News & Sicurezza

Active SharePoint Spoofing and Legacy Office RCE: CISA Alerts on New KEV Exploits The Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) Catalog, sounding a fresh warning about two high-risk security flaws currently being ... Read more Published Date: Apr 15, 2026 (22 hours, 15 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-33806 CVE-2026-32201 CVE-2026-39813 CVE-2026-39808 CVE-2026-22679 CVE-2026-35616 CVE-2026-1340 CVE-2025-49706 CVE-2025-49704 CVE-2009-0238

Microsoft SharePoint Server 0-Day Vulnerability Actively Exploited in Attacks A critical zero-day spoofing vulnerability in Microsoft SharePoint Server is being actively exploited in the wild, Microsoft confirmed on April 14, 2026, as part of its monthly security update cycle. ... Read more Published Date: Apr 15, 2026 (22 hours, 20 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-32201

25 Million Users at Risk: Fastify Publicly Discloses PoC Exploit for Single-Space Security Bypass In the world of web performance, Fastify is a heavyweight, boasting over 25 million monthly downloads and a reputation for being one of the fastest frameworks available. However, a newly disclosed vul ... Read more Published Date: Apr 15, 2026 (22 hours, 35 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-33806 CVE-2026-32201 CVE-2026-22679 CVE-2026-35616 CVE-2026-31938 CVE-2026-27212 CVE-2025-32442

CVE ID :CVE-2026-40499 Published : April 15, 2026, 2:05 a.m. | 5 hours, 52 minutes ago Description :radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by embedding a newline byte in the PE section header name field. Attackers can craft a malicious PDB file with specially crafted section names to inject r2 commands that are executed when the idp command processes the file. Severity: 8.4 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

OpenStack Keystone Flaw Grants Access to Disabled LDAP Users In the complex machinery of cloud identity management, a single misinterpretation of data can lead to a significant security breach. A recently disclosed vulnerability in OpenStack Keystone, the prima ... Read more Published Date: Apr 15, 2026 (20 hours, 51 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-22679 CVE-2026-35616 CVE-2026-22797 CVE-2025-68926 CVE-2025-13357 CVE-2024-44082

Urgent Patch Alert: SharePoint Spoofing Under Active Attack as Microsoft Releases April 2026 Updates Microsoft’s April 2026 Patch Tuesday has arrived with a massive security payload, addressing a staggering 163 vulnerabilities, including eight rated as critical. While the volume alone is significant, ... Read more Published Date: Apr 15, 2026 (15 hours, 3 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-33827 CVE-2026-33826 CVE-2026-33825 CVE-2026-32201 CVE-2026-32157 CVE-2026-22679 CVE-2026-35616 CVE-2026-21519 CVE-2025-55234 CVE-2025-53770 CVE-2024-49039 CVE-2024-21907

CVE ID :CVE-2026-1509 Published : April 15, 2026, 1:25 a.m. | 6 hours, 32 minutes ago Description :The Avada (Fusion) Builder plugin for WordPress is vulnerable to Arbitrary WordPress Action Execution in all versions up to, and including, 3.15.1. This is due to the plugin's `output_action_hook()` function accepting user-controlled input to trigger any registered WordPress action hook without proper authorization checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary WordPress action hooks via the Dynamic Data feature, potentially leading to privilege escalation, file inclusion, denial of service, or other security impacts depending on which action hooks are available in the WordPress installation. Severity: 5.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-1541 Published : April 15, 2026, 1:25 a.m. | 6 hours, 32 minutes ago Description :The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.15.1. This is due to the plugin's `fusion_get_post_custom_field()` function failing to validate whether metadata keys are protected (underscore-prefixed). This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract protected post metadata fields that should not be publicly accessible via the Dynamic Data feature's `post_custom_field` parameter. Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-4812 Published : April 15, 2026, 1:25 a.m. | 6 hours, 32 minutes ago Description :The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disclosure in versions up to and including 6.7.0. This is due to AJAX field query endpoints accepting user-supplied filter parameters that override field-configured restrictions without proper authorization checks. This makes it possible for unauthenticated attackers with access to a frontend ACF form to enumerate and disclose information about draft/private posts, restricted post types, and other data that should be restricted by field configuration. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-2834 Published : April 15, 2026, 1:25 a.m. | 6 hours, 32 minutes ago Description :The Age Verification & Identity Verification by Token of Trust plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘description’ parameter in all versions up to, and including, 3.32.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Severity: 7.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Microsoft Patch Tuesday — April 2026 TheCyberThrone | Vulnerability Advisory | April 15, 2026Volume & Scale — A Near-Record ReleaseMicrosoft patched 163 CVEs in the April 2026 Patch Tuesday release — the second largest Patch Tuesday on r ... Read more Published Date: Apr 15, 2026 (13 hours, 44 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-33827 CVE-2026-33826 CVE-2026-33825 CVE-2026-33824 CVE-2026-33115 CVE-2026-33114 CVE-2026-32225 CVE-2026-32201 CVE-2026-32190 CVE-2026-32162 CVE-2026-32157 CVE-2026-32154 CVE-2026-32152 CVE-2026-32070 CVE-2026-27921 CVE-2026-27913 CVE-2026-27908 CVE-2026-27906 CVE-2026-26151 CVE-2026-23666 CVE-2026-0390 CVE-2026-34621

CVE ID :CVE-2025-54550 Published : April 15, 2026, 12:22 a.m. | 7 hours, 35 minutes ago Description :The example example_xcom that was included in airflow documentation implemented unsafe pattern of reading value from xcom in the way that could be exploited to allow UI user who had access to modify XComs to perform arbitrary execution of code on the worker. Since the UI users are already highly trusted, this is a Low severity vulnerability. It does not affect Airflow release - example_dags are not supposed to be enabled in production environment, however users following the example could replicate the bad pattern. Documentation of Airflow 3.2.0 contains version of the example with improved resiliance for that case. Users who followed that pattern are advised to adjust their implementations accordingly. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...