News & Sicurezza

CVE ID :CVE-2026-21099 Published : Sept. 9, 2026, 5:17 a.m. | 16 minutes ago Description :Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local attackers to access sensitive information. Severity: 5.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-21098 Published : Sept. 9, 2026, 5:17 a.m. | 16 minutes ago Description :Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC without proper user interaction. Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-21095 Published : Sept. 9, 2026, 5:17 a.m. | 16 minutes ago Description :Heap-based buffer overflow in DNG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code. Severity: 9.2 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-21097 Published : Sept. 9, 2026, 5:17 a.m. | 16 minutes ago Description :Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Release 1 allows local privileged attackers to launch arbitrary activity. Severity: 4.6 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-21096 Published : Sept. 9, 2026, 5:17 a.m. | 16 minutes ago Description :Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbitrary code. Severity: 9.2 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Microsoft Patches Record 974 Flaws, Including Two Exploited Windows Zero-Days Microsoft on Tuesday broke Patch Tuesday records by addressing an earth-shattering 974 vulnerabilities spanning its software portfolio, including two flaws that it said have been actively exploited in ... Read more Published Date: Sep 09, 2026 (1 day, 11 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-85880 CVE-2026-81963 CVE-2026-80097 CVE-2026-72979 CVE-2026-69829 CVE-2026-69730 CVE-2026-69595 CVE-2026-69525 CVE-2026-69465 CVE-2026-65669 CVE-2026-55007 CVE-2023-21674

N-able N-central Pre-Auth RCE Flaw Exploited in the Wild The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a maximum-severity security flaw impacting N-able N-central to its Known Exploited Vulnerabilities (KEV) catalog, requ ... Read more Published Date: Sep 09, 2026 (1 day, 8 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-86218 CVE-2026-86206 CVE-2026-86207

The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability only affects multi-input sub-field types within a repeater (such as Name, Address, and Checkbox fields), as scalar single-input field values are escaped with esc_html() at the output stage in version 3.0.4.

The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec_ajax_save_page_default_options() AJAX handler iterating over every $_POST key and passing it directly into update_option() without any allowlist, while gating the handler only on 'manage_options' OR the plugin's custom 'wpec_manager' capability. The plugin's built-in 'wpec_store_manager' role holds 'wpec_manager' but not 'manage_options', and the required nonce is emitted on frontend product/category templates that render for any user with 'wpec_manager'. This makes it possible for authenticated attackers, with Store Manager-level access and above, to elevate their privileges to administrator by updating arbitrary WordPress options such as default_role='administrator' and users_can_register='1', then self-registering a new account that is assigned the administrator role.

CVE ID :CVE-2026-81644 Published : Sept. 9, 2026, 3:25 a.m. | 8 minutes ago Description :DoS vulnerability in the preview service module. Impact: Successful exploitation of this vulnerability may affect availability. Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-49312 Published : Sept. 9, 2026, 3:23 a.m. | 10 minutes ago Description :Permission control vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. Severity: 4.0 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-49310 Published : Sept. 9, 2026, 3:22 a.m. | 11 minutes ago Description :Permission control vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. Severity: 8.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...