News & Sicurezza

CVE ID :CVE-2026-5188 Published : April 10, 2026, 4:17 a.m. | 1 hour, 39 minutes ago Description :An integer underflow issue exists in wolfSSL when parsing the Subject Alternative Name (SAN) extension of X.509 certificates. A malformed certificate can specify an entry length larger than the enclosing sequence, causing the internal length counter to wrap during parsing. This results in incorrect handling of certificate data. The issue is limited to configurations using the original ASN.1 parsing implementation which is off by default. Severity: 2.3 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

A vulnerability was detected in code-projects Simple IT Discussion Forum 1.0. Impacted is an unknown function of the file /delete-category.php. Performing a manipulation of the argument cat_id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

CVE ID :CVE-2026-6004 Published : April 10, 2026, 3:16 a.m. | 2 hours, 40 minutes ago Description :A vulnerability was detected in code-projects Simple IT Discussion Forum 1.0. Impacted is an unknown function of the file /delete-category.php. Performing a manipulation of the argument cat_id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-5999 Published : April 10, 2026, 3:16 a.m. | 2 hours, 40 minutes ago Description :A vulnerability has been found in JeecgBoot up to 3.9.1. This impacts an unknown function of the component SysAnnouncementController. Such manipulation leads to improper authorization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor confirmed the issue and will provide a fix in the upcoming release. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-6000 Published : April 10, 2026, 3:16 a.m. | 2 hours, 40 minutes ago Description :A vulnerability was found in code-projects Online Library Management System 1.0. Affected is an unknown function of the file /sql/library.sql of the component SQL Database Backup File Handler. Performing a manipulation results in information disclosure. The attack may be initiated remotely. The exploit has been made public and could be used. Severity: 5.0 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-6003 Published : April 10, 2026, 3:16 a.m. | 2 hours, 40 minutes ago Description :A security vulnerability has been detected in code-projects Simple IT Discussion Forum 1.0. This issue affects some unknown processing of the file /admin/user.php. Such manipulation of the argument fname leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Severity: 4.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-33551 Published : April 10, 2026, 3:16 a.m. | 2 hours, 40 minutes ago Description :An issue was discovered in OpenStack Keystone 14 through 26 before 26.1.1, 27.0.0, 28.0.0, and 29.0.0. Restricted application credentials can create EC2 credentials. By using a restricted application credential to call the EC2 credential creation API, an authenticated user with only a reader role may obtain an EC2/S3 credential that carries the full set of the parent user's S3 permissions, effectively bypassing the role restrictions imposed on the application credential. Only deployments that use restricted application credentials in combination with the EC2/S3 compatibility API (swift3 / s3api) are affected. Severity: 3.5 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-6007 Published : April 10, 2026, 4:17 a.m. | 3 hours, 39 minutes ago Description :A vulnerability was found in itsourcecode Construction Management System 1.0. This affects an unknown function of the file /del.php. The manipulation of the argument equipname results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-5500 Published : April 10, 2026, 4:17 a.m. | 1 hour, 39 minutes ago Description :wolfSSL's wc_PKCS7_DecodeAuthEnvelopedData() does not properly sanitize the AES-GCM authentication tag length received and has no lower bounds check. A man-in-the-middle can therefore truncate the mac field from 16 bytes to 1 byte, reducing the tag check from 2⁻¹²⁸ to 2⁻⁸. Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-5501 Published : April 10, 2026, 4:17 a.m. | 1 hour, 39 minutes ago Description :wolfSSL_X509_verify_cert in the OpenSSL compatibility layer accepts a certificate chain in which the leaf's signature is not checked, if the attacker supplies an untrusted intermediate with Basic Constraints `CA:FALSE` that is legitimately signed by a trusted root. An attacker who obtains any leaf certificate from a trusted CA (e.g. a free DV cert from Let's Encrypt) can forge a certificate for any subject name with any public key and arbitrary signature bytes, and the function returns `WOLFSSL_SUCCESS` / `X509_V_OK`. The native wolfSSL TLS handshake path (`ProcessPeerCerts`) is not susceptible and the issue is limited to applications using the OpenSSL compatibility API directly, which would include integrations of wolfSSL into nginx and haproxy. Severity: 8.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

HPE Aruba Patches High-Severity Credential Theft Flaw HPE Aruba Networking has issued an important software update to address a high-severity security flaw in its Private 5G Core On-Prem Platform. The vulnerability, tracked as CVE-2026-23818, could allow ... Read more Published Date: Apr 10, 2026 (3 days, 5 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-23818 CVE-2026-22679 CVE-2026-35616 CVE-2026-20160 CVE-2026-5281 CVE-2026-3502 CVE-2026-1340 CVE-2025-23058 CVE-2024-26305

CVE ID :CVE-2026-5466 Published : April 10, 2026, 4:17 a.m. | 1 hour, 39 minutes ago Description :wolfSSL's ECCSI signature verifier `wc_VerifyEccsiHash` decodes the `r` and `s` scalars from the signature blob via `mp_read_unsigned_bin` with no check that they lie in `[1, q-1]`. A crafted forged signature could verify against any message for any identity, using only publicly-known constants. Severity: 7.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...