News & Sicurezza

CVE ID :CVE-2026-33292 Published : March 22, 2026, 5:17 p.m. | 10 hours, 35 minutes ago Description :WWBN AVideo is an open source video platform. Prior to version 26.0, the HLS streaming endpoint (`view/hls.php`) is vulnerable to a path traversal attack that allows an unauthenticated attacker to stream any private or paid video on the platform. The `videoDirectory` GET parameter is used in two divergent code paths — one for authorization (which truncates at the first `/` segment) and one for file access (which preserves `..` traversal sequences) — creating a split-oracle condition where authorization is checked against one video while content is served from another. Version 26.0 contains a fix for the issue. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

A vulnerability was identified in Tenda F453 1.0.0.3. Impacted is the function fromNatlimit of the file /goform/Natlimit of the component Parameters Handler. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

CVE ID :CVE-2026-4553 Published : March 22, 2026, 4:16 p.m. | 11 hours, 36 minutes ago Description :A vulnerability was identified in Tenda F453 1.0.0.3. Impacted is the function fromNatlimit of the file /goform/Natlimit of the component Parameters Handler. The manipulation of the argument page leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. Severity: 9.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

A vulnerability was determined in Tenda F453 1.0.0.3. This issue affects the function fromVirtualSer of the file /goform/VirtualSer of the component Parameters Handler. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.

A vulnerability was found in Tenda F453 1.0.0.3. This vulnerability affects the function fromSafeClientFilter of the file /goform/SafeClientFilter of the component Parameters Handler. Performing a manipulation of the argument menufacturer/Go results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

CVE ID :CVE-2026-4551 Published : March 22, 2026, 3:17 p.m. | 12 hours, 35 minutes ago Description :A vulnerability was found in Tenda F453 1.0.0.3. This vulnerability affects the function fromSafeClientFilter of the file /goform/SafeClientFilter of the component Parameters Handler. Performing a manipulation of the argument menufacturer/Go results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Severity: 9.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-4552 Published : March 22, 2026, 3:17 p.m. | 12 hours, 35 minutes ago Description :A vulnerability was determined in Tenda F453 1.0.0.3. This issue affects the function fromVirtualSer of the file /goform/VirtualSer of the component Parameters Handler. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Severity: 9.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Unmasking DarkSword: GTIG Exposes Full-Chain iOS Exploit Used by Global Spies Timeline of DarkSword observations and vulnerability patches | Image: GTIG In a comprehensive technical disclosure, the Google Threat Intelligence Group (GTIG) has revealed the existence of a highly s ... Read more Published Date: Mar 22, 2026 (1 day, 17 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-20643 CVE-2026-20700 CVE-2025-43529 CVE-2025-43520 CVE-2025-43510 CVE-2025-14174 CVE-2025-31277 CVE-2025-32432

Disconnect Immediately: Rockwell Automation Issues Urgent Warning for Industrial Controllers In a proactive move aimed at securing critical infrastructure, Rockwell Automation has issued a high-priority “Important Notice” to its global customer base. The advisory comes as the company identifi ... Read more Published Date: Mar 22, 2026 (1 day, 18 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-0866 CVE-2025-13824 CVE-2025-13823 CVE-2025-7693 CVE-2025-7353 CVE-2025-32432 CVE-2025-0477 CVE-2025-24480 CVE-2025-24479 CVE-2024-7567 CVE-2023-48693 CVE-2023-48692 CVE-2023-48691 CVE-2020-25184 CVE-2020-25182 CVE-2020-25180 CVE-2020-25178 CVE-2020-25176 CVE-2021-32926 CVE-2021-22681

CVE ID :CVE-2026-4549 Published : March 22, 2026, 2:16 p.m. | 13 hours, 35 minutes ago Description :A flaw has been found in mickasmt next-saas-stripe-starter 1.0.0. Affected by this issue is the function openCustomerPortal of the file actions/open-customer-portal.ts of the component Stripe API. This manipulation causes authorization bypass. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitation is known to be difficult. Severity: 3.1 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-4550 Published : March 22, 2026, 2:16 p.m. | 13 hours, 35 minutes ago Description :A vulnerability has been found in code-projects Simple Gym Management System up to 1.0. This affects an unknown part of the file /gym/func.php. Such manipulation of the argument Trainer_id/fname leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Severity: 5.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

A weakness has been identified in Flos Freeware Notepad2 4.2.25. This impacts an unknown function in the library TextShaping.dll. Executing a manipulation can lead to uncontrolled search path. The attack is restricted to local execution. The attack requires a high level of complexity. The exploitability is said to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.