News & Sicurezza

A weakness has been identified in D-Link DWR-M920 1.1.7. This issue affects the function sub_41E60C of the file /boafrm/formPinManageSetup. This manipulation of the argument newPin causes os command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

CVE ID :CVE-2026-90697 Published : Sept. 14, 2026, 9:17 a.m. | 1 hour, 8 minutes ago Description :A vulnerability was identified in SourceCodester Inventory Management System 1.0. This affects an unknown part of the file invoice.php. The manipulation of the argument ID leads to authorization bypass. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-90699 Published : Sept. 14, 2026, 9:17 a.m. | 1 hour, 8 minutes ago Description :A weakness has been identified in D-Link DWR-M920 1.1.7. This issue affects the function sub_41E60C of the file /boafrm/formPinManageSetup. This manipulation of the argument newPin causes os command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. Severity: 9.9 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-90698 Published : Sept. 14, 2026, 9:17 a.m. | 1 hour, 8 minutes ago Description :A security flaw has been discovered in memcached 1.6.41/1.6.42/1.6.43. This vulnerability affects the function try_read_command_asciiauth of the file proto_text.c of the component mcmc Tokenizer. The manipulation results in out-of-bounds read. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 1.6.44 is able to resolve this issue. The patch is identified as af05c9302bba508b736c3da1d5670f63fe8b7db4. You should upgrade the affected component. Severity: 5.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-90700 Published : Sept. 14, 2026, 9:17 a.m. | 1 hour, 8 minutes ago Description :A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/pro_edit1.php. Such manipulation of the argument prodcode leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-90696 Published : Sept. 14, 2026, 9:17 a.m. | 1 hour, 8 minutes ago Description :A vulnerability was determined in SourceCodester Inventory Management System 1.0. Affected by this issue is some unknown functionality of the file /api/products_handler.php of the component Product Management Module. Executing a manipulation of the argument Product_Name can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Severity: 4.0 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-88932 Published : Sept. 14, 2026, 9:17 a.m. | 1 hour, 8 minutes ago Description :multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage is aborted mid-upload, file writes that complete after multer has already run its abort cleanup are not removed, so each aborted upload can leave an orphaned file on disk. A remote unauthenticated attacker can repeatedly start and abort uploads to accumulate orphaned files and exhaust disk space, causing a denial of service. The issue is fixed in multer 2.4.0, and users should upgrade to 2.4.0 or later. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-89321 Published : Sept. 14, 2026, 9:17 a.m. | 1 hour, 8 minutes ago Description :Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but nothing limited how large an entry becomes when opened. On the first request to /vscode/unpkg/{namespace}/{extension}/{version}/{path}, WebResourceService opened the entry with ZipFile.getInputStream() and passed the decompressed stream to Files.copy(), which ran to the end of the stream without counting bytes written. The result was cached under java.io.tmpdir, and that cache evicted by entry count (150), not by size, so it placed no bound on disk usage. A publisher with access only to their own namespace could therefore upload a small, highly compressible VSIX and cause the server to write far larger files to the temp filesystem — repeating with different files or versions, since a repeat request is served from the cache. Impact observed: the temp filesystem filled; requests for files not already cached returned 500 with No space left on device; a failed extraction left a partial cache file that blocked later attempts at that path; publishing failed with Failed to read extension file. Metadata and already-cached files kept working, and the server did not stop. Triggering the extraction needs no authentication — only the upload does. Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-90893 Published : Sept. 14, 2026, 9:12 a.m. | 1 hour, 13 minutes ago Description :MISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventIndexColumnToggle were explicitly added to the Security component's unlockedActions list, which disabled all CSRF validation (both token and field-hash checks) for those endpoints. Because these endpoints accept POST requests and modify per-user application state (theme selection, default homepage URL, and event index column visibility), an attacker who can induce a logged-in MISP user to load a malicious page (e.g., via a crafted link, embedded image, or auto-submitting form) can forge requests that alter the victim's settings without their knowledge or consent. The most impactful action is setHomePage, which allows an attacker to redirect the victim's default landing page to an arbitrary attacker-controlled URL, potentially facilitating phishing or further social engineering. The setTheme action can alter the user's visual theme, and eventIndexColumnToggle can change which columns are displayed in the event index view. No authentication bypass is involved; the victim must already be authenticated to MISP. The vulnerability was reported by the Scottish Government National Cyber Team. Version affected: ≤2.5.45 Severity: 5.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

2,6 miljoen MikroTik-routers draaien met publiek toegankelijke services maandag 14 september 2026, 10:39 door Redactie, 0 reactiesLaatst bijgewerkt: Vandaag, 11:00 Wereldwijd zijn er zo'n 2,6 miljoen MikroTik-routers, waarvan ruim achtduizend in Nederland, die met publiek ... Read more Published Date: Sep 14, 2026 (2 jours, 4 heures ago) Vulnerabilities has been mentioned in this article. CVE-2026-86060 CVE-2026-67277

A flaw has been found in D-Link DIR-878 120B05. This impacts the function SetWan3Settings of the component WAN Settings. This manipulation of the argument Primary/Secondary causes stack-based buffer overflow. Remote exploitation of the attack is possible.

CVE ID :CVE-2026-90693 Published : Sept. 14, 2026, 8:16 a.m. | 2 hours, 8 minutes ago Description :A flaw has been found in D-Link DIR-878 120B05. This impacts the function SetWan3Settings of the component WAN Settings. This manipulation of the argument Primary/Secondary causes stack-based buffer overflow. Remote exploitation of the attack is possible. Severity: 9.9 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...