News & Sicurezza

CVE ID :CVE-2026-68827 Published : 8. September 2026 17:14 | 17 Minuten ago Description :None Severity: 8.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-68831 Published : 8. September 2026 17:14 | 17 Minuten ago Description :None Severity: 5.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-68828 Published : 8. September 2026 17:14 | 17 Minuten ago Description :None Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-68780 Published : 8. September 2026 17:14 | 17 Minuten ago Description :None Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-68778 Published : 8. September 2026 17:14 | 17 Minuten ago Description :None Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-68779 Published : 8. September 2026 17:14 | 17 Minuten ago Description :None Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-68777 Published : 8. September 2026 17:14 | 17 Minuten ago Description :None Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-68776 Published : 8. September 2026 17:14 | 17 Minuten ago Description :None Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Weekly ALL-SOURCE Cyber Warfare Intelligence Brief September 8, 2026 Reporting period: August 31–September 7, 2026Focus: State and state-aligned cyber operations, APT activity, technical campaign intelligence, critical-infrastructure espionage, and campaign evolution. ... Read more Published Date: Sep 08, 2026 (1 day, 19 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-85046 CVE-2022-22965 CVE-2020-1938 CVE-2014-6271

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url() references to exfiltrate CSRF tokens from other superusers via attribute-selector rules, enabling account takeover.

Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client (`mysql`) without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as `\!` as local shell commands. An authenticated superadministrator who uploads a crafted ZIP backup (POST /admin/backups/upload) and triggers a restore (POST /admin/backups/restore/{filename}) without the optional `clean` sanitizer parameter — which is not applied by default because DB_SANITIZE_BY_DEFAULT is false — can execute arbitrary OS commands as the web application's operating-system user, exposing application secrets (including database credentials and APP_KEY) and allowing modification of application-writable files and data. Version 8.7.0 adds the --binary-mode flag to the client invocation.

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteria[withTransforms][0][class] that reaches ImageTransforms::normalizeTransform(), then use a PHP gadget chain with yii\rbac\PhpManager to execute code by pointing itemFile to a request log containing PHP payload in the User-Agent header.