News & Sicurezza

CVE ID :CVE-2026-6559 Published : April 19, 2026, 6:16 a.m. | 17 hours, 9 minutes ago Description :A weakness has been identified in Wavlink WL-WN579A3 220323. This affects the function sub_401F80 of the file /cgi-bin/login.cgi. This manipulation of the argument Hostname causes cross site scripting. Remote exploitation of the attack is possible. Upgrading the affected component is recommended. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-0868 Published : April 19, 2026, 4:16 a.m. | 19 hours, 9 minutes ago Description :The EMC – Easily Embed Calendly Scheduling Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's calendly shortcode in all versions up to, and including, 4.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Severity: 6.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-6056 Published : April 18, 2026, 11:16 p.m. | 1 day ago Description :Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-41242 Published : April 18, 2026, 5:16 p.m. | 1 day, 6 hours ago Description :protobufjs compiles protobuf definitions into JavaScript (JS) functions. In versions prior to 8.0.1 and 7.5.5, attackers can inject arbitrary code in the "type" fields of protobuf definitions, which will then execute during object decoding using that definition. Versions 8.0.1 and 7.5.5 patch the issue. Severity: 9.4 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-40948 Published : April 18, 2026, 2:16 p.m. | 1 day, 9 hours ago Description :The Keycloak authentication manager in `apache-airflow-providers-keycloak` did not generate or validate the OAuth 2.0 `state` parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's browser and cause the victim to be logged into the attacker's Airflow session (login-CSRF / session fixation), where any credentials the victim subsequently stored in Airflow Connections would be harvestable by the attacker. Users are advised to upgrade `apache-airflow-providers-keycloak` to 0.7.0 or later. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Researcher Uses Claude Opus to Build a Working Chrome Exploit Chain Amidst the heated debate surrounding Anthropic’s recent announcement of its Mythos and Project Glasswing models, a security researcher has demonstrated the tangible cybersecurity implications of front ... Read more Published Date: Apr 18, 2026 (2 days, 17 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-5873

CVE ID :CVE-2026-2986 Published : April 18, 2026, 12:16 p.m. | 1 day, 9 hours ago Description :The Contextual Related Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes' parameter in versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Severity: 6.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-2505 Published : April 18, 2026, 10:16 a.m. | 1 day, 11 hours ago Description :The Categories Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.3.1, via the 'z_taxonomy_image' shortcode. This is due to the shortcode rendering path passing attacker-controlled class input into a fallback image builder that concatenates HTML attributes without proper escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts that execute when users interact with the injected frontend page via the 'class' shortcode attribute. Severity: 5.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-0894 Published : April 18, 2026, 10:16 a.m. | 1 day, 11 hours ago Description :The Content Blocks (Custom Post Widget) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's content_block shortcode in all versions up to, and including, 3.3.9 due to insufficient input sanitization and output escaping on user supplied values consumed from user-created content blocks. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Severity: 6.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Microsoft Defender Under Siege OverviewThree zero-day exploits targeting Microsoft Defender — BlueHammer, RedSun, and UnDefend — have been confirmed exploited in the wild by threat actors. All three were publicly released on GitHub ... Read more Published Date: Apr 18, 2026 (2 days, 19 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-33825 CVE-2026-34621

Nexcorium-Associated Mirai Variant Uses TBK DVR Exploit to Scale Botnet Operations A new iteration of the notorious Mirai botnet, dubbed Nexcorium, has emerged in the wild, aggressively targeting internet-connected video recording devices. According to recent threat research publish ... Read more Published Date: Apr 18, 2026 (2 days, 19 hours ago) Vulnerabilities has been mentioned in this article. CVE-2024-3721 CVE-2023-33538 CVE-2017-17215

CVE ID :CVE-2026-32690 Published : April 18, 2026, 7:16 a.m. | 1 day, 14 hours ago Description :Secrets in Variables saved as JSON dictionaries were not properly redacted - in case thee variables were retrieved by the user the secrets stored as nested fields were not masked. If you do not store variables with sensitive values in JSON form, you are not affected. Otherwise please upgrade to Apache Airflow 3.2.0 that has the fix implemented Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...