News & Sicurezza

CVE ID :CVE-2026-80181 Published : Sept. 4, 2026, 6:52 a.m. | 27 minutes ago Description :Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-80180 Published : Sept. 4, 2026, 6:50 a.m. | 30 minutes ago Description :Stored XSS via markdown HTML processing in Apache Allura. This issue affects Apache Allura: from through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-70403 Published : Sept. 4, 2026, 6:31 a.m. | 48 minutes ago Description :XING CPTrans-ME-X contains a Use of Hard-coded Password (CWE-259). Anyone with the knowledge of the credential may log in to the affected device. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-69657 Published : Sept. 4, 2026, 6:31 a.m. | 48 minutes ago Description :XING CPTrans-ME-X contains a Use of Default Password (CWE-1393). Anyone with the knowledge of the credential may log in to the affected device. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-66840 Published : Sept. 4, 2026, 6:31 a.m. | 48 minutes ago Description :XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497). Sensitive system information may be leaked. Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-62928 Published : Sept. 4, 2026, 6:31 a.m. | 48 minutes ago Description :XING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be injected. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Two Citrix NetScaler Flaws Put Enterprise Edge Devices at Risk Two Citrix NetScaler vulnerabilities affecting Citrix NetScaler Application Delivery Controller (ADC) and Citrix NetScaler Gateway products have prompted a patching warning for Australian organisation ... Read more Published Date: Sep 04, 2026 (4 days, 2 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-83548 CVE-2026-84115 CVE-2026-19490 CVE-2026-19489

CVE ID :CVE-2026-85094 Published : Sept. 4, 2026, 7:17 a.m. | 2 hours, 3 minutes ago Description :The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-85085 Published : Sept. 4, 2026, 7:17 a.m. | 2 hours, 3 minutes ago Description :The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page loaded by the user is able to communicate with Canva using the user’s session. Severity: 9.6 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-84146 Published : Sept. 4, 2026, 7:17 a.m. | 2 hours, 3 minutes ago Description :The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.8 does not perform any capability or post-status check before rendering a WooCommerce product summary from a supplied product identifier, allowing unauthenticated visitors to retrieve the title, price, SKU, description and stock details of products that are not publicly published (draft, pending, private or scheduled status). Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-84066 Published : Sept. 4, 2026, 7:17 a.m. | 2 hours, 3 minutes ago Description :The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post being modified before writing uploaded file references to its metadata, allowing users with the subscriber role and above to overwrite image metadata on posts belonging to other users. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-82194 Published : Sept. 4, 2026, 7:17 a.m. | 2 hours, 3 minutes ago Description :The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...