News & Sicurezza

CVE ID :CVE-2026-68516 Published : Aug. 24, 2026, 10:17 p.m. | 1 hour, 47 minutes ago Description :OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. From version 3.4.0 through 3.4.13, a crafted HTJ2K-compressed EXR can crash OpenEXR during normal decode. An HTJ2K-compressed EXR whose JPEG 2000 SIZ fields place the first tile outside the visible image can reach invalid tile and codeblock geometry in the vendored OpenJPH AVX2 decoder, causing a stack out-of-bounds write and denial of service. OpenEXR's HTJ2K path validates the decoded codestream dimensions against the EXR chunk size, but it does not reject SIZ image-offset/tile-grid geometry where the first tile does not intersect the image. This issue is fixed in version 3.4.14. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-77384 Published : Aug. 24, 2026, 10:17 p.m. | 1 hour, 47 minutes ago Description :libp2p is a JavaScript implementation of the libp2p networking stack. Prior to version 4.2.9, the reservation refresh path in reservation-store.ts reuses the same retimeableSignal but unconditionally registers another abort listener on every refresh. As a result, a remote peer can repeatedly send valid RESERVE requests for the same reservation, causing unbounded listener and closure growth in @libp2p/circuit-relay-v2 relay servers and leading to denial of service. This issue is fixed in version 4.2.9. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-78435 Published : Aug. 24, 2026, 10:17 p.m. | 1 hour, 47 minutes ago Description :A vulnerability has been found in Faveo Helpdesk up to 2.0.3. Affected is the function unlink of the file app/Http/Controllers/Admin/helpdesk/SettingsController.php of the component Logo Handler. Such manipulation of the argument data1 leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet. Severity: 4.7 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-78282 Published : Aug. 24, 2026, 10:17 p.m. | 1 hour, 47 minutes ago Description :Unauthenticated Cross Site Scripting (XSS) in Stripe Payments Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-78268 Published : Aug. 24, 2026, 10:17 p.m. | 1 hour, 47 minutes ago Description :Unauthenticated Sensitive Data Exposure in Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-78267 Published : Aug. 24, 2026, 10:17 p.m. | 1 hour, 47 minutes ago Description :Unauthenticated Privilege Escalation in TranslatePress Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-78266 Published : Aug. 24, 2026, 10:17 p.m. | 1 hour, 47 minutes ago Description :Subscriber Broken Access Control in AutomatorWP Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-78264 Published : Aug. 24, 2026, 10:17 p.m. | 1 hour, 47 minutes ago Description :Unauthenticated Cross Site Scripting (XSS) in Toolset Blocks Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-78265 Published : Aug. 24, 2026, 10:17 p.m. | 1 hour, 47 minutes ago Description :Unauthenticated PHP Object Injection in The Events Calendar Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-78263 Published : Aug. 24, 2026, 10:17 p.m. | 1 hour, 47 minutes ago Description :Unauthenticated Cross Site Scripting (XSS) in Event Tickets Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-78262 Published : Aug. 24, 2026, 10:17 p.m. | 1 hour, 47 minutes ago Description :Unauthenticated PHP Object Injection in WP Project Manager Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-78259 Published : Aug. 24, 2026, 10:17 p.m. | 1 hour, 47 minutes ago Description :Unauthenticated Broken Authentication in WPLegalPages Severity: 7.3 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...