News & Sicurezza

Ivanti meldt actief misbruik van kwetsbaarheid in Endpoint Manager Mobile Aanvallers maken actief misbruik van een kwetsbaarheid in Ivanti Endpoint Manager Mobile (EPMM), zo waarschuwt Ivanti vandaag. Er zijn beveiligingsupdates beschikbaar om het probleem te verhelpen, maa ... Read more Published Date: May 07, 2026 (2 days, 21 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-6973 CVE-2026-1340 CVE-2026-1281

CVE ID :CVE-2026-5787 Published : May 7, 2026, 4:16 p.m. | 2 hours, 9 minutes ago Description :An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to impersonate registered Sentry hosts and obtain valid CA-signed client certificates. Severity: 8.9 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Google 148 Stable Channel Released with 127 Bug fixes OverviewGoogle has released Chrome 148 to the stable channel, delivering one of the largest security update batches in the browser’s history — patching 127 vulnerabilities across Windows, macOS, and L ... Read more Published Date: May 07, 2026 (2 days, 13 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-8022 CVE-2026-7988 CVE-2026-7936 CVE-2026-7899 CVE-2026-7898 CVE-2026-7897 CVE-2026-7896 CVE-2026-0300 CVE-2026-0073 CVE-2023-3214

CVE ID :CVE-2026-5788 Published : May 7, 2026, 4:16 p.m. | 2 hours, 9 minutes ago Description :An Improper Access Control in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to invoke arbitrary methods. Severity: 7.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-7821 Published : May 7, 2026, 4:16 p.m. | 2 hours, 9 minutes ago Description :Improper certificate validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker to enroll a device belonging to a restricted set of unenrolled devices, leading to information disclosure about EPMM appliance and impacting on the integrity of the newly enrolled device identity. Severity: 7.4 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-6973 Published : May 7, 2026, 4:16 p.m. | 2 hours, 9 minutes ago Description :An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely authenticated user with administrative access to achieve remote code execution. Severity: 7.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-5786 Published : May 7, 2026, 4:16 p.m. | 2 hours, 9 minutes ago Description :An Improper Access Control vulnerability in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote authenticated attacker to gain administrative access. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-44264 Published : May 7, 2026, 3:16 p.m. | 3 hours, 9 minutes ago Description :Weblate is a web based localization tool. Prior to version 5.17.1, the Markdown renderer used in user comments and other user-provided content didn't properly sanitize some attributes. This issue has been patched in version 5.17.1. Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-44349 Published : May 7, 2026, 3:16 p.m. | 3 hours, 9 minutes ago Description :Daptin is a GraphQL/JSON-API headless CMS. Prior to version 0.11.5, processFuzzySearch in server/resource/resource_findallpaginated.go:1484 splits the user-supplied column parameter by comma and interpolates each segment directly into goqu.L(fmt.Sprintf("LOWER(%s) LIKE ?", prefix+col)) raw SQL with no column whitelist check. The entry point is GET /api/ with operator=fuzzy (or fuzzy_any, fuzzy_all). Any authenticated user — including one who self-registered with no admin involvement — can read the entire database. This issue has been patched in version 0.11.5. Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-44263 Published : May 7, 2026, 3:16 p.m. | 3 hours, 9 minutes ago Description :Weblate is a web based localization tool. Prior to version 5.17.1, the screenshots, tasks, and component link API allowed for the enumeration of translations in a project inaccessible to the user. This issue has been patched in version 5.17.1. Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.

CVE ID :CVE-2026-41687 Published : May 7, 2026, 3:16 p.m. | 3 hours, 9 minutes ago Description :Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.8.1, the SSRF protection in endpoints/subscription/add.php (line 42) and endpoints/payments/add.php (line 40) uses an inline IP validation check (FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE) that does not block CGNAT addresses (100.64.0.0/10, RFC 6598). The includes/ssrf_helper.php file explicitly defines is_cgnat_ip() to cover this gap (used by notification endpoints), but the logo/icon URL fetching in subscription and payment endpoints performs its own inline validation that misses this range. This allows authenticated users to perform Blind SSRF to internal services in Tailscale, Carrier-Grade NAT, and other environments using 100.64.0.0/10 addresses. This issue has been patched in version 4.8.1. Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...