News & Sicurezza

New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root cPanel has patched a flaw that it says lets a single hosting account take control of an entire server. An authenticated account holder with mail-related privileges can create files of their choosing o ... Read more Published Date: Sep 09, 2026 (2 days, 3 hours ago) Vulnerabilities has been mentioned in this article.

CVE ID :CVE-2026-80124 Published : Sept. 9, 2026, 8:17 a.m. | 1 hour, 16 minutes ago Description :Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to information exposure. Severity: 5.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-79636 Published : Sept. 9, 2026, 8:17 a.m. | 1 hour, 16 minutes ago Description :Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Validation of Certificate with Host Mismatch vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access. Severity: 7.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-80055 Published : Sept. 9, 2026, 8:17 a.m. | 1 hour, 16 minutes ago Description :Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to script injection. Severity: 4.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-80123 Published : Sept. 9, 2026, 8:17 a.m. | 1 hour, 16 minutes ago Description :Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service. Severity: 7.3 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-80177 Published : Sept. 9, 2026, 8:17 a.m. | 1 hour, 16 minutes ago Description :Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to script injection. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

The PublishPress Capabilities – User Role Editor, Access Permissions, User Capabilities, Admin Menus plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.50.0. This is due to the `addPluginCapabilities()` function unconditionally granting the Editor role all 15 `manage_capabilities_*` capabilities — including `manage_capabilities`, `manage_capabilities_roles`, `manage_capabilities_settings`, and `manage_capabilities_backup` — via a hard-coded `$eligible_roles = ['administrator', 'editor']` assignment that runs automatically on the first `admin_init` after plugin activation with no administrator opt-in, persisting the grants directly to the database. This makes it possible for authenticated attackers with Editor-level access to elevate their privileges to a site-wide capability manager, enabling them to create, rename, and delete non-system roles, modify capabilities of non-administrator roles, restore role backups, and write arbitrary plugin options whose names begin with `cme_`, `capsman`, `pp_capabilities`, or `presspermit` via `update_option()`. The escalation stops short of full Administrator access, as WordPress's `map_meta_cap` layer still prevents the escalated Editor from granting administrator-only capabilities to other roles; however, all role-management and plugin-settings functionality gated solely on `manage_capabilities_*` capabilities remains fully accessible.

Google patcht ruim 200 kwetsbaarheden in Chrome, waaronder misbruikt lek Google heeft een beveiligingsupdate voor Chrome uitgebracht die ruim tweehonderd beveiligingslekken verhelpt, waaronder een kwetsbaarheid waar aanvallers actief misbruik van maken. Van de in totaal 23 ... Read more Published Date: Sep 09, 2026 (2 days, 4 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-87491

F5 BIG-IP APM Malware Injects a PHP Web Shell Into Memory, Evading Disk Scans Malware linked to break-ins at F5 BIG-IP Access Policy Manager appliances hides a PHP web shell in memory instead of in a file on disk, Sophos said in an analysis published on September 7. When Apache ... Read more Published Date: Sep 09, 2026 (2 days ago) Vulnerabilities has been mentioned in this article. CVE-2025-53521

Microsoft dicht bijna duizend beveiligingslekken tijdens patchdinsdag september Microsoft heeft tijdens de patchdinsdag van september bijna duizend beveiligingslekken verholpen, waaronder twee kwetsbaarheden die al voor het uitkomen van de patches werden misbruikt bij aanvallen t ... Read more Published Date: Sep 09, 2026 (2 days ago) Vulnerabilities has been mentioned in this article. CVE-2026-85880 CVE-2026-81963 CVE-2026-55007 CVE-2026-69414

CVE ID :CVE-2026-83537 Published : 9. September 2026 07:16 | 17 Minuten ago Description :The WP Express Checkout WordPress plugin before 2.5.0 does not verify server-side that a payment was actually completed before marking an order as paid, allowing unauthenticated users to forge a completed order without paying. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-87747 Published : 9. September 2026 07:16 | 17 Minuten ago Description :The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vulnerability. Privileged remote attackers can exploit Relative Path Traversal to download arbitrary system files. Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...