News & Sicurezza

CVE ID :CVE-2026-1659 Published : May 14, 2026, 6:16 a.m. | 14 minutes ago Description :GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by sending specially crafted requests due to insufficient input validation. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-1322 Published : May 14, 2026, 6:16 a.m. | 14 minutes ago Description :GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.0 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with a read_api scoped OAuth application to create issues and add comments to issues in private projects due to improper authorization. Severity: 6.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-1184 Published : May 14, 2026, 6:16 a.m. | 14 minutes ago Description :GitLab has remediated an issue in GitLab EE affecting all versions from 11.9 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an unauthenticated user to cause denial of service by uploading a specially crafted file due to improper validation. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-2900 Published : May 14, 2026, 6:16 a.m. | 14 minutes ago Description :GitLab has remediated an issue in GitLab EE affecting all versions from 16.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that when instance-level approval rule editing prevention was enabled, could have allowed an authenticated user with Maintainer permissions to modify or delete project approval rules due to missing authorization checks. Severity: 2.7 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-1338 Published : May 14, 2026, 6:16 a.m. | 14 minutes ago Description :GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.9.7, 18.10 before 18.10.6, and 18.11 before 18.11.3 that could have allowed an authenticated user with developer-role permissions to delete protected container registry tags due to improper authorization checks. Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

18-Year-Old NGINX Rewrite Module Flaw Enables Unauthenticated RCE Cybersecurity researchers have disclosed multiple security vulnerabilities impacting NGINX Plus and NGINX Open, including a critical flaw that remained undetected for 18 years. The vulnerability, disc ... Read more Published Date: May 14, 2026 (19 hours, 48 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-42946 CVE-2026-42945 CVE-2026-42934 CVE-2026-40701 CVE-2026-23918

Critical MongoDB Vulnerability Allow Attackers to Execute Arbitrary Code A newly disclosed critical vulnerability in MongoDB could allow threat actors to execute arbitrary code, potentially handing them complete control over affected servers and exposing millions of record ... Read more Published Date: May 14, 2026 (17 hours, 53 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-8053

The Gentlemen RaaS Leverages Fortinet and Cisco Edge Devices for Initial Access A ransomware group that only surfaced in mid-2025 has already made a significant mark on the threat landscape. The Gentlemen, a ransomware-as-a-service (RaaS) operation, has quickly risen to become on ... Read more Published Date: May 14, 2026 (18 hours, 2 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2025-33073 CVE-2025-32433 CVE-2024-55591

CVE ID :CVE-2026-46445 Published : May 14, 2026, 4:17 a.m. | 13 minutes ago Description :SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection. Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-5486 Published : May 14, 2026, 4:17 a.m. | 13 minutes ago Description :The Unlimited Elements for Elementor plugin for WordPress is vulnerable to SQL Injection via the 'data[filter_search]' parameter in the get_cat_addons AJAX action in versions up to and including 2.0.7. This is due to insufficient input sanitization and the use of deprecated escaping functions combined with direct string concatenation in SQL query construction. The vulnerability is exacerbated because the normalizeAjaxInputData() function calls stripslashes() on all user input, removing the protection provided by WordPress's wp_magic_quotes() function. Subsequently, the filter_search parameter is escaped using the deprecated wpdb->_escape() function and then directly concatenated into a LIKE clause without using prepared statements. This makes it possible for authenticated attackers, with Contributor-level access and above (who can obtain a valid nonce through the Elementor editor), to inject arbitrary SQL commands and extract sensitive information from the database. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-46446 Published : May 14, 2026, 4:17 a.m. | 13 minutes ago Description :SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored, allows SQL injection. This is related to c_password = '%@' in changePasswordForLogin. Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-46419 Published : May 14, 2026, 2:17 a.m. | 2 hours, 13 minutes ago Description :Yubico webauthn-server-core (aka java-webauthn-server) 2.8.0 before 2.8.2 incorrectly checks a function's return value in the second factor flow, leading to impersonation. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...