News & Sicurezza

Two Unitree G1 EDU Humanoid Robot Flaws Enable Root RCE, One Starts Over Bluetooth Security researcher Olivier Laflamme has disclosed two independent root remote code execution (RCE) chains affecting the Unitree G1 EDU, including a Bluetooth Low Energy (BLE) path that can reach root ... Read more Published Date: Aug 28, 2026 (4 days, 20 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-76640 CVE-2026-76639 CVE-2026-58231

NCSC: Grote kans op misbruik en schade door kritiek Exchange-lek Het Nationaal Cyber Security Centrum (NCSC) waarschuwt organisaties dat er een grote kans is op misbruik van een kritieke kwetsbaarheid in Microsoft Exchange en dit tot grote schade kan leiden. Organi ... Read more Published Date: Aug 28, 2026 (4 days, 20 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-62911

ServiceNow waarschuwt voor kritieke CVSS 10.0-lekken in AI-platform Softwarebedrijf ServiceNow waarschuwt voor meerdere kritieke kwetsbaarheden in het eigen AI-platform waardoor ongeauthenticeerde aanvallers code op het platform kunnen uitvoeren en toegang tot data ku ... Read more Published Date: Aug 28, 2026 (4 days, 18 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-74820 CVE-2026-18886 CVE-2026-18885 CVE-2026-6875

Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Code and SQL ServiceNow has released patches for four security flaws impacting the ServiceNow AI Platform, three of them rated 10.0 on the CVSS scoring system and exploitable, in certain circumstances, by an unaut ... Read more Published Date: Aug 28, 2026 (4 days, 18 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-74820 CVE-2026-6876 CVE-2026-18886 CVE-2026-18885 CVE-2026-58231 CVE-2026-6875

The Cyber Express Weekly Roundup: Exploited Entra ID Flaw, AI Agent Risks, and Global Cybercrime Crackdown This weekly roundup highlights a broad range of cybersecurity and technology developments affecting cloud identity infrastructure, social media platforms, businesses, digital assets, and international ... Read more Published Date: Aug 28, 2026 (4 days, 18 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-69836

CVE ID :CVE-2026-82111 Published : Aug. 28, 2026, 11 a.m. | 1 hour, 8 minutes ago Description :A vulnerability was detected in iswalle getnote-mcp up to 1.5.0. The affected element is the function fs.readFileSync of the file src/index.ts of the component upload_image. Performing a manipulation of the argument image_path results in path traversal. The attack can be initiated remotely. The exploit is now public and may be used. Upgrading to version 1.5.1 is sufficient to fix this issue. The patch is named 7f9a215e03575c650d38c8f87fc6d8d363fed80d. Upgrading the affected component is advised. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access VulnCheck has disclosed two previously undocumented factory implants in firmware for routers built by Shenzhen Zhibotong Electronics (ZBT), each of which gives an unauthenticated remote attacker the a ... Read more Published Date: Aug 28, 2026 (4 days, 9 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-74233 CVE-2026-74232 CVE-2026-58231 CVE-2026-66747

CVE ID :CVE-2026-82258 Published : Aug. 28, 2026, 12:16 p.m. | 1 hour, 52 minutes ago Description :SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users' concurrent requests. Severity: 5.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-82257 Published : Aug. 28, 2026, 12:16 p.m. | 1 hour, 52 minutes ago Description :SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling application functionality. Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-82256 Published : Aug. 28, 2026, 12:16 p.m. | 1 hour, 52 minutes ago Description :SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-82255 Published : Aug. 28, 2026, 12:16 p.m. | 1 hour, 52 minutes ago Description :gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers after HTTP redirects. The vulnerability occurs because credential validation checks the original URL instead of the effective URL after redirect, allowing attackers to steal authentication tokens through cross-domain redirects or HTTPS-to-HTTP downgrades. Severity: 6.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-82250 Published : Aug. 28, 2026, 12:16 p.m. | 1 hour, 52 minutes ago Description :gitoxide gix-packetline versions before 0.21.5 contain a panic vulnerability in the TextRef implementation that occurs when processing side-band packet lines with empty payloads. A malicious Git server can send a crafted side-band packet to trigger an index out of bounds panic, aborting the client process during fetch operations without authentication. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...