News & Sicurezza

CVE ID :CVE-2026-78280 Published : Aug. 24, 2026, 11:39 a.m. | 21 minutes ago Description :Unauthenticated Cross Site Request Forgery (CSRF) in Hash Form Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-78279 Published : Aug. 24, 2026, 11:39 a.m. | 21 minutes ago Description :Unauthenticated Cross Site Request Forgery (CSRF) in Fluent Support Pro Severity: 5.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the file all_users/register.php of the component User Registration. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used.

A vulnerability was detected in itsourcecode Real Estate Management System 1.0. Affected by this issue is some unknown functionality of the file search.php. Performing a manipulation of the argument search/delivery_type/search_price/property_type results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used.

Hugo's security.http.urls allowlist is the only control on outbound fetches made by resources.GetRemote, and it inspects the URL text alone. CheckAllowedHTTPURL in config/security/securityConfig.go applies the configured pattern list and then re-checks a canonicalised form of an integer, hex or octal IPv4 host, but it never resolves the hostname and never inspects the address the HTTP client actually connects to. The client constructed in resources/resource_factories/create/create.go installs no dial-time hook, so no check occurs at connection time either. A hostname that resolves to a loopback, private or cloud-metadata address therefore satisfies the policy, and the response body is embedded in the generated site. An attacker who can supply a URL through content, for example a front-matter field or a CMS field, can make the build fetch an internal endpoint and publish the response in the static output, so the build artifact itself carries the data out.

Vulnerabilities in KAON PG5298A/PG5298B routers Vulnerabilities in KAON PG5298A/PG5298B routers CVE ID CVE-2025-63080 Publication date 24 August 2026 Vendor KAON Product PG5298APG5298B Vulnerable versions PG5298A: All before 3.0.82PG5298B: All befo ... Read more Published Date: Aug 24, 2026 (3 days, 4 hours ago) Vulnerabilities has been mentioned in this article.

CVE-2026-69836: Critical RCE Vulnerability in Microsoft Entra ID August 24, 2026Microsoft has disclosed CVE-2026-69836, a critical remote-code-execution vulnerability affecting Microsoft Entra ID.The vulnerability is classified as CWE-502 — Deserialization of Untru ... Read more Published Date: Aug 24, 2026 (3 days, 3 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-69836

CVE ID :CVE-2026-75899 Published : Aug. 24, 2026, 9:40 a.m. | 20 minutes ago Description :fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time during authority recomposition, so a single call to normalize or resolve can turn nested percent-encoded input into a different network destination such as a loopback hostname or address. For example, a doubly encoded host that spells out a loopback name decodes to that live host in one operation, which contradicts RFC 3986 section 2.4 that an implementation must not decode the same string more than once. An application that normalizes or resolves an untrusted HTTP-family URI before outbound routing, redirect validation, or a host-policy check can receive a destination different from the one the original encoded host represented, giving a server-side request forgery and host-policy bypass primitive. This is an incomplete-fix variant of CVE-2026-6322. The affected versions are 2.4.1 up to but not including 2.4.5, 3.1.2 up to but not including 3.1.6, and 4.0.0 up to but not including 4.1.3. The issue is fixed in 2.4.5, 3.1.6, and 4.1.3, which normalize percent escapes once and preserve encoded percent signs. Users should upgrade to a patched version. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Australische overheid meldt misbruik van kritiek lek TeamCity-servers TeamCity-servers die zich in Australië bevinden zijn het doelwit van aanvallen, zo meldt de Australische inlichtingendienst ASD. De aanvallers maken misbruik van een kritieke kwetsbaarheid aangeduid a ... Read more Published Date: Aug 24, 2026 (3 Tage, 1 Stunde ago) Vulnerabilities has been mentioned in this article. CVE-2026-63077

CVE ID :CVE-2026-78317 Published : Aug. 24, 2026, 9:34 a.m. | 26 minutes ago Description :SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-78316 Published : Aug. 24, 2026, 9:34 a.m. | 26 minutes ago Description :SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-78315 Published : Aug. 24, 2026, 9:34 a.m. | 26 minutes ago Description :SQL Injection in Delta DIAEnergie v1.11.00.002 allows attacker to remote code execution. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...