News & Sicurezza

CVE ID :CVE-2026-34185 Published : April 9, 2026, 10:16 a.m. | 3 hours, 40 minutes ago Description :Hydrosystem Control System is vulnerable to SQL Injection across most scripts and input parameters. Because no protections are in place, an authenticated attacker can inject arbitrary SQL commands, potentially gaining full control over the database.This issue was fixed in Hydrosystem Control System version 9.8.5 Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-34184 Published : April 9, 2026, 10:16 a.m. | 3 hours, 40 minutes ago Description :Hydrosystem Control System does not enforce authorization for some directories. This allows an unauthorized attacker to read all files in these directories and even execute some of them. Critically the attacker could run PHP scripts directly on the connected database.This issue was fixed in Hydrosystem Control System version 9.8.5 Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-4901 Published : April 9, 2026, 10:16 a.m. | 3 hours, 40 minutes ago Description :Hydrosystem Control System saves sensitive information into a log file. Critically, user credentials are logged allowing the attacker to obtain further authorized access into the system. Combined with vulnerability CVE-2026-34184, these sensitive information could be accessed by an unauthorized user.This issue was fixed in Hydrosystem Control System version 9.8.5 Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-62188 Published : April 9, 2026, 10:16 a.m. | 3 hours, 40 minutes ago Description :An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler. This vulnerability may allow unauthorized actors to access sensitive information, including database credentials. This issue affects Apache DolphinScheduler versions 3.1.*. Users are recommended to upgrade to: * version ≥ 3.2.0 if using 3.1.x As a temporary workaround, users who cannot upgrade immediately may restrict the exposed management endpoints by setting the following environment variable: ``` MANAGEMENT_ENDPOINTS_WEB_EXPOSURE_INCLUDE=health,metrics,prometheus ``` Alternatively, add the following configuration to the application.yaml file: ``` management: endpoints: web: exposure: include: health,metrics,prometheus ``` This issue has been reported as CVE-2023-48796: https://cveprocess.apache.org/cve5/CVE-2023-48796 Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Denial of Service Alert: React Server Components Vulnerability Causes CPU Spikes React, the popular JavaScript library used by millions of developers for building user interfaces, has issued an urgent advisory regarding a denial of service (DoS) vulnerability. The flaw specificall ... Read more Published Date: Apr 09, 2026 (1 day, 5 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-23869 CVE-2026-34078 CVE-2026-22679 CVE-2026-35616 CVE-2026-5281 CVE-2026-3502 CVE-2026-1340 CVE-2026-23864 CVE-2025-55182 CVE-2025-49826

CVE ID :CVE-2026-34179 Published : April 9, 2026, 10:16 a.m. | 3 hours, 40 minutes ago Description :In Canonical LXD versions 4.12 through 6.7, the doCertificateUpdate function in lxd/certificates.go does not validate the Type field when handling PUT/PATCH requests to /1.0/certificates/{fingerprint} for restricted TLS certificate users, allowing a remote authenticated attacker to escalate privileges to cluster admin. Severity: 9.1 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-34178 Published : April 9, 2026, 10:16 a.m. | 3 hours, 40 minutes ago Description :In Canonical LXD before 6.8, the backup import path validates project restrictions against backup/index.yaml in the supplied tar archive but creates the instance from backup/container/backup.yaml, a separate file in the same archive that is never checked against project restrictions. An authenticated remote attacker with instance-creation permission in a restricted project can craft a backup archive where backup.yaml carries restricted settings such as security.privileged=true or raw.lxc directives, bypassing all project restriction enforcement and allowing full host compromise. Severity: 9.1 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Sandbox Escape: Critical Flatpak Flaw Grants Full Host Access Flatpak, the widely-used system for building, distributing, and running sandboxed desktop applications on Linux, has been hit by a critical security vulnerability. The flaw, tracked as CVE-2026-34078 ... Read more Published Date: Apr 09, 2026 (1 day, 3 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-23869 CVE-2026-34078 CVE-2026-22679 CVE-2021-4473 CVE-2026-35616 CVE-2026-5281 CVE-2026-3308 CVE-2026-34156 CVE-2026-3502 CVE-2026-1340

CVE ID :CVE-2026-34177 Published : April 9, 2026, 10:16 a.m. | 3 hours, 40 minutes ago Description :Canonical LXD versions 4.12 through 6.7 contain an incomplete denylist in isVMLowLevelOptionForbidden (lxd/project/limits/permissions.go), which omits raw.apparmor and raw.qemu.conf from the set of keys blocked under the restricted.virtual-machines.lowlevel=block project restriction. A remote attacker with can_edit permission on a VM instance in a restricted project can inject an AppArmor rule and a QEMU chardev configuration that bridges the LXD Unix socket into the guest VM, enabling privilege escalation to LXD cluster administrator and subsequently to host root. Severity: 9.1 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-34538 Published : April 9, 2026, 10:16 a.m. | 3 hours, 40 minutes ago Description :Apache Airflow versions 3.0.0 through 3.1.8 DagRun wait endpoint returns XCom result values even to users who only have DAG Run read permissions, such as the Viewer role.This behavior conflicts with the FAB RBAC model, which treats XCom as a separate protected resource, and with the security model documentation that defines the Viewer role as read-only. Airflow uses the FAB Auth Manager to manage access control on a per-resource basis. The Viewer role is intended to be read-only by default, and the security model documentation defines Viewer users as those who can inspect DAGs without accessing sensitive execution results. Users are recommended to upgrade to Apache Airflow 3.2.0 which resolves this issue. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

A vulnerability was detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this issue is the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Performing a manipulation of the argument merge results in os command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

A security vulnerability has been detected in Totolink A7100RU 7.4cu.2313_b20191024. Affected by this vulnerability is the function setIpv6LanCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument addrPrefixLen leads to os command injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.