News & Sicurezza

CVE ID :CVE-2026-82248 Published : Aug. 28, 2026, 12:16 p.m. | 1 hour, 52 minutes ago Description :gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. gix_worktree_state::checkout() follows an existing terminal symlink during non-exclusive (incremental) materialization (destination_is_initially_empty: false) when core.symlinks is true. If a symlink entry (mode 120000) is first checked out at a path P pointing outside the worktree, a subsequent incremental checkout of a regular-file entry (mode 100644) at the same path follows the existing reparse point and writes the blob content through the link, overwriting files outside the worktree. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-82249 Published : Aug. 28, 2026, 12:16 p.m. | 1 hour, 52 minutes ago Description :gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return credentials for attacker-specified hosts instead of the requested URL. Severity: 3.1 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-82238 Published : Aug. 28, 2026, 12:16 p.m. | 1 hour, 52 minutes ago Description :filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declared Upload-Length by sending concurrent PATCH requests. Attackers can send multiple simultaneous PATCH requests at the same offset to bypass length validation, resulting in files that exceed their declared size and triggering completion hooks for oversized uploads. Severity: 3.1 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Filipijns nucleair onderzoeksinstituut gehackt via kritiek ownCloud-lek Aanvallers hebben een Filipijns nucleair onderzoeksinstituut door middel van een bekende kritieke kwetsbaarheid in ownCloud weten te hacken, zo meldt cybersecuritybedrijf Hunt.io. Bij de aanval zou ne ... Read more Published Date: Aug 28, 2026 (4 days, 6 hours ago) Vulnerabilities has been mentioned in this article. CVE-2023-49105

Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server cPanel has released patches for a security flaw affecting domain parking and addon domain functionality in cPanel and WebHost Manager (WHM), which could allow code execution as the root user. The vuln ... Read more Published Date: Aug 28, 2026 (4 days, 2 hours ago) Vulnerabilities has been mentioned in this article.

PaperCut Zero-Day Exploited in Attacks, Affecting All NG and MF Versions PaperCut has alerted customers that bad actors are actively exploiting a vulnerability impacting all versions of its PaperCut NG and PaperCut MF print management software in zero-day attacks. The comp ... Read more Published Date: Aug 28, 2026 (3 days, 23 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-58231 CVE-2023-27350

CVE ID :CVE-2026-80703 Published : Aug. 28, 2026, 8:16 a.m. | 1 hour, 51 minutes ago Description :In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix missing authorization check in KFD_IOC_DBG_TRAP_DISABLE Prevent unauthorized termination of active GPU debug sessions. Previously, users with /dev/kfd access could terminate another process's debug session without proper ownership or ptrace authorization. (cherry picked from commit 4db4c5ffd5585b72622ecf6ffedf2da258ee23f5) Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.1. This is due to inconsistent and ambiguous HMAC message construction between the unauthenticated `wdpsso_step1` and `wdpsso_step2` AJAX actions, where step 1 signs and discloses an unseparated concatenation of the token, state, redirect, and domain values, while step 2 verifies an unseparated concatenation that omits the domain field. This makes it possible for unauthenticated attackers, on sites connected to WPMU DEV with Hub SSO enabled and mapped to an administrator, to obtain a valid HMAC from step 1 and replay it to step 2 by moving the domain value into the redirect field, resulting in an authenticated administrator session.

The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to Stored Cross-Site Scripting via customer name fields in versions up to and including 2.2. This is due to an authentication bypass where the AddBookingCommand explicitly skips nonce verification (Command.php line 186), allowing unauthenticated users to submit booking data. While the plugin applies sanitize_text_field() to customer firstName and lastName fields (BookingApplicationService.php lines 302-308), this function only removes HTML tags and preserves special characters including double quotes. The vulnerability manifests in the administrative Calendar view where a FullCalendar eventContent callback interpolates customer names directly into JavaScript template literals (redesign/dist/index.js line 199) and renders them via innerHTML without proper HTML entity encoding. Because double quotes are preserved, an attacker can inject payloads like '" onmouseover="alert(document.cookie)"' to break out of the title attribute and inject malicious event handlers. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute when an administrator accesses the Calendar page and hovers over the malicious appointment.

The wpForo Forum plugin for WordPress is vulnerable to SQL Injection via the 'referer' parameter in all versions up to, and including, 2.4.17. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in extract domain in Synology Chat Server before 2.4.5-22148 allows remote authenticated users, via a UI interaction, to read or write arbitrary files and conduct denial-of-service attacks in DSM.

Beveiligingslek in IPv6-systeem Linux-kernel misbruikt bij aanvallen meldt VS Een beveiligingslek in een IPv6-subsysteem van de Linux-kernel wordt misbruikt bij aanvallen, zo waarschuwt het Amerikaanse cyberagentschap CISA. Via de kwetsbaarheid (CVE-2026-53362) kan een aanvalle ... Read more Published Date: Aug 28, 2026 (3 days, 10 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-53362