News & Sicurezza

CVE ID :CVE-2026-23415 Published : April 2, 2026, 12:16 p.m. | 1 hour, 38 minutes ago Description :In the Linux kernel, the following vulnerability has been resolved: futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() During futex_key_to_node_opt() execution, vma->vm_policy is read under speculative mmap lock and RCU. Concurrently, mbind() may call vma_replace_policy() which frees the old mempolicy immediately via kmem_cache_free(). This creates a race where __futex_key_to_node() dereferences a freed mempolicy pointer, causing a use-after-free read of mpol->mode. [ 151.412631] BUG: KASAN: slab-use-after-free in __futex_key_to_node (kernel/futex/core.c:349) [ 151.414046] Read of size 2 at addr ffff888001c49634 by task e/87 [ 151.415969] Call Trace: [ 151.416732] __asan_load2 (mm/kasan/generic.c:271) [ 151.416777] __futex_key_to_node (kernel/futex/core.c:349) [ 151.416822] get_futex_key (kernel/futex/core.c:374 kernel/futex/core.c:386 kernel/futex/core.c:593) Fix by adding rcu to __mpol_put(). Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Apple Expands iOS 18.7.7 Update to More Devices to Shield Users from DarkSword Exploit Apple has taken the rare step of expanding the availability of iOS 18.7.7 and iPadOS 18.7.7 to a broader set of devices on April 1, 2026, pushing critical backported security patches to millions of us ... Read more Published Date: Apr 02, 2026 (1 day, 4 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-28871 CVE-2026-28868 CVE-2026-28867 CVE-2026-28865 CVE-2026-28864 CVE-2026-28861 CVE-2026-20690 CVE-2026-20687 CVE-2026-20665 CVE-2026-20637 CVE-2025-43534 CVE-2026-20643 CVE-2025-14524

CVE ID :CVE-2026-5326 Published : April 2, 2026, 11:16 a.m. | 2 hours, 38 minutes ago Description :A vulnerability was identified in SourceCodester Leave Application System 1.0. Impacted is an unknown function of the file /index.php?page=manage_user of the component User Information Handler. Such manipulation of the argument ID leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and might be used. Severity: 5.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-32145 Published : April 2, 2026, 11:16 a.m. | 2 hours, 38 minutes ago Description :Allocation of Resources Without Limits or Throttling vulnerability in gleam-wisp wisp allows a denial of service via multipart form body parsing. The multipart_body function bypasses configured max_body_size and max_files_size limits. When a multipart boundary is not present in a chunk, the parser takes the MoreRequiredForBody path, which appends the chunk to the output but passes the quota unchanged to the recursive call. Only the final chunk containing the boundary is counted via decrement_quota. The same pattern exists in multipart_headers, where MoreRequiredForHeaders recurses without calling decrement_body_quota. An unauthenticated attacker can exhaust server memory or disk by sending arbitrarily large multipart form submissions in a single HTTP request. This issue affects wisp: from 0.2.0 before 2.2.2. Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Vulnerabilities in Szafir software Vulnerabilities in Szafir software CVE ID CVE-2026-26927 Publication date 02 April 2026 Vendor Krajowa Izba Rozliczeniowa Product Szafir SDK Web Vulnerable versions All before 0.0.17.4 Vulnerability t ... Read more Published Date: Apr 02, 2026 (1 day, 3 hours ago) Vulnerabilities has been mentioned in this article.

An unauthenticated remote attacker can exploit an unauthenticated blind SQL Injection vulnerability in the mb24api endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

CVE ID :CVE-2026-5246 Published : April 2, 2026, 10:16 a.m. | 3 hours, 38 minutes ago Description :A vulnerability was determined in Cesanta Mongoose up to 7.20. Affected is the function mg_tls_verify_cert_signature of the file mongoose.c of the component P-384 Public Key Handler. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. Attacks of this nature are highly complex. The exploitability is told to be difficult. The exploit has been publicly disclosed and may be utilized. Upgrading to version 7.21 is able to address this issue. This patch is called 0d882f1b43ff2308b7486a56a9d60cd6dba8a3f1. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product. Severity: 6.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the setinfo endpoint due to improper neutralization of special elements in a SQL UPDATE command. This can result in a total loss of integrity and availability.

An unauthenticated remote attacker can exploit an unauthenticated SQL Injection vulnerability in the getinfo endpoint due to improper neutralization of special elements in a SQL SELECT command. This can result in a total loss of confidentiality.

Due to the improper neutralisation of special elements used in an OS command, a remote attacker can exploit an RCE vulnerability in the generateSrpArray function, resulting in full system compromise. This vulnerability can only be attacked if the attacker has some other way to write arbitrary data to the user table.

Cisco Smart Software Manager Vulnerability Let Attackers Execute Arbitrary Commands Cisco has issued an urgent security warning regarding a critical vulnerability in its Smart Software Manager On-Prem (SSM On-Prem) platform. Enterprise organizations widely use this tool to manage the ... Read more Published Date: Apr 02, 2026 (1 day, 4 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-20160

'Overheden aangevallen via beveiligingslek in videovergaderplatform TrueConf' Overheidsinstanties in Zuidoost-Azië zijn aangevallen via een kwetsbaarheid in het videovergaderplatform TrueConf. Op het moment van de aanvallen was er nog geen beveiligingsupdate beschikbaar. Inmidd ... Read more Published Date: Apr 02, 2026 (1 day, 4 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-3502