News & Sicurezza

CVE ID :CVE-2026-82909 Published : Aug. 31, 2026, 9:17 p.m. | 2 hours, 51 minutes ago Description :A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.0.0-rc.17 can resolve this issue. This patch is called 0d5995eb63f8801d32eb32fbe74b75b68752bfa9. The affected component should be upgraded. Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-82906 Published : Aug. 31, 2026, 9:17 p.m. | 2 hours, 51 minutes ago Description :A flaw has been found in sdcb chats up to 1.12.0. This impacts the function DownloadPublic of the file src/BE/web/Controllers/Chats/Files/FileController.cs of the component Signed File Download Endpoint. This manipulation causes missing authentication. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitability is said to be difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 3.7 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-82852 Published : Aug. 31, 2026, 9:17 p.m. | 2 hours, 51 minutes ago Description :Unauthenticated Server Side Request Forgery (SSRF) in MapSVG Severity: 5.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-82392 Published : Aug. 31, 2026, 9:17 p.m. | 51 minutes ago Description :pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys with dp.parse(depPath).name and uses it without validation in deps/graph-builder/src/lockfileToDepGraph.ts and pnpm11/deps/graph-builder/src/lockfileToDepGraph.ts. The name reaches path.join(modules, pkgName), storeController.importPackage, and pnpm11/lockfile/to-pnp/src/index.ts, allowing package contents to be written outside node_modules when a user runs pnpm install. When dangerouslyAllowAllBuilds or a matching allowBuilds entry permits lifecycle scripts, the escaped package can execute code with the user's privileges. This issue is fixed in versions 10.34.5 and 11.11.0. Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-82914 Published : Aug. 31, 2026, 9:17 p.m. | 2 hours, 51 minutes ago Description :A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument Contact results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-82908 Published : Aug. 31, 2026, 9:17 p.m. | 2 hours, 51 minutes ago Description :A vulnerability was found in MSI Dragon Center up to 2.0.155.0. Affected by this vulnerability is the function MmioWritePath in the library NTIOLib_X64.sys of the component MMIO Write Path Handler. Performing a manipulation of the argument count/elementSize results in integer overflow. The attack requires a local approach. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-82346 Published : Aug. 31, 2026, 9:17 p.m. | 51 minutes ago Description :A potential security vulnerability has been identified in the HP ImageDiags for versions prior to 5.0.0.36. The vulnerability could potentially allow a local attacker to escalate privileges due to insufficient access controls. Severity: 7.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-82228 Published : Aug. 31, 2026, 9:17 p.m. | 51 minutes ago Description :Unauthenticated Bypass Vulnerability in SiteGround Security Severity: 8.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-82225 Published : Aug. 31, 2026, 9:17 p.m. | 51 minutes ago Description :Unauthenticated Broken Authentication in RegistrationMagic Severity: 7.4 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-82229 Published : Aug. 31, 2026, 9:17 p.m. | 51 minutes ago Description :Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-82224 Published : Aug. 31, 2026, 9:17 p.m. | 51 minutes ago Description :Unauthenticated Cross Site Scripting (XSS) in SliceWP Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-82221 Published : Aug. 31, 2026, 9:17 p.m. | 51 minutes ago Description :Unauthenticated Cross Site Scripting (XSS) in RegistrationMagic Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...