News & Sicurezza

CVE ID :CVE-2026-6490 Published : April 17, 2026, 2:16 p.m. | 3 hours, 42 minutes ago Description :A weakness has been identified in QueryMine sms up to 7ab5a9ea196209611134525ffc18de25c57d9593. Impacted is an unknown function of the file admin/deletecourse.php of the component GET Request Parameter Handler. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public and could be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

The Good, the Bad and the Ugly in Cybersecurity – Week 16 The Good | U.S. Authorities Seize W3LL Phishing Ring & Jail DPRK IT Worker Scheme Facilitators The FBI has dismantled the “W3LL” phishing platform, seized its infrastructure, and arrested its alleged ... Read more Published Date: Apr 17, 2026 (2 days, 23 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-33032

CISA meldt actief misbruik van kritiek lek in Apache ActiveMQ Een kritieke kwetsbaarheid in Apache ActiveMQ wordt actief misbruikt, zo waarschuwt het Cybersecurity and Infrastructure Security Agency (CISA) van het Amerikaanse ministerie van Homeland Security. De ... Read more Published Date: Apr 17, 2026 (2 days, 22 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-34197

CVE ID :CVE-2026-28263 Published : April 17, 2026, 12:16 p.m. | 3 hours, 42 minutes ago Description :Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain a cross-site Scripting vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection. Severity: 5.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-23777 Published : April 17, 2026, 12:16 p.m. | 3 hours, 42 minutes ago Description :Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.5, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.50, contain an exposure of sensitive information to an unauthorized actor vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to information exposure. Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-46606 Published : April 17, 2026, 12:16 p.m. | 3 hours, 42 minutes ago Description :Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 8.4 through 8.5 contain an improper restriction of excessive authentication attempts vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access. Severity: 6.2 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Critical Command Injection Flaw Hits upKeeper Instant Privilege Access A critical security vulnerability has been unmasked in upKeeper Instant Privilege Access, a tool designed to give users temporary administrative rights in a controlled, traceable manner. The flaw, tra ... Read more Published Date: Apr 17, 2026 (2 days, 22 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-2449 CVE-2026-22679 CVE-2026-0740 CVE-2026-0866 CVE-2026-2256 CVE-2026-27699 CVE-2025-62878 CVE-2025-30411 CVE-2026-1358 CVE-2025-26385 CVE-2026-1453 CVE-2026-23830 CVE-2025-14988 CVE-2026-0994 CVE-2026-0695 CVE-2025-61937 CVE-2025-37186 CVE-2025-52691 CVE-2025-37164 CVE-2025-59396 CVE-2025-58384 CVE-2025-1316 CVE-1999-0073

CVE ID :CVE-2025-46605 Published : April 17, 2026, 12:16 p.m. | 3 hours, 42 minutes ago Description :Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 8.4 through 8.5 contain a session fixation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access. Severity: 6.2 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-46641 Published : April 17, 2026, 12:16 p.m. | 3 hours, 42 minutes ago Description :Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 8.4 through 8.5 contain an improper authentication vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access. Severity: 6.6 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

A vulnerability was found in Wavlink WL-WN530H4 20220721. This vulnerability affects the function strcat/snprintf of the file /cgi-bin/internet.cgi. The manipulation results in os command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2026.04.16 is able to resolve this issue. Upgrading the affected component is recommended.

CVE ID :CVE-2026-6483 Published : April 17, 2026, 11:16 a.m. | 2 hours, 42 minutes ago Description :A vulnerability was found in Wavlink WL-WN530H4 20220721. This vulnerability affects the function strcat/snprintf of the file /cgi-bin/internet.cgi. The manipulation results in os command injection. It is possible to launch the attack remotely. The exploit has been made public and could be used. Upgrading to version 2026.04.16 is able to resolve this issue. Upgrading the affected component is recommended. Severity: 8.3 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-5131 Published : April 17, 2026, 11:16 a.m. | 2 hours, 42 minutes ago Description :GREENmod uses named pipes for communication between plugins, the web portal, and the system service, but the access control lists for these pipes are configured incorrectly. This allows an attacker to communicate with the stream and upload any XML or JSON file, which will be processed by the named pipe with the privileges of the user under whose context the service is running. This allows for Server-Side Request Forgery to any Windows system on which the agent is installed and which provides communication via SMB or WebDav. This issue was fixed in version 2.8.33. Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...