News & Sicurezza

CVE ID :CVE-2026-4816 Published : March 25, 2026, 2:16 p.m. | 1 hour, 36 minutes ago Description :A Reflected Cross Site Scripting (XSS) vulnerability has been found in Support Board v3.7.7. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the 'search' parameter in '/supportboard/include/articles.php'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user. Severity: 4.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-4815 Published : March 25, 2026, 2:16 p.m. | 1 hour, 36 minutes ago Description :A SQL Injection vulnerability has been found in Support Board v3.7.7. This vulnerability allows an attacker to retrieve, create, update and delete database via 'calls[0][message_ids][]' parameter in '/supportboard/include/ajax.php' endpoint. Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-3591 Published : March 25, 2026, 2:16 p.m. | 1 hour, 36 minutes ago Description :A use-after-return vulnerability exists in the `named` server when handling DNS queries signed with SIG(0). Using a specially-crafted DNS request, an attacker may be able to cause an ACL to improperly (mis)match an IP address. In a default-allow ACL (denying only specific IP addresses), this may lead to unauthorized access. Default-deny ACLs should fail-secure. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected. Severity: 5.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-3119 Published : March 25, 2026, 2:16 p.m. | 1 hour, 36 minutes ago Description :Under certain conditions, `named` may crash when processing a correctly signed query containing a TKEY record. The affected code can only be reached if an incoming request has a valid transaction signature (TSIG) from a key declared in the `named` configuration. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

A specially crafted domain can be used to cause a memory leak in a BIND resolver simply by querying this domain. This issue affects BIND 9 versions 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, and 9.20.9-S1 through 9.20.20-S1. BIND 9 versions 9.18.0 through 9.18.46 and 9.18.11-S1 through 9.18.46-S1 are NOT affected.

If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see: https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries). This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, and 9.20.9-S1 through 9.20.20-S1.

Node.js Issues Security Updates: High-Severity DoS and Permission Bypasses Patched The Node.js project has released a critical sweep of security updates across its 20.x, 22.x, 24.x, and 25.x release lines. The updates address a total of nine vulnerabilities, including two High-sever ... Read more Published Date: Mar 25, 2026 (1 day, 6 hours ago) Vulnerabilities has been mentioned in this article.

F5 NGINX Plus and Open Source Vulnerability Allow Attackers to Execute Code Using MP4 file A high-severity vulnerability has been disclosed affecting both NGINX Open Source and NGINX Plus. Tracked formally as CVE-2026-32647, this security flaw carries a CVSS v4.0 base score of 8.5 and a CVS ... Read more Published Date: Mar 25, 2026 (1 day, 3 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-32647

CVE ID :CVE-2026-4761 Published : March 25, 2026, 1:16 p.m. | 36 minutes ago Description :When a certificate and its private key are installed in the Windows machine certificate store using Network and Security tool, access rights to the private key are unnecessarily granted to the operator group. * Installations based on Panorama Suite 2025 (25.00.004) are vulnerable unless update PS-2500-00-0357 (or higher) is installed * Installations based on Panorama Suite 2025 Updated Dec. 25 (25.10.007) are not vulnerable Please refer to security bulletin BS-036, available on the Panorama CSIRT website: https://my.codra.net/en-gb/csirt . Severity: 3.3 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-4760 Published : March 25, 2026, 1:16 p.m. | 36 minutes ago Description :From Panorama Web HMI, an attacker can gain read access to certain Web HMI server files, if he knows their paths and if these files are accessible to the Servin process execution account. * Installations based on Panorama Suite 2022-SP1 (22.50.005) are vulnerable unless update PS-2210-02-4079 (or higher) is installed * Installations based on Panorama Suite 2023 (23.00.004) are vulnerable unless updates PS-2300-03-3078 (or higher) and PS-2300-04-3078 (or higher) and PS-2300-82-3078 (or higher) are installed * Installations based on Panorama Suite 2025 (25.00.016) are vulnerable unless updates PS-2500-02-1078 (or higher) and PS-2500-04-1078 (or higher) are installed * Installations based on Panorama Suite 2025 Updated Dec. 25 (25.10.007) are vulnerable unless updates PS-2510-02-1077 (or higher) and PS-2510-04-1077 (or higher) are installed Please refer to security bulletin BS-035, available on the Panorama CSIRT website: https://my.codra.net/en-gb/csirt . Severity: 7.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Firefox 149 Released With Patch for 37 Vulnerabilities that Enables Remote Attacks Mozilla released Firefox 149 on March 24, 2026, delivering one of the largest security advisories in the browser’s recent history, addressing 37 vulnerabilities spanning memory corruption, sandbox esc ... Read more Published Date: Mar 25, 2026 (1 day, 3 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-4729 CVE-2026-4728 CVE-2026-4727 CVE-2026-4726 CVE-2026-4725 CVE-2026-4724 CVE-2026-4723 CVE-2026-4722 CVE-2026-4721 CVE-2026-4720 CVE-2026-4719 CVE-2026-4718 CVE-2026-4717 CVE-2026-4716 CVE-2026-4715 CVE-2026-4714 CVE-2026-4713 CVE-2026-4712 CVE-2026-4711 CVE-2026-4710 CVE-2026-4709 CVE-2026-4708 CVE-2026-4707 CVE-2026-4706 CVE-2026-4705 CVE-2026-4704 CVE-2026-4702 CVE-2026-4701 CVE-2026-4700 CVE-2026-4699 CVE-2026-4698 CVE-2026-4697 CVE-2026-4696 CVE-2026-4695 CVE-2026-4694 CVE-2026-4693 CVE-2026-4692 CVE-2026-4691 CVE-2026-4690 CVE-2026-4689 CVE-2026-4688 CVE-2026-4687 CVE-2026-4686 CVE-2026-4685 CVE-2026-4684 CVE-2025-59375

CVE ID :CVE-2025-40842 Published : March 25, 2026, 1:10 p.m. | 42 minutes ago Description :Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains a Cross-Site Scripting (XSS) vulnerability which, if exploited, can lead to unauthorized disclosure and modification of certain information. Severity: 8.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...