News & Sicurezza

CVE ID :CVE-2026-23902 Published : April 24, 2026, 12:17 p.m. | 1 hour, 54 minutes ago Description :Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution. This issue affects Apache DolphinScheduler versions prior to 3.4.1. Users are recommended to upgrade to version 3.4.1, which fixes this issue. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Vulnerability in AdaptiveGRC software Vulnerability in AdaptiveGRC software CVE ID CVE-2026-4313 Publication date 24 April 2026 Vendor C&F Product AdaptiveGRC Vulnerable versions released before December 2025. Vulnerability type (CWE) Imp ... Read more Published Date: Apr 24, 2026 (3 days, 13 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-4313

CVE ID :CVE-2026-6272 Published : April 24, 2026, 9:16 a.m. | 4 hours, 55 minutes ago Description :A client holding only a read JWT scope can still register itself as a signal provider through the production kuksa.val.v2 OpenProviderStream API by sending ProvideSignalRequest. 1. Obtain any valid token with only read scope. 2. Connect to the normal production gRPC API (kuksa.val.v2). 3. Open OpenProviderStream. 4. Send ProvideSignalRequest for a target signal ID. 5. Wait for the broker to forward GetProviderValueRequest. 6. Reply with attacker-controlled GetProviderValueResponse. 7. Other clients performing GetValue / GetValues for that signal receive forged data. Severity: 8.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-21728 Published : April 24, 2026, 9:16 a.m. | 4 hours, 55 minutes ago Description :Tempo queries with large limits can cause large memory allocations which can impact the availability of the service, depending on its deployment strategy. Mitigation can be done by setting max_result_limit in the search config, e.g. to 262144 (2^18). Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Hackers Use Telegram Bots to Track 900+ Successful React2Shell Exploits A newly exposed server has revealed how a threat actor used automated tools, AI assistance, and Telegram bots to silently hack into more than 900 companies around the world. The operation, built aroun ... Read more Published Date: Apr 24, 2026 (3 days, 16 hours ago) Vulnerabilities has been mentioned in this article. CVE-2025-55182

China-Linked Cyber Actors Turn to Massive Covert Botnets to Evade Detection A newly issued cybersecurity advisory highlights an evolution in the tactics, techniques and procedures (TTPs) employed by China-Nexus threat actors. The report, released with support from the UK Cybe ... Read more Published Date: Apr 24, 2026 (3 days, 8 hours ago) Vulnerabilities has been mentioned in this article. CVE-2025-55182

CVE ID :CVE-2026-3569 Published : April 24, 2026, 8:16 a.m. | 5 hours, 55 minutes ago Description :The Liaison Site Prober plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 1.2.1 via the /wp-json/site-prober/v1/logs REST API endpoint. The permissions_read() permission callback unconditionally returns true (via __return_true()) instead of checking for appropriate capabilities. This makes it possible for unauthenticated attackers to retrieve sensitive audit log data including IP addresses, user IDs, usernames, login/logout events, failed login attempts, and detailed activity descriptions. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-4078 Published : April 24, 2026, 8:16 a.m. | 5 hours, 55 minutes ago Description :The ITERAS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple shortcodes (iteras-ordering, iteras-signup, iteras-paywall-login, iteras-selfservice) in all versions up to and including 1.8.2. This is due to insufficient input sanitization and output escaping in the combine_attributes() function. The function directly concatenates shortcode attribute values into JavaScript code within tags using double-quoted string interpolation (line 489: '"'.$key.'": "'.$value.'"') without any escaping. An attacker can break out of the JavaScript string context by including a double-quote character in a shortcode attribute value and inject arbitrary JavaScript. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Severity: 6.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-3565 Published : April 24, 2026, 8:16 a.m. | 5 hours, 55 minutes ago Description :The Taqnix plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to a missing nonce verification in the taqnix_delete_my_account() function, where the check_ajax_referer() call is explicitly commented out on line 883. This makes it possible for unauthenticated attackers to trick a logged-in non-administrator user into deleting their own account via a forged request granted they can trick the user into performing an action such as clicking a link or visiting a malicious page. Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-11762 Published : April 24, 2026, 8:16 a.m. | 5 hours, 55 minutes ago Description :The HubSpot All-In-One Marketing - Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 11.3.32 via the leadin/public/admin/class-adminconstants.php file. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract a list of all installed plugins and their versions which can be leveraged for reconnaissance and further attacks. Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure A high-severity security flaw in LMDeploy, an open-source toolkit for compressing, deploying, and serving LLMs, has come under active exploitation in the wild less than 13 hours after its public discl ... Read more Published Date: Apr 24, 2026 (3 days, 9 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-3844 CVE-2026-33626 CVE-2026-34197 CVE-2026-0740 CVE-2026-33032

CVE ID :CVE-2026-1952 Published : April 24, 2026, 7:16 a.m. | 6 hours, 55 minutes ago Description :Delta Electronics AS320T has denial of service via the undocumented subfunction vulnerability. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...