News & Sicurezza

CVE ID :CVE-2026-6217 Published : Sept. 4, 2026, 8:17 a.m. | 1 hour, 3 minutes ago Description :Use of a One-Way hash without a salt vulnerability in Pik Online Software Solutions Inc. Pik Online Portal allows Cryptanalysis. This issue affects Pik Online Portal: through 3.5.1. Severity: 6.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-85229 Published : Sept. 4, 2026, 8:17 a.m. | 1 hour, 3 minutes ago Description :** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache SkyWalking Booster UI. This issue affects Apache SkyWalking UI : from 10.2.0 through 10.4.0. Users are recommended to upgrade to Horizon UI 1.0.0, which fixes the issue. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-80190 Published : Sept. 4, 2026, 8:17 a.m. | 1 hour, 3 minutes ago Description :Apache Allura: stored XSS via SVN code repositories. Git repositories are not known to be affected. The vulnerability is likely mitigated via default CSP headers. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-57777 Published : Sept. 4, 2026, 8:12 a.m. | 1 hour, 8 minutes ago Description :Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Automattic WooCommerce allows Blind SQL Injection. This issue affects WooCommerce: from n/a before 11.0. Severity: 7.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-85311 Published : Sept. 4, 2026, 8:07 a.m. | 1 hour, 13 minutes ago Description :Missing Authorization vulnerability in Kings Plugins MarketKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MarketKing: from n/a through 2.1.60. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-32480 Published : Sept. 4, 2026, 8:02 a.m. | 1 hour, 18 minutes ago Description :Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WCFM Membership: from n/a through 2.11.11. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Plex Urges Immediate Updates After Patching Multiple Undisclosed Security Flaws Plex is urging users to update their instances to the latest version following the release of an update that patches multiple security flaws. The fixes are available in Plex Media Server 1.43.3 and Pl ... Read more Published Date: Sep 04, 2026 (4 days, 18 hours ago) Vulnerabilities has been mentioned in this article. CVE-2025-34158 CVE-2020-5741

Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day Google on Thursday released security updates to patch 12 vulnerabilities, including one that has come under active exploitation in the wild. The high-severity vulnerability, tracked as CVE-2026-85046 ... Read more Published Date: Sep 04, 2026 (4 days, 9 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-85046 CVE-2026-11645 CVE-2026-5281 CVE-2026-3910 CVE-2026-3909 CVE-2026-2441

The ACPT (Premium) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0.66. This is due to missing authorization in the `submit()` function, which allows unauthenticated form submissions to control the target user ID before calling `wp_update_user()`. This makes it possible for unauthenticated attackers to overwrite any WordPress user's email address and password, including an administrator's, and take over the account. Successful exploitation requires a public ACPT user form that permits anonymous submissions.

Google waarschuwt voor actief misbruik van beveiligingslek in Chrome Google waarschuwt voor actief misbruik van een beveiligingslek in Chrome. Er zijn updates uitgebracht om het probleem te verhelpen. De kwetsbaarheid is aanwezig in V8, de JavaScript-engine die Chrome ... Read more Published Date: Sep 04, 2026 (4 days, 3 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-85046

CVE ID :CVE-2026-81270 Published : Sept. 4, 2026, 7:17 a.m. | 2 hours, 3 minutes ago Description :Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-71216 Published : Sept. 4, 2026, 6:55 a.m. | 24 minutes ago Description :PagerDuty alarm hook transmits the integration routing key over cleartext HTTP. PagerDuty serves this endpoint over HTTPS and will normally answer plain HTTP with a redirect. That does not remove the exposure. The initial POST -- including the JSON body containing the routing key -- is written to the socket unencrypted before any redirect response is received. Redirection affects only whether the request is retried securely, not whether the first copy left the host in the clear. This issue affects Apache SkyWalking: from 9.6.0 through 11.0.0. Users are recommended to upgrade to version 11.0.0, which fixes the issue. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...