News & Sicurezza

CVE ID :CVE-2026-23396 Published : March 26, 2026, 11:16 a.m. | 36 minutes ago Description :In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix NULL deref in mesh_matches_local() mesh_matches_local() unconditionally dereferences ie->mesh_config to compare mesh configuration parameters. When called from mesh_rx_csa_frame(), the parsed action-frame elements may not contain a Mesh Configuration IE, leaving ie->mesh_config NULL and triggering a kernel NULL pointer dereference. The other two callers are already safe: - ieee80211_mesh_rx_bcn_presp() checks !elems->mesh_config before calling mesh_matches_local() - mesh_plink_get_event() is only reached through mesh_process_plink_frame(), which checks !elems->mesh_config, too mesh_rx_csa_frame() is the only caller that passes raw parsed elements to mesh_matches_local() without guarding mesh_config. An adjacent attacker can exploit this by sending a crafted CSA action frame that includes a valid Mesh ID IE but omits the Mesh Configuration IE, crashing the kernel. The captured crash log: Oops: general protection fault, probably for non-canonical address ... KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] Workqueue: events_unbound cfg80211_wiphy_work [...] Call Trace: ? __pfx_mesh_matches_local (net/mac80211/mesh.c:65) ieee80211_mesh_rx_queued_mgmt (net/mac80211/mesh.c:1686) [...] ieee80211_iface_work (net/mac80211/iface.c:1754 net/mac80211/iface.c:1802) [...] cfg80211_wiphy_work (net/wireless/core.c:426) process_one_work (net/kernel/workqueue.c:3280) ? assign_work (net/kernel/workqueue.c:1219) worker_thread (net/kernel/workqueue.c:3352) ? __pfx_worker_thread (net/kernel/workqueue.c:3385) kthread (net/kernel/kthread.c:436) [...] ret_from_fork_asm (net/arch/x86/entry/entry_64.S:255) This patch adds a NULL check for ie->mesh_config at the top of mesh_matches_local() to return false early when the Mesh Configuration IE is absent. Severity: 0.0 | NA Visit the link for m...

Coruna iOS Kit Reuses 2023 Triangulation Exploit Code in New Mass Attacks The kernel exploit for two security vulnerabilities used in the recently uncovered Apple iOS exploit kit known as Coruna is an updated version of the same exploit that was used in the Operation Triang ... Read more Published Date: Mar 26, 2026 (1 day, 1 hour ago) Vulnerabilities has been mentioned in this article. CVE-2023-38606 CVE-2023-32434

Cisco Secure Firewall Vulnerability Allows Remote Code Execution as Root User Cisco has released an urgent security advisory addressing a critical vulnerability in its Secure Firewall Management Center (FMC) software. This severe flaw allows unauthenticated remote attackers to ... Read more Published Date: Mar 26, 2026 (1 day, 1 hour ago) Vulnerabilities has been mentioned in this article. CVE-2026-20131

A security vulnerability has been detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This issue affects the function strcpy of the file /goform/formConfigDnsFilterGlobal of the component Parameter Handler. Such manipulation of the argument GroupName leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

Cisco Alert: Public Vulnerabilities in IOS XE Risk Service Denial and Privilege Escalation Cisco has issued important security advisories for two distinct vulnerabilities within its Cisco IOS XE Software, targeting the Command Line Interface (CLI) and the Lobby Ambassador management API. Th ... Read more Published Date: Mar 26, 2026 (1 day, 2 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-20114 CVE-2026-20110 CVE-2026-20045 CVE-2025-20363 CVE-2025-20352 CVE-2025-29969 CVE-2024-20401

A weakness has been identified in Wavlink WL-NU516U1 260227. This vulnerability affects the function ftext of the file /cgi-bin/nas.cgi. This manipulation of the argument Content-Length causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

A security flaw has been discovered in 648540858 wvp-GB28181-pro up to 2.7.4. This affects the function GenericFastJsonRedisSerializer of the file src/main/java/com/genersoft/iot/vmp/conf/redis/RedisTemplateConfig.java of the component API Endpoint. The manipulation results in deserialization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID :CVE-2026-4861 Published : March 26, 2026, 9:16 a.m. | 2 hours, 36 minutes ago Description :A weakness has been identified in Wavlink WL-NU516U1 260227. This vulnerability affects the function ftext of the file /cgi-bin/nas.cgi. This manipulation of the argument Content-Length causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 9.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-4860 Published : March 26, 2026, 9:16 a.m. | 2 hours, 36 minutes ago Description :A security flaw has been discovered in 648540858 wvp-GB28181-pro up to 2.7.4. This affects the function GenericFastJsonRedisSerializer of the file src/main/java/com/genersoft/iot/vmp/conf/redis/RedisTemplateConfig.java of the component API Endpoint. The manipulation results in deserialization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-4263 Published : March 26, 2026, 10:16 a.m. | 1 hour, 36 minutes ago Description :Vulnerability of incorrect authorization in HiJiffy Chatbot allows an attacker to download private messages from other users via the parameter 'visitor' in '/api/v1/webchat/message'. Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Britse overheid roept organisaties op om kritiek Citrix-lek meteen te patchen De Britse overheid heeft organisaties opgeroepen om een kritieke kwetsbaarheid in Citrix NetScaler ADC en Citrix NetScaler meteen te patchen. Beveiligingsupdates voor het probleem, aangeduid als CVE-2 ... Read more Published Date: Mar 26, 2026 (1 day, 1 hour ago) Vulnerabilities has been mentioned in this article. CVE-2026-3055

CVE ID :CVE-2026-4262 Published : March 26, 2026, 10:16 a.m. | 1 hour, 36 minutes ago Description :Vulnerability of incorrect authorization in HiJiffy Chatbot allows an attacker to download private messages from other users via the parameter 'ID' in '/api/v1/download//'. Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...