News & Sicurezza

CVE ID :CVE-2026-41573 Published : Sept. 15, 2026, 10:17 a.m. | 20 minutes ago Description :Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, IdentityResourceV1.queryCollection() passes the _queryId parameter from /json/{realm}/users to CrestQuery with escapeQueryId disabled, bypassing protection added for CVE-2021-29156. The unescaped value reaches DJLDAPv3Repo.getFilter(), where it is concatenated into an LDAP filter, allowing an authenticated attacker to inject LDAP metacharacters for user enumeration and blind LDAP injection. This issue is fixed in version 16.1.1. Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-19515 Published : Sept. 15, 2026, 10:17 a.m. | 20 minutes ago Description :The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untrusted sources. This allows a crafted project to inject and execute arbitrary operating system commands through the unit test execution flow. Successful exploitation of this vulnerability could lead to the execution of arbitrary OS commands on the system where the VS Code extension is running. The extent of the impact is dependent on the privileges of the user account under which VS Code is operating. Exploitation requires the user to grant workspace trust to the malicious project and subsequently trigger the unit test execution. Severity: 7.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Bluetooth-lek maakt uitvoeren van code op iPhones en Macs mogelijk dinsdag 15 september 2026, 11:33 door Redactie, 0 reactiesLaatst bijgewerkt: Vandaag, 11:38 Een bluetooth-kwetsbaarheid in iOS en macOS maakt het mogelijk voor remote aanvallers om willekeurige code o ... Read more Published Date: Sep 15, 2026 (3 days, 1 hour ago) Vulnerabilities has been mentioned in this article. CVE-2026-86890 CVE-2026-65414

A privilege escalation flaw was found in the scan_mysql actor of leapp-upgrade-el9toel10 (provided by leapp-repository). During RHEL 9 to RHEL 10 upgrades, the actor runs: mysqld --validate-config --log-error-verbosity=2 directly as root in the Leapp actor context, bypassing the packaged MySQL systemd unit that normally starts the daemon as User=mysql. A process compromised as the mysql OS identity can write a version-2 persisted configuration (mysqld-auto.cnf) and a malicious shared object into /var/lib/mysql (a directory owned by mysql). That persisted map can set plugin_dir to /var/lib/mysql and early_plugin_load (or related loader options such as plugin_load / plugin_load_add) so MySQL loads the attacker-controlled object during configuration validation. Plugin loading can reach dlopen() before MySQL’s runtime-user check and before plugin-symbol validation. When an administrator subsequently runs the documented Leapp preupgrade or upgrade workflow, attacker-controlled code can execute as UID 0 with a full capability set in an unconfined SELinux domain (unconfined_t). The attack does not require write access to the default system plugin path under /usr; redirecting plugin_dir via mysql-owned persisted state is sufficient. Ordinary SQL privileges alone (including highly privileged SQL accounts) are not a sufficient startpoint — OS-level execution as the mysql service identity is required, plus later administrator invocation of Leapp.

Webwinkels aangevallen via kritiek uploadlek in WooCommerce-plug-in Webwinkels worden al maandenlang aangevallen via een kritieke uploadkwetsbaarheid in een plug-in genaamd WooCommerce Wholesale Lead Capture. Via het beveiligingslek (CVE-2026-27540) kan een ongeauthen ... Read more Published Date: Sep 15, 2026 (2 days, 18 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-27540

4 in 5 Singapore Business Websites Have WordPress Vulnerabilities A new Singapore Study has found that four in five websites run by local businesses carry at least one detectable WordPress vulnerabilities. The Singapore WordPress Website Cybersecurity Study, release ... Read more Published Date: Sep 15, 2026 (2 days, 18 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-1490

CVE ID :CVE-2026-91091 Published : Sept. 15, 2026, 7:45 a.m. | 40 minutes ago Description :A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gf_node_list_insert_child of the file scenegraph/base_scenegraph.c of the component Node Insertion. Such manipulation leads to memory corruption. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version abi-16.23 is sufficient to resolve this issue. The name of the patch is 49dee5cad329cfed310c1682703df7daa47df31a. It is suggested to upgrade the affected component. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-91819 Published : Sept. 15, 2026, 7:41 a.m. | 43 minutes ago Description :Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. CakePHP honors a _method field or X-HTTP-Method-Override header by rewriting the effective request method. For override values outside the normal write verbs POST, PUT, PATCH, and DELETE, CakePHP also clears the parsed request body. MISP’s security component then determines whether to perform _validatePost() and _validateCsrf() based on whether request data remains. With a value such as: _method=GET the body becomes empty before those checks run, so both protections are skipped. A cross-site form containing only that override can therefore reach actions whose parameters are taken from the URL rather than the request body Version affected: ≤2.5.45 Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-91090 Published : Sept. 15, 2026, 7:30 a.m. | 55 minutes ago Description :A vulnerability was determined in GPAC up to f1219cde. The affected element is the function gf_node_activate_ex of the file scenegraph/base_scenegraph.c. This manipulation causes stack-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been publicly disclosed and may be utilized. Upgrading to version abi-16.23 is sufficient to fix this issue. Patch name: 9eb40df4448b88d6a6ce3454657c06f47eff0b24. The affected component should be upgraded. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Cisco waarschuwt voor misbruik van kritiek SQL Injection-lek in Email Gateway Aanvallers maken actief misbruik van een kritieke SQL Injection-kwetsbaarheid in de Cisco Secure Email Gateway, zo waarschuwt Cisco. Via het beveiligingslek (CVE-2026-76461) kan een aanvaller willekeu ... Read more Published Date: Sep 15, 2026 (2 days, 19 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-76461

A flaw has been found in GPAC up to f1219cde. This vulnerability affects the function gf_mo_get_od_id of the file compositor/media_object.c of the component Compositor. Executing a manipulation can lead to use after free. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version abi-16.24 is able to resolve this issue. This patch is called e34f4ba349d55cd1849f0bcf4cf46552732e2db7. Upgrading the affected component is advised.

CVE ID :CVE-2026-91087 Published : Sept. 15, 2026, 7:16 a.m. | 1 hour, 8 minutes ago Description :A flaw has been found in GPAC up to f1219cde. This vulnerability affects the function gf_mo_get_od_id of the file compositor/media_object.c of the component Compositor. Executing a manipulation can lead to use after free. The attack may be performed from remote. The exploit has been published and may be used. Upgrading to version abi-16.24 is able to resolve this issue. This patch is called e34f4ba349d55cd1849f0bcf4cf46552732e2db7. Upgrading the affected component is advised. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...