News & Sicurezza

CVE ID :CVE-2026-4492 Published : March 20, 2026, 5:02 p.m. | 40 minutes ago Description :A vulnerability was found in Tenda A18 Pro 02.03.02.28. The affected element is the function set_qosMib_list of the file /goform/formSetQosBand. Performing a manipulation of the argument list results in stack-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

A vulnerability was detected in Tenda A18 Pro 02.03.02.28. This vulnerability affects the function form_fast_setting_wifi_set of the file /goform/fast_setting_wifi_set. The manipulation results in stack-based buffer overflow. The attack may be launched remotely. The exploit is now public and may be used.

A vulnerability was identified in UTT HiPER 1250GW up to 3.2.7-210907-180535. Affected is the function strcpy of the file /goform/setSysAdm. Such manipulation of the argument GroupName leads to buffer overflow. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

Precurio Intranet Portal 4.4 contains a cross-site request forgery (CSRF) weakness that can allow an attacker to induce an authenticated user to submit a crafted request to a profile update endpoint that handles file uploads. If the application stores attacker-controlled content as an executable server-side file (e.g., in a web-accessible location with an executable extension), this can lead to arbitrary code execution in the context of the web server.

CVE ID :CVE-2026-32986 Published : March 20, 2026, 4:16 p.m. | 1 hour, 26 minutes ago Description :A Second-Order Cross-Site Scripting (XSS) vulnerability exists in Textpattern CMS version 4.9.0 due to improper sanitization and contextual encoding of user-supplied input embedded within Atom feed XML elements. User-controlled parameters (e.g., category) are reflected into Atom fields such as and without proper XML escaping. While the payload may not execute directly in modern browsers in raw XML context, it can execute when the feed is consumed by HTML-based feed readers, admin dashboards, or CMS aggregators that insert the feed content into the DOM using unsafe methods (e.g., innerHTML), resulting in JavaScript execution in a trusted context. Severity: 6.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-46597 Published : March 20, 2026, 4:16 p.m. | 1 hour, 26 minutes ago Description :Bitcoin Core 0.13.0 through 29.x has an integer overflow. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-67260 Published : March 20, 2026, 4:16 p.m. | 1 hour, 26 minutes ago Description :The Terrapack software, from ASTER TEC / ASTER S.p.A., with the indicated components and versions has a file upload vulnerability that may allow attackers to execute arbitrary code. Vulnerable components include Terrapack TkWebCoreNG:: 1.0.20200914, Terrapack TKServerCGI 2.5.4.150, and Terrapack TpkWebGIS Client 1.0.0. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Oracle komt met noodpatch voor kritiek lek in Identity en Web Services Manager Oracle heeft buiten de vaste patchcyclus om een noodpatch uitgebracht voor een kritieke kwetsbaarheid in Oracle Identity Manager en Oracle Web Services Manager. Het beveiligingslek (CVE-2026-21992) m ... Read more Published Date: Mar 20, 2026 (2 days, 22 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-21992

Microsoft dicht weer kritieke Copilot-lekken die datadiefstal mogelijk maakten Microsoft heeft wederom verschillende kritieke kwetsbaarheden in chatbot Copilot gepatcht waardoor aanvallers data van gebruikers hadden kunnen stelen. "Information disclosure" beveiligingslekken word ... Read more Published Date: Mar 20, 2026 (2 days, 21 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-26136 CVE-2026-24299

CVE ID :CVE-2026-4519 Published : March 20, 2026, 3:16 p.m. | 2 hours, 26 minutes ago Description :The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open(). Severity: 5.7 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

A vulnerability was determined in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/websHostFilter. This manipulation causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

CVE ID :CVE-2026-4487 Published : March 20, 2026, 3:16 p.m. | 2 hours, 26 minutes ago Description :A vulnerability was determined in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/websHostFilter. This manipulation causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Severity: 9.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...