News & Sicurezza

CVE ID :CVE-2026-40552 Published : April 28, 2026, 2:16 p.m. | 4 hours ago Description :mpGabinet is vulnerable to Remote Command Execution. An authorized user with access to the application and direct access to the backend database can achieve system command execution by uploading an attachment and modifying its storage path in the database to reference an attacker-controlled remote network resource. Alternatively, it is possible to use a previously uploaded file and change its reference. When the application processes the attachment, and a user tries to open it, the referenced resource is executed by the system. Critically, this vulnerability can be exploited by any unauthenticated attacker by chaining it with CVE-2026-40550 and CVE-2026-40551, which allows obtaining database access, and logging onto any account. This issue affects mpGabinet version 23.12.19 and below. Severity: 4.7 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-40551 Published : April 28, 2026, 2:16 p.m. | 4 hours ago Description :mpGabinet performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass the login verification process by manipulating the application binary and authenticate as an arbitrary user. This issue affects mpGabinet version 23.12.19 and below. Severity: 8.4 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-40550 Published : April 28, 2026, 2:16 p.m. | 2 hours ago Description :mpGabinet is vulnerable to Privilege Escalation due to excessive database privileges assigned to the user used by the application. An attacker with access to any running application instance connected to the backend server can extract database credentials from the application’s memory by inspecting the running process. While ability to retrieve credentials from memory is expected behavior, the exposed credentials grant administrative access to the database, exceeding the privileges required for normal application functionality. This allows an attacker to perform actions beyond those permitted through the application interface. This issue affects mpGabinet version 23.12.19 and below. Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-6706 Published : April 28, 2026, 2:16 p.m. | 4 hours ago Description :Improper access control in the vault documentation feature in Devolutions Server 2026.1.14.0 and earlier allows an authenticated attacker to read documentation content from unauthorized vaults via a crafted API request. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-5944 Published : April 28, 2026, 2:16 p.m. | 4 hours ago Description :An improper access control vulnerability exists in the Cisco Intersight Device Connector for Nutanix Prism Central. The service exposes an API passthrough endpoint on TCP port 7373 that is accessible within the network scope of the deployment environment without authentication. An unauthenticated attacker with network access can exploit this vulnerability by sending crafted requests to the exposed endpoint to enumerate cluster metadata, including virtual machine information and cluster configuration details. While the API primarily supports read-only operations, it also allows certain cluster maintenance workflows to be invoked. Although this vulnerability does not allow persistent modification of system configurations or access to credentials or sensitive user data, successful exploitation may result in disruption of active workloads, leading to loss of service availability within the affected environment. Severity: 8.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Langflow Alert: Path Traversal Flaw in Knowledge Bases API Risks Total Data Wipeout Langflow, the popular visual framework for building and deploying AI-powered agents , has patched a critical security vulnerability that could have allowed authenticated users to delete virtually any ... Read more Published Date: Apr 28, 2026 (1 day, 7 hours ago) Vulnerabilities has been mentioned in this article.

Apache Thrift Issues Massive Patch for Critical Cross-Language Flaws Apache Thrift, the powerhouse framework used by tech giants to bridge communication between different programming languages, has issued a sweeping security update. The project recently disclosed a ser ... Read more Published Date: Apr 28, 2026 (1 day, 4 hours ago) Vulnerabilities has been mentioned in this article.

New Windows 0-Click Vulnerability Exploited to Bypass Defender SmartScreen A critical zero-click authentication coercion vulnerability, tracked as CVE-2026-32202, stemming from an incomplete patch for a Windows Shell security feature bypass actively weaponized by the Russian ... Read more Published Date: Apr 28, 2026 (1 day, 2 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-32202 CVE-2026-21513 CVE-2026-21510

Critical Unpatched Flaw Leaves Hugging Face LeRobot Open to Unauthenticated RCE Cybersecurity researchers have disclosed details of a critical security flaw impacting LeRobot, Hugging Face's open-source robotics platform with nearly 24,000 GitHub stars, that could be exploited to ... Read more Published Date: Apr 28, 2026 (1 day, 3 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-25874 CVE-2026-34197 CVE-2026-33032

CVE ID :CVE-2026-7265 Published : April 28, 2026, 11:16 a.m. | 3 hours ago Description :A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is the function Category of the file pizza/index.php?page=category. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

An unsecured configuration interface on affected devices allows unauthenticated remote attackers to access sensitive information, including hashed credentials and access codes.

CVE ID :CVE-2026-3323 Published : April 28, 2026, 11:16 a.m. | 3 hours ago Description :An unsecured configuration interface on affected devices allows unauthenticated remote attackers to access sensitive information, including hashed credentials and access codes. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...