News & Sicurezza

CVE ID :CVE-2026-25660 Published : April 24, 2026, 1:10 p.m. | 1 hour, 1 minute ago Description :CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication bypass occurs when the URL ends with Authentication with certain function calls. This bypass allows assigning arbitrary permission to any user existing in CodeChecker. This issue affects CodeChecker: through 6.27.3. Severity: 9.3 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Triple Threat: Apache ActiveMQ Vulnerabilities Expose Enterprises to RCE and XSS Apache ActiveMQ, the world’s most popular open-source message broker, is currently facing a series of “Important” security threats. As a cornerstone of enterprise middleware, ActiveMQ facilitates comm ... Read more Published Date: Apr 24, 2026 (3 days, 21 hours ago) Vulnerabilities has been mentioned in this article.

Microsoft beefs up Remote Desktop security with ... hard-to-read messages Microsoft's update to harden Remote Desktop against phishing attacks has arrived. When users open a Remote Desktop (.rdp) file, they should now see a warning listing all requested connection settings ... Read more Published Date: Apr 24, 2026 (3 days, 22 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-40372

Xiongmai IP Camera Vulnerability Let Attackers Bypass Authentication and have Remote Access Security cameras are designed to keep commercial facilities safe. However, a newly disclosed critical vulnerability in Hangzhou Xiongmai Technology’s XM530 IP Cameras is putting networks at risk. Trac ... Read more Published Date: Apr 24, 2026 (3 days, 18 hours ago) Vulnerabilities has been mentioned in this article. CVE-2025-65856

Python Vulnerability Allows Out-of-Bounds Write on Windows Systems A security vulnerability has been discovered in Python’s Windows asyncio implementation, allowing attackers to trigger out-of-bounds memory writes through a missing boundary check in network socket op ... Read more Published Date: Apr 24, 2026 (3 days, 14 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-3298

CVE ID :CVE-2026-41044 Published : April 24, 2026, 11:16 a.m. | 2 hours, 55 minutes ago Description :Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ, Apache ActiveMQ Broker, Apache ActiveMQ All. An authenticated attacker can use the admin web console page to construct a malicious broker name that bypasses name validation to include an xbean binding that can be later used by a VM transport to load a remote Spring XML application. The attacker can then use the DestinationView mbean to send a message to trigger a VM transport creation that will reference this malicious broker name which can lead to loading the malicious Spring XML context file. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ All: before 5.19.6, from 6.0.0 before 6.2.5. Users are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-41043 Published : April 24, 2026, 11:16 a.m. | 2 hours, 55 minutes ago Description :Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache ActiveMQ, Apache ActiveMQ Web. An authenticated attacker can show malicious content when browsing queues in the web console by overriding the content type to be HTML (instead of XML) and by injecting HTML into a JMS selector field. This issue affects Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ Web: before 5.19.6, from 6.0.0 before 6.2.5. Users are recommended to upgrade to version 6.2.5 or 5.19.6, which fixes the issue. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-40466 Published : April 24, 2026, 11:16 a.m. | 2 hours, 55 minutes ago Description :Improper Input Validation, Improper Control of Generation of Code ('Code Injection') vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. An authenticated attacker may bypass the fix in CVE-2026-34197 by adding a connector using an HTTP Discovery transport via BrokerView.addNetworkConnector or BrokerView.addConnector through Jolokia if the activemq-http module is on the classpath. A malicious HTTP endpoint can return a VM transport through the HTTP URI which will bypass the validation added in CVE-2026-34197. The attacker can then use the VM transport's brokerConfig parameter to load a remote Spring XML application context using ResourceXmlApplicationContext. Because Spring's ResourceXmlApplicationContext instantiates all singleton beans before the BrokerService validates the configuration, arbitrary code execution occurs on the broker's JVM through bean factory methods such as Runtime.exec(). This issue affects Apache ActiveMQ Broker: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ All: before 5.19.6, from 6.0.0 before 6.2.5; Apache ActiveMQ: before 5.19.6, from 6.0.0 before 6.2.5. Users are recommended to upgrade to version 5.19.6 or 6.2.5, which fixes the issue. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-62233 Published : April 24, 2026, 11:16 a.m. | 2 hours, 55 minutes ago Description :Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module. This issue affects Apache DolphinScheduler: Version >= 3.2.0 and Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Hackers Can Exploit Ollama Model Uploads to Leak Sensitive Server Data A critical, unpatched vulnerability has been discovered in Ollama, a widely used open-source platform for running Large Language Models locally. Tracked as CVE-2026-5757, this severe memory leak allow ... Read more Published Date: Apr 24, 2026 (3 days, 15 hours ago) Vulnerabilities has been mentioned in this article.

CVE ID :CVE-2026-4313 Published : April 24, 2026, 12:17 p.m. | 1 hour, 54 minutes ago Description :AdaptiveGRC is vulnerable to Stored XSS via text type fields across the forms. Authenticated attacker can replace the value of the text field in the HTTP POST request. Improper parameter validation by the server results in arbitrary JavaScript execution in the victim's browser. Critically, this may allow the attacker to obtain the administrator authentication token and perform arbitrary actions with administrative privileges, which could lead to further compromise. This issue occurs in versions released before December 2025. Severity: 2.4 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-6043 Published : April 24, 2026, 12:17 p.m. | 1 hour, 54 minutes ago Description :P4 Server versions prior to 2026.1 are configured with insecure default settings that, when exposed to untrusted networks, allow unauthenticated attackers to create arbitrary user accounts, enumerate existing users, authenticate to accounts with no password set, and access depot contents via the built-in 'remote' user. These default settings, taken together, can lead to unauthorized access to source code repositories and other managed assets. The 2026.1 release, expected in May 2026, enforces secure-by-default configurations on upgrade and new installations Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...