News & Sicurezza

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a local attacker to execute arbitrary code due to a time-of-check to time-of-use (TOCTOU) race condition.

CVE ID :CVE-2026-76997 Published : Aug. 20, 2026, 3:15 p.m. | 38 minutes ago Description :A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=save_category. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

WordPress-sites via Elementor Pro upload-lek volledig over te nemen Een kritieke kwetsbaarheid in de populaire WordPress-plug-in Elementor Pro maakt het mogelijk voor ongeauthenticeerde aanvallers om WordPress-sites volledig over te nemen. Via het beveiligingslek kan ... Read more Published Date: Aug 20, 2026 (4 days, 22 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-32475

CVE ID :CVE-2026-76833 Published : Aug. 20, 2026, 2:18 p.m. | 1 hour, 36 minutes ago Description :@cgauge/yaml npm package contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary JavaScript by embedding a custom !js YAML tag whose construct callback unconditionally calls eval() on attacker-supplied string values during document parsing. Any application parsing untrusted YAML input with this library exposes full Node.js runtime authority, including environment variable access, filesystem read/write, network access, and subprocess execution, with no safe-mode alternative or opt-out mechanism available. Severity: 8.4 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations. Attackers can chain a backup restore code injection flaw, where PHP code outside class definitions in schema files executes unconditionally upon loading, to plant malicious table names and trigger error-based SQL injection that retrieves database version, schema contents, and arbitrary data from the PostgreSQL backend.

WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of the alterarSenha method from permission checks in controle/control.php. Attackers can manipulate the redir parameter to point to alterar_senha.php, routing through verificarSenhaConfig() instead of verificarSenha() to bypass current password verification and convert temporary session access into permanent account takeover.

Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application (BMS): before v1.1.10.142.

Kritiek Citrix NetScaler-lek kan aanvaller toegang tot systeem geven Een kritieke kwetsbaarheid in Citrix NetScaler ADC en Citrix NetScaler Gateway kan ongeauthenticeerde aanvallers toegang tot het systeem geven. Er zijn beveiligingsupdates uitgebracht om het probleem ... Read more Published Date: Aug 20, 2026 (4 days, 19 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-19490

Critical NetScaler Flaw Can Bypass Authentication on Certain Gateway and AAA Servers Citrix has released updates to address two security flaws impacting NetScaler ADC and NetScaler Gateway deployments, including a critical-severity authentication bypass vulnerability. According to the ... Read more Published Date: Aug 20, 2026 (4 days, 19 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-19490 CVE-2026-19489 CVE-2026-8451

CVE ID :CVE-2026-15706 Published : Aug. 20, 2026, 1:27 p.m. | 25 minutes ago Description :Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application (BMS) allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application (BMS): before v1.1.10.142. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Attackers Exploit Zimbra SNMP Flaw for Unauthenticated Remote Code Execution A now-patched security flaw impacting Zimbra Collaboration (ZCS) has come under active exploitation in the wild, according to the Polish Computer Emergency Response Team (CERT Polska). The vulnerabili ... Read more Published Date: Aug 20, 2026 (4 days, 19 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-73570 CVE-2025-66376

CVE ID :CVE-2026-7485 Published : Aug. 20, 2026, 1:19 p.m. | 34 minutes ago Description :Incorrect authorization in frozen BI aggregations in Checkmk Severity: 2.3 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...