News & Sicurezza

CVE-2026-20223 — Cisco Secure Workload Authentication Bypass May 22, 2026CVE-2026-20223 is assigned a maximum CVSS base score of 10.0. The vulnerability allows remote, completely unauthenticated threat actors to cross isolated tenant boundaries and gain full co ... Read more Published Date: May 22, 2026 (19 hours, 27 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-20223

The WP ERP Pro plugin for WordPress is vulnerable to SQL Injection via the 'search_key' parameter in all versions up to, and including, 1.5.1. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE ID :CVE-2026-4834 Published : May 22, 2026, 4:16 a.m. | 6 hours, 3 minutes ago Description :The WP ERP Pro plugin for WordPress is vulnerable to SQL Injection via the 'search_key' parameter in all versions up to, and including, 1.5.1. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-9054 Published : May 22, 2026, 4:16 a.m. | 6 hours, 3 minutes ago Description :An attacker sending tcp, il, rudp, rudp, or gre packets with a length less than the header size would trigger a kernel panic. Severity: 9.2 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-9053 Published : May 22, 2026, 4:16 a.m. | 6 hours, 3 minutes ago Description :Mothra would respect a default value given by a website for HTML file upload forms. An attacker could craft a website with a malicious default file path, and then conceal this form element. Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-42508 Published : May 22, 2026, 4:16 a.m. | 4 hours, 3 minutes ago Description :Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-46595 Published : May 22, 2026, 4:16 a.m. | 4 hours, 3 minutes ago Description :Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-46598 Published : May 22, 2026, 4:16 a.m. | 6 hours, 3 minutes ago Description :For certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-39829 Published : May 22, 2026, 4:16 a.m. | 4 hours, 3 minutes ago Description :The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-39834 Published : May 22, 2026, 4:16 a.m. | 4 hours, 3 minutes ago Description :When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-39831 Published : May 22, 2026, 4:16 a.m. | 4 hours, 3 minutes ago Description :The Verify() method for FIDO/U2F security key types ([email protected], [email protected]) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a "no-touch-required" extension in Permissions.Extensions from PublicKeyCallback. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-39827 Published : May 22, 2026, 4:16 a.m. | 2 hours, 2 minutes ago Description :An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...