News & Sicurezza

Nine-year-old Linux Kernel Vulnerability Let Attackers Exfiltrate SSH Private Keys A newly disclosed Linux kernel vulnerability, tracked as CVE-2026-46333, exposes a serious local privilege escalation flaw that has remained undetected for nearly nine years. Security researchers at t ... Read more Published Date: May 21, 2026 (1 day, 6 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-46333

New Microsoft Defender 0‑Days Actively Exploited in the Wild Two newly disclosed Microsoft Defender vulnerabilities are being actively exploited in the wild, enabling local attackers to elevate privileges to SYSTEM and potentially disrupt endpoint protection ac ... Read more Published Date: May 21, 2026 (1 day, 4 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-45498 CVE-2026-41091

CVE ID :CVE-2026-45254 Published : May 21, 2026, 10:16 a.m. | 2 hours, 1 minute ago Description :In the case of the cap_net service, when a key present in the old limit was omitted from the new limit, the missing key was treated as "allow any" instead of being rejected. In certain scenarios, an application that had previously restricted a subset of network operations could ask for a new limit that extended the permissions of the process. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-41999 Published : May 21, 2026, 10:16 a.m. | 2 hours, 1 minute ago Description :Incorrect Behaviour of Views with TCP PROXY Requests Severity: 4.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-45255 Published : May 21, 2026, 10:16 a.m. | 2 hours, 1 minute ago Description :When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they build up a list of network names and use bsddialog(1) to prompt the user to select a network. This is implemented using a shell script, and the code which handled network names was not careful to prevent expansion by the shell. As a result, a suitably crafted network name can be used to execute commands via a subshell. The problem can be exploited to execute code as root on the system running bsdinstall or bsdconfig. The attacker would need to create an access point with a specially crafted name and be within range of a Wi-Fi scan. Note that bsdinstall and bsdconfig are vulnerable as soon as the user prompts them to scan for nearby networks; they do not need to actually select the malicious network. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-42002 Published : May 21, 2026, 10:16 a.m. | 2 hours, 1 minute ago Description :Concurrency and locking defects in GSS-TSIG Severity: 5.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Google ontdekt en dicht wederom kritieke kwetsbaarheden in Chrome Google heeft opnieuw kritieke kwetsbaarheden in Chrome gevonden die remote code execution mogelijk maken en er zijn updates uitgerold om de problemen te verhelpen. Een week geleden werden twaalf van d ... Read more Published Date: May 21, 2026 (1 day, 4 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-9111 CVE-2026-9110

CVE ID :CVE-2026-42001 Published : May 21, 2026, 10:16 a.m. | 2 hours, 1 minute ago Description :Insufficient Validation of Autoprimary SOA Queries Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-42000 Published : May 21, 2026, 10:16 a.m. | 2 hours, 1 minute ago Description :Insufficient Validation of Names During AXFR Severity: 6.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-42396 Published : May 21, 2026, 10:16 a.m. | 2 hours, 1 minute ago Description :Insufficient Validation of Member Zone Data May Cause Catalog Zone Transfer to Fail Severity: 4.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Critical Cisco Secure Workload Vulnerability Enables Unauthorized API Access Cisco has disclosed a critical security vulnerability in its Secure Workload platform that could allow unauthenticated attackers to gain unauthorized access to sensitive resources via internal APIs. T ... Read more Published Date: May 21, 2026 (1 day, 4 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-20223

CVE ID :CVE-2026-39461 Published : May 21, 2026, 10:16 a.m. | 2 hours, 1 minute ago Description :libcasper(3) communicates with helper processes via UNIX domain sockets, and uses the select(2) system call to wait for data to become available. However, it does not verify that its socket descriptor fits within select(2)'s descriptor set size limit of FD_SETSIZE (1024). An attacker able to cause an application using libcasper(3) to allocate large file descriptors, e.g., by opening many descriptors and executing a program which is not careful to close them upon startup, may trigger stack corruption. If the target application runs with setuid root privileges, this could be used to escalate local privileges. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...