News & Sicurezza

No Patch Available: The CVSS 10 Flaw Turning AVideo into an Attacker’s Playground AVideo, a versatile video streaming platform popular among content creators and businesses for hosting and monetizing content, is facing a security crisis. A critical vulnerability has been uncovered ... Read more Published Date: Apr 15, 2026 (22 hours, 10 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-32201 CVE-2026-22679 CVE-2026-28501 CVE-2026-21962

April Patch Tuesday Fixes Critical Flaws Across SAP, Adobe, Microsoft, Fortinet, and More A number of critical vulnerabilities impacting products from Adobe, Fortinet, Microsoft, and SAP have taken center stage in April's Patch Tuesday releases. Topping the list is an SQL injection vulnera ... Read more Published Date: Apr 15, 2026 (20 hours, 13 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-34619 CVE-2026-27306 CVE-2026-27305 CVE-2026-27304 CVE-2026-27282 CVE-2026-32201 CVE-2026-39813 CVE-2026-39808 CVE-2026-27681 CVE-2026-34621 CVE-2026-35616 CVE-2026-5281 CVE-2026-34040 CVE-2025-55182

CVE ID :CVE-2026-25219 Published : April 15, 2026, 1:16 p.m. | 2 hours, 41 minutes ago Description :The `access_key` and `connection_string` connection properties were not marked as sensitive names in secrets masker. This means that user with read permission could see the values in Connection UI, as well as when Connection was accidentaly logged to logs, those values could be seen in the logs. Azure Service Bus used those properties to store sensitive values. Possibly other providers could be also affected if they used the same fields to store sensitive data. If you used Azure Service Bus connection with those values set or if you have other connections with those values storing sensitve values, you should upgrade Airflow to 3.1.8 Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-4145 Published : April 15, 2026, 1:16 p.m. | 2 hours, 41 minutes ago Description :During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privileges. Severity: 8.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-4135 Published : April 15, 2026, 1:16 p.m. | 2 hours, 41 minutes ago Description :During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix, that during installation could allow a local authenticated user to perform an arbitrary file write with elevated privileges. Severity: 6.6 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-4134 Published : April 15, 2026, 1:16 p.m. | 2 hours, 41 minutes ago Description :During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix, that during installation could allow a local authenticated user to execute code with elevated privileges. Severity: 7.3 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-1636 Published : April 15, 2026, 1:16 p.m. | 2 hours, 41 minutes ago Description :A potential DLL hijacking vulnerability was reported in Lenovo Service Bridge that, under certain conditions, could allow a local authenticated user to execute code with elevated privileges. Severity: 6.7 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-0827 Published : April 15, 2026, 1:16 p.m. | 2 hours, 41 minutes ago Description :During an internal security assessment, a potential vulnerability was discovered in Lenovo Diagnostics and the HardwareScanAddin used in Lenovo Vantage that, during installation or when using hardware scan, could allow a local authenticated user to perform an arbitrary file write with elevated privileges. Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

High-Severity Authentication Bypass Discovered in MinIO Storage A significant security vulnerability has been identified in MinIO, the high-performance, S3-compatible object storage solution widely used for AI/ML and data-intensive workloads. The flaw, categorized ... Read more Published Date: Apr 15, 2026 (20 hours, 48 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-32201 CVE-2026-22679 CVE-2025-62506 CVE-2024-55949

Ancient Excel bug comes out of retirement for active attacks While Microsoft was rolling out its bumper Patch Tuesday updates this week, US cybersecurity agency CISA was readying an alert about a 17-year-old critical Excel flaw now under exploit. CISA confirmed ... Read more Published Date: Apr 15, 2026 (21 hours, 4 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-32201 CVE-2009-0238

CVE ID :CVE-2026-1852 Published : April 15, 2026, 12:16 p.m. | 3 hours, 41 minutes ago Description :The Product Pricing Table by WooBeWoo plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing or incorrect nonce validation on the updateLabel() and remove() functions. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages or delete pricing tables via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Severity: 6.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-3590 Published : April 15, 2026, 12:16 p.m. | 3 hours, 41 minutes ago Description :Mattermost versions 10.11.x Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...