News & Sicurezza

No Password Required: 9.8 Severity ELECOM Router Flaws Allow Total Network Takeover In a major security disclosure, JPCERT/CC has issued an urgent advisory regarding multiple high-severity vulnerabilities discovered in various wireless LAN routers and access points provided by ELECOM ... Read more Published Date: May 15, 2026 (17 hours, 48 minutes ago) Vulnerabilities has been mentioned in this article.

Cisco SD-WAN Manager XXE Flaw Grants Unauthenticated Access to Private Files Cisco has detailed the curtain on a fresh set of vulnerabilities haunting its Catalyst SD-WAN Manager (formerly vManage). These flaws could grant remote attackers the keys to your sensitive data or al ... Read more Published Date: May 15, 2026 (18 hours, 4 minutes ago) Vulnerabilities has been mentioned in this article.

Critical 9.2 CVSS RCE Found in Amazon Redshift JDBC Driver Security teams are being urged to move quickly following the disclosure of a critical Remote Code Execution (RCE) vulnerability found within the Amazon Redshift JDBC Driver. The flaw, tracked as CVE-2 ... Read more Published Date: May 15, 2026 (16 hours, 14 minutes ago) Vulnerabilities has been mentioned in this article.

Critical 9.4 CVSS pgAdmin 4 Flaws Enable Full OS Command Execution In a major security overhaul, pgAdmin, the world’s most popular open-source administration platform for PostgreSQL, has released version 9.15 to address a cluster of dangerous vulnerabilities. The upd ... Read more Published Date: May 15, 2026 (14 hours, 30 minutes ago) Vulnerabilities has been mentioned in this article.

Kubernetes Alert: 9.4 Severity RCE in CloudNativePG Enables PostgreSQL Superuser Takeover In a critical discovery for Kubernetes-based database environments, researchers have unveiled a severe privilege escalation and Remote Code Execution (RCE) vulnerability in CloudNativePG (CNPG). The f ... Read more Published Date: May 15, 2026 (14 hours, 49 minutes ago) Vulnerabilities has been mentioned in this article.

Exploited in the Wild: Critical OWA Spoofing Flaw (CVE-2026-42897) Hits On-Premises Exchange Servers Microsoft has issued an urgent warning for organizations running on-premises email infrastructure. A newly disclosed vulnerability in Outlook Web Access (OWA) is being actively hunted in the wild, all ... Read more Published Date: May 15, 2026 (12 hours, 53 minutes ago) Vulnerabilities has been mentioned in this article.

79 Security Holes Sealed: Google Issues Urgent Chrome Update to Fix 14 “Critical” Vulnerabilities Google has unleashed a major security update for the Chrome Stable channel, addressing a staggering 79 security fixes that range from internal logic errors to high-stakes remote execution threats. The ... Read more Published Date: May 15, 2026 (11 hours, 27 minutes ago) Vulnerabilities has been mentioned in this article.

Exploited in the Wild: Maximum CVSS 10 SD-WAN Flaw (CVE-2026-20182) Grants Admin Control Cisco Talos has issued a high-priority warning regarding the active, in-the-wild exploitation of several critical vulnerabilities targeting the Cisco Catalyst SD-WAN infrastructure. Threat actors are ... Read more Published Date: May 15, 2026 (11 hours, 42 minutes ago) Vulnerabilities has been mentioned in this article.

CVE ID :CVE-2026-6811 Published : May 14, 2026, 10:16 p.m. | 4 hours, 14 minutes ago Description :Stack exhaustion vulnerability in the MongoDB PHP driver can cause application crashes when processing deeply nested BSON documents in unusual circumstances when the source of these BSON documents is not MongoDB Server. Severity: 5.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-45248 Published : May 14, 2026, 10:16 p.m. | 4 hours, 14 minutes ago Description :Hedera Guardian through 3.5.1 contains an authentication bypass vulnerability in the GET /api/v1/demo/registered-users endpoint that allows unauthenticated attackers to retrieve sensitive user information. Attackers can access the endpoint without providing authentication credentials to obtain usernames, Hedera DIDs, parent registry DIDs, system roles, and policy role assignments for all registered users in the system. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-44428 Published : May 14, 2026, 10:16 p.m. | 4 hours, 14 minutes ago Description :The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. Prior to 1.7.6, the client-side and server-side GitHub OIDC flow is bound only to a global audience string, not to the specific registry instance being targeted. On the client side, the publisher always appends audience=mcp-registry when requesting the GitHub Actions ID token, regardless of the selected --registry URL. On the server side, the exchange endpoint validates only that same fixed audience and then derives publish permissions directly from repository_owner. As a result, a token legitimately obtained while interacting with one registry deployment remains acceptable to any other deployment that shares the same code and audience string. This vulnerability is fixed in 1.7.6. Severity: 2.1 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-44427 Published : May 14, 2026, 10:16 p.m. | 4 hours, 14 minutes ago Description :The MCP Registry provides MCP clients with a list of MCP servers, like an app store for MCP servers. From 1.1.0 to 1.7.4, the TrailingSlashMiddleware in internal/api/server.go is vulnerable to an open redirect attack. An attacker can craft a URL with a protocol-relative path (e.g., //evil.com/) that, after trailing slash removal, results in a Location header of //evil.com — which browsers interpret as an absolute URL to an external domain. This vulnerability is fixed in 1.7.5. Severity: 0.0 | NONE Visit the link for more details, such as CVSS details, affected products, timeline, and more...