News & Sicurezza

CVE ID :CVE-2025-31976 Published : May 6, 2026, 3:16 p.m. | 1 hour, 7 minutes ago Description :HCL BigFix Service Management (SM) is vulnerable to insufficiently protected credentials for a short duration while communicating with a backend, internal application which could allow an attacker to potentially misuse them, if exfiltrated. . Severity: 4.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-31978 Published : May 6, 2026, 3:16 p.m. | 1 hour, 7 minutes ago Description :HCL BigFix Service Management (SM) does not adequately sanitize or safely render spreadsheet files (CSV, XLS, XLSX) before processing or distributing them. An attacker could populate data fields which, when saved to a CSV file, may attempt information exfiltration or other malicious activity when automatically executed by the spreadsheet software. Note that current versions of Excel warn users of untrusted content. Severity: 4.6 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-31975 Published : May 6, 2026, 3:16 p.m. | 1 hour, 7 minutes ago Description :HCL BigFix Service Management (SM) is affected by an Information Disclosure – Server Banner issue was identified. Exposed server banners may reveal software versions and system details, potentially aiding attackers in targeting known vulnerabilities. Severity: 2.6 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-31959 Published : May 6, 2026, 3:16 p.m. | 1 hour, 7 minutes ago Description :HCL BigFix Service Management (SM) application fails to strip EXIF metadata from uploaded images. This could lead to confidentiality and privacy risks if sensitive location information is unintentionally shared. . Severity: 3.5 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-31957 Published : May 6, 2026, 3:16 p.m. | 1 hour, 7 minutes ago Description :HHCL BigFix Service Management (SM) is affected by a Cross‑Site Request Forgery (CSRF) vulnerability. This could lead to unauthorized changes or exposure of sensitive data. Severity: 2.6 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-6691 Published : May 6, 2026, 4:16 p.m. | 2 hours, 7 minutes ago Description :The MongoDB C Driver's Cyrus SASL integration performs unsafe string copying during username canonicalization, enabling a heap buffer overflow before any authentication or network traffic. This may be triggered by passing untrusted input in the username of a MongoDB URI with authMechanism=GSSAPI. Severity: 8.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Salesforce Marketing Cloud Vulnerability Opened Door to Email Data Exposure A significant set of security vulnerabilities in Salesforce Marketing Cloud (SFMC) could have allowed attackers to read and expose private email data belonging to millions of users across hundreds of ... Read more Published Date: May 06, 2026 (23 hours, 28 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-2298 CVE-2026-22586 CVE-2026-22585 CVE-2026-22583 CVE-2026-22582

CVE ID :CVE-2026-6863 Published : May 6, 2026, 4:16 p.m. | 2 hours, 7 minutes ago Description :Velociraptor versions prior to 0.76.4 contain a cross organization authorization bypass in the HTTP API. A user with only the reader role in the root organization (the lowest authenticated role, holding only READ_RESULTS permission ) can issue a single authenticated HTTP GET that can read any files from other orgs - even if they have no explicit permissions in the target org. However, the problem does not occur in reverse - a user with read access to a sub org is unable to read from other org or the root org. Severity: 6.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2026-0300 — Critical PAN-OS Buffer Overflow Bug OverviewPalo Alto Networks has confirmed that CVE-2026-0300, a critical PAN-OS vulnerability with a CVSS score of 9.3, is actively exploited in the wild. The flaw is a buffer overflow in the User-ID™ ... Read more Published Date: May 06, 2026 (23 hours, 53 minutes ago) Vulnerabilities has been mentioned in this article.

CVE ID :CVE-2026-36358 Published : May 6, 2026, 2:16 p.m. | 2 hours, 7 minutes ago Description :Cross Site Scripting vulnerability in Juzaweb CMS v.5.0.0 allows a remote attacker via execute arbitrary code via a crafted script to the Add Banner Ads function Severity: 5.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-8026 Published : May 6, 2026, 1:16 p.m. | 3 hours, 7 minutes ago Description :A security flaw has been discovered in FlowiseAI Flowise up to 3.0.12. Affected is the function Login of the file packages/server/src/enterprise/services/account.service.ts of the component API Response Handler. The manipulation results in information disclosure. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is told to be difficult. You should upgrade the affected component. Severity: 6.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-5081 Published : May 6, 2026, 1:16 p.m. | 3 hours, 7 minutes ago Description :Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure. Apache::Session::Generate::ModUniqueId (added in version 1.54) uses the value of the UNIQUE_ID environment variable for the session id. The UNIQUE_ID variable is set by the Apache mod_unique_id plugin, which generates unique ids for the request. The id is based on the IPv4 address, the process id, the epoch time, a 16-bit counter and a thread index, with no obfuscation. The server IP is often available to the public, and if not available, can be guessed from previous session ids being issued. The process ids may also be guessed from previous session ids. The timestamp is easily guessed (and leaked in the HTTP Date response header). The purpose of mod_unique_id is to assign a unique id to requests so that events can be correlated in different logs. The id is not designed, nor is it suitable for security purposes. Severity: 9.1 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...