News & Sicurezza

CVE ID :CVE-2026-42403 Published : May 1, 2026, 9:16 a.m. | 3 hours, 2 minutes ago Description :Apache Neethi does not properly detect circular references in policy definitions. When a WS-Policy document contains circular policy references (where Policy A references Policy B which references Policy A), the policy normalization process can enter an infinite loop or cause excessive recursion, leading to a stack overflow or application hang. An attacker can craft malicious policy documents with circular references to cause a Denial of Service condition Users are recommended to upgrade to version 3.2.2, which fixes this issue. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-43001 Published : May 1, 2026, 9:16 a.m. | 3 hours, 2 minutes ago Description :An issue was discovered in OpenStack Keystone 13 through 29. POST /v3/credentials did not validate that the caller-supplied project_id for an EC2-type credential matched the project of the authenticating application credential. This allowed an attacker holding an unrestricted application credential for project A to create an EC2 credential targeting project B; a subsequent /v3/ec2tokens exchange would then issue a Keystone token scoped to project B while still carrying the original app_cred_id, enabling cross-project lateral movement within the credential owner's role footprint. Severity: 7.9 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-43003 Published : May 1, 2026, 9:16 a.m. | 3 hours, 2 minutes ago Description :An issue was discovered in OpenStack ironic-python-agent 1.0.0 through 11.5.0. Ironic Python Agent (IPA) sometimes executes grub-install from within a chroot of the deployed partition image, leading to code execution in the case of a malicious image. Severity: 8.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-40201 Published : May 1, 2026, 9:16 a.m. | 3 hours, 2 minutes ago Description :@diplodoc/search-extension 1.0.0 through 3.x before 3.0.3 allows stored XSS via the title in a .md file. Severity: 5.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-42402 Published : May 1, 2026, 9:16 a.m. | 3 hours, 2 minutes ago Description :Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. Specially crafted WS-Policy documents can trigger an exponential Cartesian cross-product expansion during the normalization process, causing unbounded memory allocation that exhausts the JVM heap. This occurs when the normalization process generates an excessive number of policy alternatives without bounds, leading to runtime memory exhaustion. Users should upgrade to 3.2.2 which limits the maximum number of normalized policy alternatives. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Privacy-OS Tails komt wegens Tor Brower-kwetsbaarheden met noodpatch De ontwikkelaars van het op privacy gerichte besturingssysteem Tails hebben wegens kwetsbaarheden in Tor Browser een noodpatch uitgebracht. Tails staat voor The Amnesic Incognito Live System en is een ... Read more Published Date: May 01, 2026 (3 days, 3 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-7322

Privacy-OS Tails komt wegens Tor Browser-kwetsbaarheden met noodpatch vrijdag 1 mei 2026, 10:35 door Redactie, 0 reactiesLaatst bijgewerkt: Vandaag, 11:20 De ontwikkelaars van het op privacy gerichte besturingssysteem Tails hebben wegens kwetsbaarheden in Tor Browser ee ... Read more Published Date: May 01, 2026 (3 days, 3 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-7322

China-Aligned Attackers Use ShadowPad, IOX Proxy, and WMIC in Multi-Stage Espionage Campaign A China-aligned threat group has been carrying out a carefully planned espionage campaign against government agencies and critical infrastructure across Asia. The group, tracked under the temporary de ... Read more Published Date: May 01, 2026 (3 days ago) Vulnerabilities has been mentioned in this article. CVE-2021-27065 CVE-2021-26858 CVE-2021-26857 CVE-2021-26855

NCSC adviseert updates voor cPanel en WHM zo snel mogelijk te installeren Het Nationaal Cyber Security Centrum (NCSC) adviseert beheerders en organisaties om beveiligingsupdates voor een kritieke kwetsbaarheid in cPanel en WHM zo snel mogelijk te installeren. Misbruik van h ... Read more Published Date: May 01, 2026 (3 days ago) Vulnerabilities has been mentioned in this article. CVE-2026-41940

CVE ID :CVE-2026-7584 Published : May 1, 2026, 8:16 a.m. | 4 hours, 3 minutes ago Description :The LabOne Q serialization framework uses a class-loading mechanism (import_cls) to dynamically import and instantiate Python classes during deserialization. Prior to the fix, this mechanism accepted arbitrary fully-qualified class names from the serialized data without any validation of the target class or restriction on which modules could be imported. An attacker can craft a serialized experiment file that causes the deserialization engine to import and instantiate arbitrary Python classes with attacker-controlled constructor arguments, resulting in arbitrary code execution in the context of the user running the Python process. Exploitation requires the victim to load a malicious file using LabOne Q's deserialization functions, for example a compromised experiment file shared for collaboration or support purposes. Severity: 8.4 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-42996 Published : May 1, 2026, 7:15 a.m. | 5 hours, 3 minutes ago Description :JS8Call through 2.3.1 and JS8Call-improved before 3.0 have a stack-based buffer overflow via a radio transmission of @APRSIS GRID followed by a long Maidenhead locator. This occurs in grid2deg in APRSISClient.cpp. Severity: 10.0 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

A vulnerability was identified in itsourcecode Electronic Judging System 1.0. This affects an unknown part of the file /intrams/login.php. Such manipulation of the argument Username leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.