News & Sicurezza

Critical PHP SOAP Extension Vulnerabilities Enables Remote Code Execution Attacks A serious cluster of vulnerabilities has been uncovered in PHP’s core string processing and ext-soap components, putting numerous web servers at immediate risk of total takeover. While the SOAP extens ... Read more Published Date: May 12, 2026 (17 hours, 6 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-6104 CVE-2026-7262 CVE-2026-7261 CVE-2026-7258 CVE-2026-6722

3500 Wazuh-servers missen update voor kritiek path traversal-lek Wereldwijd zijn er meer dan 3500 Wazuh-servers, waaronder 76 in Nederland, die een beveiligingsupdate voor een kritiek path traversal-lek missen, waardoor aanvallers in het ergste geval volledige cont ... Read more Published Date: May 12, 2026 (17 hours, 13 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-30893

CVE ID :CVE-2026-35227 Published : May 12, 2026, 8:16 a.m. | 14 minutes ago Description :An unauthenticated remote attacker may exhaust all available TCP connections in the CODESYS Modbus TCP Server stack if a race condition in connection handling is successfully exploited, preventing legitimate clients from establishing new connections. Severity: 8.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Critical 9.6 Severity: SAP May 2026 Patch Day Fixes Dangerous S/4HANA and Commerce Cloud Flaws Today, SAP released its monthly security patch update, addressing 15 new security notes. This month’s patch day is particularly significant due to the presence of two Critical vulnerabilities, both ca ... Read more Published Date: May 12, 2026 (17 hours, 32 minutes ago) Vulnerabilities has been mentioned in this article.

CVE ID :CVE-2026-39432 Published : May 12, 2026, 7:49 a.m. | 41 minutes ago Description :Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Timetics: from n/a through 1.0.53. Severity: 8.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-2300 Published : May 12, 2026, 7:48 a.m. | 42 minutes ago Description :The BJ Lazy Load plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `filter_images()` function in all versions up to, and including, 1.0.9. This is due to the use of regex-based HTML processing (`preg_replace`) that does not properly handle HTML attribute boundaries when replacing `src` attributes, allowing crafted content inside a `class` attribute value to be promoted to real DOM attributes after processing. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-7464 Published : May 12, 2026, 7:48 a.m. | 42 minutes ago Description :The WP Google Maps Integration plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `page` parameter in all versions up to, and including, 1.2. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-6247 Published : May 12, 2026, 7:48 a.m. | 42 minutes ago Description :The scratchblocks for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'element' attribute of the 'scratchblocks' shortcode in all versions up to, and including, 1.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-5028 Published : May 12, 2026, 7:48 a.m. | 42 minutes ago Description :The Eight Day Week Print Workflow plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'title' parameter in the `pp-get-articles` AJAX action in all versions up to, and including, 1.2.6. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-6256 Published : May 12, 2026, 7:48 a.m. | 42 minutes ago Description :The Credits Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the 'credits' shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-6710 Published : May 12, 2026, 7:48 a.m. | 42 minutes ago Description :The Skysa Text Ticker App plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the SkysaApps_Admin_AppPage function. This makes it possible for unauthenticated attackers to trick a site administrator into making a forged request to modify the plugin's settings, including the scrolling message text and URL, via a forged cross-site request via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-6932 Published : May 12, 2026, 7:48 a.m. | 42 minutes ago Description :The Woo Commerce Minimum Weight plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 3.0.1. This is due to missing nonce verification on the settings update handler in edit-weight.php. This makes it possible for unauthenticated attackers to modify the minimum order weight setting by tricking a site administrator into clicking a link or visiting an attacker-controlled page containing a forged POST request. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...