News & Sicurezza

Mozilla Patches 423 Firefox 0-Day Vulnerabilities with Claude Mythos and Other AI Models Mozilla has fixed a total of 423 Firefox security bugs in April 2026 alone, a figure nearly 20 times higher than its monthly average of about 21 bugs throughout 2025, driven by a groundbreaking agenti ... Read more Published Date: May 08, 2026 (3 days, 2 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-6758 CVE-2026-6757 CVE-2026-6746

CVE ID :CVE-2013-10075 Published : May 8, 2026, 8:16 a.m. | 4 hours, 9 minutes ago Description :Apache::Session versions through 1.94 for Perl re-creates deleted sessions. The session stores Apache::Session::Store::File and Apache::Session::Store::DB_File will create a session that does not exist. This can lead to sessions being revived, potentially with data that was to be deleted. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Critical Spring Vulnerabilities Expose Arbitrary Files and GCP Secrets Spring Cloud Config provides crucial server-side and client-side support for externalized configuration in distributed systems. Recently, the Spring development team disclosed four security vulnerabil ... Read more Published Date: May 08, 2026 (3 days, 1 hour ago) Vulnerabilities has been mentioned in this article. CVE-2026-41004 CVE-2026-41002 CVE-2026-40982 CVE-2026-40981 CVE-2026-27174

Is Your React App Vulnerable to the CVE-2026-23870 DoS Attack? A high-severity Denial of Service (DoS) vulnerability has been uncovered in React Server Components, prompting an urgent call for developers to audit and update their dependencies. Tracked as CVE-2026 ... Read more Published Date: May 08, 2026 (3 days, 1 hour ago) Vulnerabilities has been mentioned in this article.

CVE ID :CVE-2026-43284 Published : May 8, 2026, 8:16 a.m. | 4 hours, 9 minutes ago Description :In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths that may modify packet data can first make a private copy. The IPv4/IPv6 datagram append paths did not set this flag when splicing pages into UDP skbs. That leaves an ESP-in-UDP packet made from shared pipe pages looking like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW fast path for uncloned skbs without a frag_list and decrypts in place over data that is not owned privately by the skb. Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching TCP. Also make ESP input fall back to skb_cow_data() when the flag is present, so ESP does not decrypt externally backed frags in place. Private nonlinear skb frags still use the existing fast path. This intentionally does not change ESP output. In esp_output_head(), the path that appends the ESP trailer to existing skb tailroom without calling skb_cow_data() is not reachable for nonlinear skbs: skb_tailroom() returns zero when skb->data_len is nonzero, while ESP tailen is positive. Thus ESP output will either use the separate destination-frag path or fall back to skb_cow_data(). Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-44916 Published : May 8, 2026, 7:16 a.m. | 5 hours, 9 minutes ago Description :In OpenStack Ironic through 35.x, instance_info['ks_template'] is rendered without sandboxing. Severity: 3.0 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-4935 Published : May 8, 2026, 7:16 a.m. | 5 hours, 9 minutes ago Description :The OttoKit: All-in-One Automation Platform WordPress plugin before 1.1.23 does not properly sanitize user input before using it in a SQL statement, which could allow unauthenticated attackers to perform SQL injection attacks. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-8069 Published : May 8, 2026, 7:16 a.m. | 5 hours, 9 minutes ago Description :PredatorSense version 3.00.3136 to 3.00.3196 contain Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functions. However, this Named Pipe is misconfigured, allowing any authenticated local user to execute arbitrary code with NT AUTHORITY\SYSTEM privileges and to delete arbitrary files with SYSTEM privileges. By leveraging this, an attacker can execute arbitrary code on the target system with elevated privileges. Severity: 8.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-8149 Published : May 8, 2026, 7:16 a.m. | 5 hours, 9 minutes ago Description :A vulnerability in Legion of the Bouncy Castle Inc. BC-FJA BC-FIPS on Linux, X86_64, AVX, AVX-512f. This vulnerability is associated with program files gcm128w, gcm512w. This issue affects BC-FJA: from 2.1.0 through 2.1.2. Severity: 5.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-69599 Published : May 8, 2026, 7:16 a.m. | 5 hours, 9 minutes ago Description :RayVentory Scan Engine through 12.6 Update 8 allows attackers to gain privileges if they control the value of the PATH environment variable. NOTE: this is disputed because ability of an attacker to control the environment is a site-specific misconfiguration. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-55449 Published : May 8, 2026, 7:16 a.m. | 5 hours, 9 minutes ago Description :AstrBotDevs AstrBot 3.5.15 has Advanced_System_for_Text_Response_and_Bot_Operations_Tool as the hardcoded private key used to sign a JWT. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-67887 Published : May 8, 2026, 7:16 a.m. | 5 hours, 9 minutes ago Description :1C-Bitrix through 25.100.500 allows Remote Code Execution because an actor with SOURCE/WRITE permissions for the Translate Module can upload and execute code by sending a PHP file and a .htaccess file. NOTE: this is disputed by the Supplier because this is intended behavior for the high-privileged users who can upload new translated pages to the website. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...