News & Sicurezza

CVE ID :CVE-2026-32563 Published : Aug. 24, 2026, 10:16 p.m. | 1 hour, 47 minutes ago Description :Subscriber PHP Object Injection in ACPT (Pro) - Custom Post Types Plugin for WordPress Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-32561 Published : Aug. 24, 2026, 10:16 p.m. | 1 hour, 47 minutes ago Description :Subscriber Privilege Escalation in Booking Hub Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-32560 Published : Aug. 24, 2026, 10:16 p.m. | 1 hour, 47 minutes ago Description :Subscriber Local File Inclusion in MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-32559 Published : Aug. 24, 2026, 10:16 p.m. | 1 hour, 47 minutes ago Description :Subscriber Arbitrary File Upload in UltimateAI Severity: 9.9 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-32556 Published : Aug. 24, 2026, 10:16 p.m. | 1 hour, 47 minutes ago Description :Unauthenticated Cross Site Scripting (XSS) in Boost Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-32554 Published : Aug. 24, 2026, 10:16 p.m. | 1 hour, 47 minutes ago Description :Unauthenticated SQL Injection in WooBeWoo Product Filter Pro Severity: 9.3 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-32555 Published : Aug. 24, 2026, 10:16 p.m. | 1 hour, 47 minutes ago Description :Unauthenticated SQL Injection in Boost Severity: 9.3 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-27364 Published : Aug. 24, 2026, 10:16 p.m. | 1 hour, 47 minutes ago Description :Subscriber Broken Access Control in Style Kits Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-78284 Published : Aug. 24, 2026, 10:17 p.m. | 1 hour, 47 minutes ago Description :Unauthenticated Arbitrary File Deletion in MasterStudy LMS Severity: 8.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-78434 Published : Aug. 24, 2026, 10:17 p.m. | 1 hour, 47 minutes ago Description :A flaw has been found in Faveo Helpdesk up to 2.0.3. This impacts the function FormController::post_ticket_reply of the file app/Http/Controllers/Client/helpdesk/FormController.php of the component post-ticket-reply Endpoint. This manipulation causes missing authentication. The attack can be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-77337 Published : Aug. 24, 2026, 10:17 p.m. | 1 hour, 47 minutes ago Description :CakePHP Authentication is an authentication plugin for CakePHP that can also be used in PSR-7 based applications. Versions before 2.11.2, from 3.0.0 through 3.3.6, and from 4.0.0 through 4.2.0 allow authentication bypass and potential CPU or memory exhaustion when CookieAuthenticator uses unencrypted, forgeable legacy tokens. This issue is fixed in versions 2.11.2, 3.3.7, and 4.2.1. Severity: 9.1 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-17113 Published : Aug. 24, 2026, 9:22 p.m. | 41 minutes ago Description :A flaw was found in CRI-O's container-creation environment-variable handling (`mergeEnvs` in `server/utils.go`, consumed by `setupContainerEnvironmentAndWorkdir` in `server/container_create.go`). When a `CreateContainer` request supplies a `nil` CRI `Envs` field, CRI-O falls back to using the target OCI image's `config.Env` entries unfiltered, in contrast to the normal merge path, which validates each entry for a `key=value` form before use. An OCI image whose `config.Env` contains an entry with no `=` character (e.g. a bare `NOEQUALS` string) causes CRI-O to split that entry into a single-element slice and then index its second element, which is out of range. This triggers an unrecovered Go runtime panic in the `crio` daemon process, crashing it and terminating the container-runtime service for all workloads on the node until it is restarted. Severity: 6.0 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...