News & Sicurezza

Windows Python Users Warned of High-Severity “asyncio” Memory Flaw Python developers and system administrators on Windows are being urged to update their environments following the discovery of a high-severity vulnerability in the standard library. The flaw, tracked ... Read more Published Date: Apr 23, 2026 (3 days, 16 hours ago) Vulnerabilities has been mentioned in this article.

Mailcow Critical Alert: Unauthenticated XSS Threatens Admin Takeover The popular open-source groupware suite mailcow: dockerized is facing a high-stakes security challenge. A critical Stored Cross-Site Scripting (XSS) vulnerability has been discovered in the platform’s ... Read more Published Date: Apr 23, 2026 (3 days, 16 hours ago) Vulnerabilities has been mentioned in this article.

ThreatsDay Bulletin: $290M DeFi Hack, macOS LotL Abuse, ProxySmart SIM Farms +25 New Stories You scroll past one incident and see another that feels familiar, like it should have been fixed years ago, but it still works with small changes. Same bugs. Same mistakes.The supply chain is messy. P ... Read more Published Date: Apr 23, 2026 (2 days, 15 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-34197 CVE-2026-33032 CVE-2026-27175 CVE-2026-27174 CVE-2025-22952 CVE-2024-57046 CVE-2024-32114

CVE ID :CVE-2025-66286 Published : April 23, 2026, 1:16 p.m. | 4 hours, 54 minutes ago Description :An API design flaw in WebKitGTK and WPE WebKit allows untrusted web content to unexpectedly perform IP connections, DNS lookups, and HTTP requests. Applications expect to use the WebPage::send-request signal handler to approve or reject all network requests. However, certain types of HTTP requests bypass this signal handler. Severity: 4.7 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-39440 Published : April 23, 2026, 1:16 p.m. | 4 hours, 53 minutes ago Description :Improper Control of Generation of Code ('Code Injection') vulnerability in Funnelforms LLC FunnelFormsPro allows Remote Code Inclusion.This issue affects FunnelFormsPro: from n/a through 3.8.1. Severity: 9.9 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-13763 Published : April 23, 2026, 1:16 p.m. | 4 hours, 54 minutes ago Description :Multiple uses of uninitialized variables were found in libopensc that may lead to information disclosure or application crash. An attack requires a crafted USB device or smart card that would present the system with specially crafted responses to the APDUs Severity: 5.7 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Unpatch Ollama Flaw: Malicious Model Uploads Can Leak Server Heap Memory A critical unauthenticated remote information disclosure vulnerability has been uncovered in Ollama, the popular open-source tool used to run LLMs on macOS, Windows, and Linux. The flaw, tracked as CV ... Read more Published Date: Apr 23, 2026 (2 days, 5 hours ago) Vulnerabilities has been mentioned in this article.

Critical Authentication Bypass in Apache HttpClient 5.6 The Apache Software Foundation has issued an urgent advisory for a vulnerability in its widely used HttpClient library, a cornerstone for Java-based HTTP communication. The flaw, tracked as CVE-2026-4 ... Read more Published Date: Apr 23, 2026 (1 day, 17 hours ago) Vulnerabilities has been mentioned in this article.

Hybrid clouds have two attack surfaces and you’re not paying enough attention to either Black Hat Asia Israeli researchers found a series of flaws in Microsoft's Windows Admin Center (WAC) and suggest this shows hybrid cloud management tools are a two-way attack surface that users don't ... Read more Published Date: Apr 23, 2026 (1 day, 14 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-32196 CVE-2026-23660 CVE-2026-20965 CVE-2025-64669

Critical 9.8 CVSS Flaws Hit ArcGIS Infrastructure Esri has issued an urgent security bulletin regarding two critical vulnerabilities affecting developer credentials within ArcGIS Online, ArcGIS Location Platform, and ArcGIS Enterprise. The flaws, whi ... Read more Published Date: Apr 23, 2026 (1 day, 6 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-33519 CVE-2026-33518 CVE-2026-33626 CVE-2026-33825 CVE-2026-22679

CVE ID :CVE-2026-31531 Published : April 23, 2026, 12:17 p.m. | 3 hours, 53 minutes ago Description :In the Linux kernel, the following vulnerability has been resolved: ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() When querying a nexthop object via RTM_GETNEXTHOP, the kernel currently allocates a fixed-size skb using NLMSG_GOODSIZE. While sufficient for single nexthops and small Equal-Cost Multi-Path groups, this fixed allocation fails for large nexthop groups like 512 nexthops. This results in the following warning splat: WARNING: net/ipv4/nexthop.c:3395 at rtm_get_nexthop+0x176/0x1c0, CPU#20: rep/4608 [...] RIP: 0010:rtm_get_nexthop (net/ipv4/nexthop.c:3395) [...] Call Trace: rtnetlink_rcv_msg (net/core/rtnetlink.c:6989) netlink_rcv_skb (net/netlink/af_netlink.c:2550) netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) netlink_sendmsg (net/netlink/af_netlink.c:1894) ____sys_sendmsg (net/socket.c:721 net/socket.c:736 net/socket.c:2585) ___sys_sendmsg (net/socket.c:2641) __sys_sendmsg (net/socket.c:2671) do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) Fix this by allocating the size dynamically using nh_nlmsg_size() and using nlmsg_new(), this is consistent with nexthop_notify() behavior. In addition, adjust nh_nlmsg_size_grp() so it calculates the size needed based on flags passed. While at it, also add the size of NHA_FDB for nexthop group size calculation as it was missing too. This cannot be reproduced via iproute2 as the group size is currently limited and the command fails as follows: addattr_l ERROR: message exceeded bound of 1048 Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-31532 Published : April 23, 2026, 12:17 p.m. | 3 hours, 53 minutes ago Description :In the Linux kernel, the following vulnerability has been resolved: can: raw: fix ro->uniq use-after-free in raw_rcv() raw_release() unregisters raw CAN receive filters via can_rx_unregister(), but receiver deletion is deferred with call_rcu(). This leaves a window where raw_rcv() may still be running in an RCU read-side critical section after raw_release() frees ro->uniq, leading to a use-after-free of the percpu uniq storage. Move free_percpu(ro->uniq) out of raw_release() and into a raw-specific socket destructor. can_rx_unregister() takes an extra reference to the socket and only drops it from the RCU callback, so freeing uniq from sk_destruct ensures the percpu area is not released until the relevant callbacks have drained. [mkl: applied manually] Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...