News & Sicurezza

CVE ID :CVE-2025-32745 Published : May 22, 2026, 1:23 p.m. | 56 minutes ago Description :Dell PowerFlex Manager, version(s) Severity: 4.2 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-9277 Published : May 22, 2026, 1:22 p.m. | 57 minutes ago Description :shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`. The `.op` field was backslash-escaped character by character using `/(.)/g`, which in JavaScript does not match line terminators (\n, \r, U+2028, U+2029). A line terminator in `.op` therefore passed through unescaped into the output; POSIX shells treat a literal newline as a command separator, so any content after it would execute as a second command. The vulnerable code path is reachable in two ways: (1) direct construction of `{ op: '...\n...' }` from external input, and (2) via `parse(cmd, envFn)` when `envFn` returns object tokens whose `.op` is attacker-influenced. Both are documented API surface. Fixed by replacing the per-character escape with strict shape validation: `.op` must match the parser's control-operator allowlist; `{ op: 'glob', pattern }` validates `pattern` and forbids line terminators; `{ comment }` validates `comment` and forbids line terminators; any other object shape throws `TypeError`. Severity: 9.2 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-8673 Published : May 22, 2026, 1:18 p.m. | 1 hour, 1 minute ago Description :Unprotected transport of credentials vulnerability in syslink software AG Avantra on Linux, Windows allows Sniffing Attacks. This issue affects Avantra: before 25.3.0. Severity: 5.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-8672 Published : May 22, 2026, 1:17 p.m. | 1 hour, 2 minutes ago Description :Use of default password vulnerability in syslink software AG Avantra on Linux, Windows allows Try Common or Default Usernames and Passwords. This issue affects Avantra: before 25.3.0. Severity: 5.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-8671 Published : May 22, 2026, 1:15 p.m. | 1 hour, 4 minutes ago Description :Insertion of sensitive information into log file vulnerability in syslink software AG Avantra on Linux, Windows allows Resource Leak Exposure. This issue affects Avantra: before 25.3.0. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-32746 Published : May 22, 2026, 1:13 p.m. | 1 hour, 6 minutes ago Description :Dell PowerFlex Manager, version(s) Severity: 4.0 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-8670 Published : May 22, 2026, 1:12 p.m. | 1 hour, 6 minutes ago Description :Insufficient session expiration vulnerability in syslink software AG Avantra on Linux, Windows allows Reusing Session IDs (aka Session Replay). This issue affects Avantra: before 25.3.1. Severity: 9.6 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-32747 Published : May 22, 2026, 1:02 p.m. | 1 hour, 17 minutes ago Description :Dell PowerFlex Manager, version(s) Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Kritieke Ubiquiti-lekken geven aanvaller toegang tot UniFi OS-apparaten Netwerkfabrikant Ubiquiti heeft updates uitgerold voor vijf kwetsbaarheden waardoor aanvallers toegang tot UniFi OS-apparaten kunnen krijgen. De impact van drie beveiligingslekken is beoordeeld met ee ... Read more Published Date: May 22, 2026 (2 days, 19 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-34909 CVE-2026-34908 CVE-2026-33000

CVE ID :CVE-2025-32749 Published : May 22, 2026, 12:48 p.m. | 1 hour, 31 minutes ago Description :Dell PowerFlex Manager, version(s) Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-44417 Published : May 22, 2026, 12:17 p.m. | 2 hours, 2 minutes ago Description :The fix for CVE-2025-48913: Apache CXF: Untrusted JMS configuration can lead to RCE was not complete, meaning that another path in the code might lead to code execution capabilities, if untrusted users are allowed to configure JMS for Apache CXF. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-44618 Published : May 22, 2026, 12:17 p.m. | 2 hours, 2 minutes ago Description :Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...