News & Sicurezza

CVE ID :CVE-2026-84113 Published : 9. September 2026 06:17 | 1 Stunde, 16 Minuten ago Description :The Quentn WP WordPress plugin before 1.2.15 does not properly sanitise and escape a parameter before using it in an SQL query, allowing high privilege users such as administrators to perform SQL injection attacks. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 3.9.8 via the `NCWM_Kitconnect::run()` function. This is due to the plugin registering the `/wp-json/next_cart/v1/migration` REST route with `permission_callback` set to `__return_true` and relying on a hardcoded fallback value of `__token__` in `get_option('nextcart_token', '__token__')` when the `nextcart_token` option has not yet been written to the database. This makes it possible for unauthenticated attackers to bypass authentication to the migration endpoint by supplying the literal string `__token__` as the token, gaining access to privileged handlers that pass attacker-controlled SQL directly to `$wpdb->query()` and `$wpdb->get_results()` — enabling arbitrary SQL execution including administrator account creation — and pass an attacker-controlled path to `unlink()`, enabling arbitrary file deletion and full site takeover. The hardcoded fallback is reachable whenever the `nextcart_token` option has not yet been populated, which occurs after WP-CLI, network, or programmatic plugin activation without a subsequent authenticated `wp-admin` visit, as token generation is deferred to `admin_init` via `register_settings()`.

CVE ID :CVE-2026-81021 Published : 9. September 2026 06:17 | 1 Stunde, 16 Minuten ago Description :The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download paths, allowing unauthenticated attackers to read protected customer-uploaded attachments by enumerating sequential attachment identifiers. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

September 2026 Patch Tuesday: Two Exploited Zero-Days and 113 Critical Vulnerabilities Among 972 CVEs Microsoft has addressed 972 vulnerabilities in its September 2026 security update release, over double the number of CVEs released in August, and a new Patch Tuesday record. This month's patches inclu ... Read more Published Date: Sep 09, 2026 (1 day, 12 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-66302 CVE-2026-85880 CVE-2026-83939 CVE-2026-83501 CVE-2026-83498 CVE-2026-81963 CVE-2026-81959 CVE-2026-81955 CVE-2026-81953 CVE-2026-81952 CVE-2026-81951 CVE-2026-81950 CVE-2026-81949 CVE-2026-81948 CVE-2026-81355 CVE-2026-81354 CVE-2026-81352 CVE-2026-80083 CVE-2026-78525 CVE-2026-78520 CVE-2026-78519 CVE-2026-78510 CVE-2026-78509 CVE-2026-78505 CVE-2026-78450 CVE-2026-78449 CVE-2026-78445 CVE-2026-78444 CVE-2026-78439 CVE-2026-77898 CVE-2026-77505 CVE-2026-77504 CVE-2026-77495 CVE-2026-77493 CVE-2026-73023 CVE-2026-73018 CVE-2026-73017 CVE-2026-73013 CVE-2026-73010 CVE-2026-73009 CVE-2026-73006 CVE-2026-72987 CVE-2026-72986 CVE-2026-72983 CVE-2026-72982 CVE-2026-72981 CVE-2026-72980 CVE-2026-72979 CVE-2026-72962 CVE-2026-72961 CVE-2026-72960 CVE-2026-72959 CVE-2026-72958 CVE-2026-72957 CVE-2026-72954 CVE-2026-72950 CVE-2026-70586 CVE-2026-70585 CVE-2026-70351 CVE-2026-70296 CVE-2026-70203 CVE-2026-69906 CVE-2026-69890 CVE-2026-69874 CVE-2026-69864 CVE-2026-69860 CVE-2026-69858 CVE-2026-69854 CVE-2026-69852 CVE-2026-69846 CVE-2026-69845 CVE-2026-69829 CVE-2026-69827 CVE-2026-69820 CVE-2026-69813 CVE-2026-69799 CVE-2026-69797 CVE-2026-69784 CVE-2026-69769 CVE-2026-69767 CVE-2026-69740 CVE-2026-69730 CVE-2026-69725 CVE-2026-69712 CVE-2026-69710 CVE-2026-69678 CVE-2026-69676 CVE-2026-69649 CVE-2026-69632 CVE-2026-69603 CVE-2026-69601 CVE-2026-69595 CVE-2026-69590 CVE-2026-69579 CVE-2026-69530 CVE-2026-69518 CVE-2026-69501 CVE-2026-69499 CVE-2026-69285 CVE-2026-67643 CVE-2026-67636 CVE-2026-67631 CVE-2026-67378 CVE-2026-65772 CVE-2026-65669 CV...

CVE ID :CVE-2026-87737 Published : Sept. 9, 2026, 5:18 a.m. | 15 minutes ago Description :An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. There is a timing side channel for NIST elliptic-curve scalar multiplication: the time required for a lookup can depend on a secret. Severity: 5.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-87733 Published : Sept. 9, 2026, 5:18 a.m. | 15 minutes ago Description :An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets accept 0x00, the encoding of the point at infinity, as a public key. With that public key, signatures can be forged without a private key. Severity: 6.2 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-87734 Published : Sept. 9, 2026, 5:18 a.m. | 15 minutes ago Description :An issue was discovered in the utcp package before 0.0.6 for OCaml. Out-of-order segment reassembly allows remote denial of service. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-87735 Published : Sept. 9, 2026, 5:18 a.m. | 15 minutes ago Description :An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. There is an undocumented exception for a small message during RSA decryption or encryption. Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-87736 Published : Sept. 9, 2026, 5:18 a.m. | 15 minutes ago Description :An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. There is an EC public key out-of-bounds read for compressed points. Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-87732 Published : Sept. 9, 2026, 5:18 a.m. | 15 minutes ago Description :An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticate_decrypt_into and Chacha20.authenticate_decrypt_into functions write the decrypted plaintext into a caller-provided buffer and only then compares the tag. On a forged tag, the functions returns false, but the destination buffer already holds the full plaintext. Severity: 6.2 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-21107 Published : Sept. 9, 2026, 5:17 a.m. | 16 minutes ago Description :Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows local attackers to write out-of-bounds memory. Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-21113 Published : Sept. 9, 2026, 5:17 a.m. | 16 minutes ago Description :Improper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call without proper permission. Severity: 4.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...