News & Sicurezza

CVE ID :CVE-2026-75948 Published : Aug. 20, 2026, 8:16 a.m. | 1 hour, 35 minutes ago Description :Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12 - The frontend "Submit an Event" form stores the `image` and `file` fields as raw strings with no output-side HTML-attribute escaping. Severity: 8.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Kritiek GitLab-lek twee dagen na uitkomen update misbruikt bij aanvallen Een kritieke kwetsbaarheid in GitLab, de populaire online DevOps-tool voor het ontwikkelen van software, wordt twee dagen na het uitkomen van de beveiligingsupdate al misbruikt bij aanvallen. Dat laat ... Read more Published Date: Aug 20, 2026 (4 days ago) Vulnerabilities has been mentioned in this article. CVE-2026-19478

CVE ID :CVE-2026-76569 Published : Aug. 20, 2026, 8:16 a.m. | 1 hour, 35 minutes ago Description :Joomla Extension - phoca.cz - Reflected XSS via the search GET parameter in Phoca Download 5.0.0-6.1.4 Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-76565 Published : Aug. 20, 2026, 8:16 a.m. | 1 hour, 35 minutes ago Description :Joomla Extension - phoca.cz - Reflected XSS via price_from & price_to filter parameters in Phoca Cart 5.0.0-6.1.7 Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-14601 Published : Aug. 20, 2026, 8:16 a.m. | 1 hour, 35 minutes ago Description :An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. An attacker can exploit this flaw to disrupt web server operations, expose sensitive data, or potentially achieve full server compromise. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch. Severity: 8.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-14163 Published : Aug. 20, 2026, 7:16 a.m. | 2 hours, 35 minutes ago Description :In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text. Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-71368 Published : Aug. 20, 2026, 7:16 a.m. | 2 hours, 35 minutes ago Description :F-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while logged in to the affected product, unintended operations may be performed. Severity: 6.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-14602 Published : Aug. 20, 2026, 7:16 a.m. | 2 hours, 35 minutes ago Description :The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a remote attacker to accurately guess or brute-force the generated filename within a short time window. An attacker can successfully locate and access uploaded files, which can be used to facilitate further attacks. Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

The Events Made Easy plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the eme_single_event_page_template function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The stored traversal payload is triggered passively when any visitor loads the affected single-event page, meaning post-submission execution does not require additional attacker interaction.

CVE ID :CVE-2026-75860 Published : Aug. 20, 2026, 6:17 a.m. | 3 hours, 34 minutes ago Description :The JSON Options WordPress plugin through 0.0.4 does not have any capability check or nonce verification on one of its actions, which runs on every request and is available to unauthenticated users, allowing them to update arbitrary WordPress options. This can be leveraged to enable user registration and set the default role to administrator, leading to privilege escalation and full site takeover. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-74992 Published : Aug. 20, 2026, 6:17 a.m. | 3 hours, 34 minutes ago Description :The Kirki WordPress plugin before 6.2.3 does not properly validate the files contained in archives uploaded by users with the Editor role, and does not remove all unwanted files after extracting them, allowing such users to upload arbitrary files to a web accessible directory, leading to Stored XSS as well as RCE on some server configurations. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-19699 Published : Aug. 20, 2026, 6:17 a.m. | 3 hours, 34 minutes ago Description :The GutenKit WordPress plugin before 2.5.0 does not have a sufficient capability check on some of its REST API endpoints, allowing users with the Contributor role and above to retrieve mailing-list audience metadata from the site's connected marketing account. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...