News & Sicurezza

Vulnerability in drEryk Gabinet software Vulnerability in drEryk Gabinet software CVE ID CVE-2026-17038 Publication date 10 September 2026 Vendor drEryk Product drEryk Gabinet Vulnerable versions All before 11.5.0 Vulnerability type (CWE) Us ... Read more Published Date: Sep 10, 2026 (4 days, 7 hours ago) Vulnerabilities has been mentioned in this article.

CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added three flaws, each impacting Cisco, Citrix, and Fortinet, to its Known Exploited Vulnerabilities (KEV) catalog, requi ... Read more Published Date: Sep 10, 2026 (4 days, 5 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-19490 CVE-2026-20079 CVE-2025-25249

NCSC verwacht grootschalig misbruik van kritieke Check Point vpn-lekken Het Nationaal Cyber Security Centrum (NCSC) waarschuwt organisaties voor twee kritieke kwetsbaarheden in vpn-producten van cybersecuritybedrijf Check Point en roept op tot het zo snel mogelijk install ... Read more Published Date: Sep 10, 2026 (4 days, 6 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-85103 CVE-2026-85102

CVE ID :CVE-2026-78303 Published : Sept. 10, 2026, 10:17 a.m. | 1 hour, 21 minutes ago Description :Joomla Extension - joomshaper.com - Unvalidated Email Destination & Form Manipulation in Booking Requests in SP Property Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-87803 Published : Sept. 10, 2026, 10:17 a.m. | 1 hour, 21 minutes ago Description :An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint parses user-controlled aggregation JSON and passes it through a stage sanitizer that determines whether a nested array is a sub-pipeline by checking if every element contains a key present in a hardcoded KNOWN_STAGE_OPERATORS set. If any element contains an unrecognized stage key, such as the undocumented MongoDB-internal $_internalInhibitOptimization, the sanitizer misclassifies the entire branch as a generic array and skips stage-level stripping for all sibling stages. This allows a non-admin user with DBViewer read permission to inject forbidden operators like $lookup inside $facet sub-pipelines, performing cross-collection joins into restricted collections. This leads to unauthorized read access to sensitive data including password-reset tokens (prid), enabling account takeover. Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-78084 Published : Sept. 10, 2026, 10:17 a.m. | 1 hour, 21 minutes ago Description :Joomla Extension - joomshaper.com - Missing Access Control in Gallery Image Management in SP Property Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-78302 Published : Sept. 10, 2026, 10:17 a.m. | 1 hour, 21 minutes ago Description :Joomla Extension - joomshaper.com - Unauthenticated Stored Cross-Site Scripting (XSS) via Unescaped Output in Views and Admin Lists in SP Property Severity: 8.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-78374 Published : Sept. 10, 2026, 10:17 a.m. | 1 hour, 21 minutes ago Description :Joomla Extension - joomlart.com - Open mail relay via contact AJAX endpoint in T4 Page Builder extension Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-78083 Published : Sept. 10, 2026, 10:17 a.m. | 1 hour, 21 minutes ago Description :Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Property Booking and Agent Contact Endpoints in SP Property Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-5399 Published : Sept. 10, 2026, 10:17 a.m. | 1 hour, 21 minutes ago Description :The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider field in User Profile settings in versions up to and including 4.5.13.1. This is due to insufficient input sanitization in the user_meta_save() function (which only sanitizes array values, not scalar values) and improper output escaping in the Redux_Slider::render() method, which outputs slider values into unquoted HTML attributes. The vulnerability also exploits the fact that the clean_default() method only casts values to numeric types when they are empty or out of bounds, allowing malicious strings like '1 tabindex=0 autofocus onfocus=alert(1) x=' to pass validation through PHP's loose type comparison. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts into their user profile that will execute whenever an Administrator navigates to view the attacker's profile page. Severity: 6.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-78082 Published : Sept. 10, 2026, 10:17 a.m. | 1 hour, 21 minutes ago Description :Joomla Extension - joomshaper.com - Unauthenticated SQL Injection in Property Search and Map Filtering in SP Property Severity: 9.3 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-15889 Published : Sept. 10, 2026, 10:17 a.m. | 1 hour, 21 minutes ago Description :The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Severity: 6.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...