News & Sicurezza

CVE ID :CVE-2026-84135 Published : Sept. 1, 2026, 12:19 p.m. | 54 minutes ago Description :Other issue in Firefox Focus for Android. This vulnerability was fixed in Firefox 155. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-84134 Published : Sept. 1, 2026, 12:19 p.m. | 54 minutes ago Description :Other issue in the Profile Backup component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-84133 Published : Sept. 1, 2026, 12:18 p.m. | 54 minutes ago Description :Site isolation issue in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-84132 Published : Sept. 1, 2026, 12:18 p.m. | 54 minutes ago Description :Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-84130 Published : Sept. 1, 2026, 12:18 p.m. | 54 minutes ago Description :Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-84129 Published : Sept. 1, 2026, 12:18 p.m. | 54 minutes ago Description :Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 155 and Firefox ESR 153.2. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-84128 Published : Sept. 1, 2026, 12:18 p.m. | 54 minutes ago Description :Privilege escalation in the WebDriver BiDi component. This vulnerability was fixed in Firefox 155. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyExceptions, the less restrictive exception takes precedence, allowing an attacker to bypass the policy by crafting a resource name that matches the second exception's name pattern (e.g., '*ingress*'). This can be used to circumvent policies such as one blocking hostPath volumes. Fixed in v1.13.0.

Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature. The URL field in a Policy's ServiceCall configuration is not validated, so a user with namespace-level Policy creation permissions can direct Kyverno to make HTTP requests to arbitrary internal resources (e.g., cloud metadata endpoints such as 169.254.169.254 or other tenants' resources). Because Kyverno executes these requests using its cluster-wide high-privilege ServiceAccount (a Confused Deputy problem), the responses—potentially including other tenants' secrets and cloud IAM credentials—are returned in the PolicyReport and can be read by the attacker, breaking multi-tenant isolation.

Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send arbitrary HTTP requests by injecting user-controlled input through variable substitution. Attackers can target internal services, cloud metadata endpoints, and loopback addresses, with response data reflected in admission error messages enabling non-blind data exfiltration.

LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sourced data without escaping. An attacker who controls a monitored network device can inject arbitrary JavaScript through SNMP interface descriptions or syslog program fields that executes when authenticated users view affected pages.

LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable Oxidized integration URL (oxidized.url) into the device showconfig page without applying htmlspecialchars(). An administrator who points the Oxidized URL at an attacker-controlled server (SSRF) can cause it to return malicious JSON, resulting in stored/persistent cross-site scripting affecting all users who view any device's showconfig tab. Fixed in 26.7.0.