News & Sicurezza

CVE ID :CVE-2025-59707 Published : March 25, 2026, 3:16 p.m. | 36 minutes ago Description :In N2W before 4.3.2 and 4.4.x before 4.4.1, there is potential remote code execution and account credentials theft because of a spoofing vulnerability. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-59706 Published : March 25, 2026, 3:16 p.m. | 36 minutes ago Description :In N2W before 4.3.2 and 4.4.0 before 4.4.1, improper validation of API request parameters enables remote code execution. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-32991 Published : March 25, 2026, 3:16 p.m. | 36 minutes ago Description :In N2WS Backup & Recovery before 4.4.0, a two-step attack against the RESTful API results in remote code execution. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

F5 Out-of-Band Security Alert: Multiple Vulnerabilities Unveiled in NGINX Plus and Open Source In a significant out-of-band security notification released on March 24, 2026, F5 has disclosed several critical and high-severity vulnerabilities affecting both NGINX Plus and NGINX Open Source. The ... Read more Published Date: Mar 25, 2026 (1 day, 11 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-32647 CVE-2026-27784 CVE-2026-27654 CVE-2026-27651 CVE-2025-15517 CVE-2024-24990 CVE-2024-24989

CVE ID :CVE-2026-4815 Published : March 25, 2026, 2:16 p.m. | 1 hour, 36 minutes ago Description :A SQL Injection vulnerability has been found in Support Board v3.7.7. This vulnerability allows an attacker to retrieve, create, update and delete database via 'calls[0][message_ids][]' parameter in '/supportboard/include/ajax.php' endpoint. Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-4816 Published : March 25, 2026, 2:16 p.m. | 1 hour, 36 minutes ago Description :A Reflected Cross Site Scripting (XSS) vulnerability has been found in Support Board v3.7.7. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the 'search' parameter in '/supportboard/include/articles.php'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user. Severity: 4.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-3119 Published : March 25, 2026, 2:16 p.m. | 1 hour, 36 minutes ago Description :Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an incoming request has a valid transaction signature (TSIG) from a key declared in the `named` configuration. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-3591 Published : March 25, 2026, 2:16 p.m. | 1 hour, 36 minutes ago Description :A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected. Severity: 5.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.

If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see: https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries). This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, and 9.20.9-S1 through 9.20.20-S1.

Node.js Issues Security Updates: High-Severity DoS and Permission Bypasses Patched The Node.js project has released a critical sweep of security updates across its 20.x, 22.x, 24.x, and 25.x release lines. The updates address a total of nine vulnerabilities, including two High-sever ... Read more Published Date: Mar 25, 2026 (1 day, 6 hours ago) Vulnerabilities has been mentioned in this article.

F5 NGINX Plus and Open Source Vulnerability Allow Attackers to Execute Code Using MP4 file A high-severity vulnerability has been disclosed affecting both NGINX Open Source and NGINX Plus. Tracked formally as CVE-2026-32647, this security flaw carries a CVSS v4.0 base score of 8.5 and a CVS ... Read more Published Date: Mar 25, 2026 (1 day, 3 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-32647