a specially crafted URL, thereby achieving full privilege escalation to administrator.

Casdoor through 4.4.0 contains an authorization bypass vulnerability in the /api/mcp endpoint that allows attackers with any application's clientId and clientSecret to gain unrestricted access to user administration across all organizations. Attackers can enumerate user records including password salts and email addresses, create administrator accounts, modify existing users, and delete them in any organization by supplying legitimate credentials from a single application.

lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous access, allowing unauthenticated attackers to read the server's full JVM system property map. Attackers can send POST requests to /defGenProject/anno/getProperties to retrieve sensitive information including JVM classpath, filesystem paths, operating system details, and startup secrets.

pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are discarded, allowing any value as the current password. Remote attackers can submit a username with an incorrect current password to overwrite any account credential including the admin account and gain full administrative control.

Human Attacker Exploits Marimo RCE, Reaches SSH Bastion in Eight Seconds With artificial intelligence (AI) shrinking the window between vulnerability discovery and exploitation and lowering the barrier to entry for bad actors, new findings from Sysdig show that skilled hum ... Read more Published Date: Sep 15, 2026 (3 days, 7 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-39987 CVE-2021-33045 CVE-2021-33044

CVE ID :CVE-2026-91926 Published : Sept. 15, 2026, 11:49 a.m. | 36 minutes ago Description :A flaw was found in gss-ntlmssp. A memory leak occurs in the NTLM target-info parser when a crafted NTLM CHALLENGE message contains duplicated string-valued AV_PAIR entries. The parser allocates memory for each string value but does not free the previous allocation when the same AV_PAIR type appears more than once, leaking the earlier allocation. A malicious or man-in-the-middle server can exploit this to cause gradual memory exhaustion on the client during NTLM authentication, leading to a denial of service. Severity: 3.7 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...