News & Sicurezza

Cisco FMC flaw was exploited by Interlock weeks before patch (CVE-2026-20131) A critical vulnerability (CVE-2026-20131) in Cisco Secure Firewall Management Center (FMC) that Cisco disclosed and patched in early March 2026 has been exploited as a zero-day by the Interlock ransom ... Read more Published Date: Mar 20, 2026 (2 days, 21 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-20131 CVE-2026-20127 CVE-2026-20045 CVE-2026-20963 CVE-2025-20393

CVE ID :CVE-2026-4434 Published : March 20, 2026, 1:16 p.m. | 2 hours, 26 minutes ago Description :Improper certificate validation in the PAM propagation WinRM connections allows a network attacker to perform a man-in-the-middle attack via disabled TLS certificate verification. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

32 jaar oud Telnet-lek kan aanvaller volledige controle over servers geven Onderzoekers hebben een 32 jaar oude kwetsbaarheid in Telnet ontdekt waardoor aanvallers in het ergste geval volledige controle over de server kunnen krijgen. Een beveiligingsupdate is nog niet beschi ... Read more Published Date: Mar 20, 2026 (2 days, 21 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-32746

The Good, the Bad and the Ugly in Cybersecurity – Week 12 The Good | Operation Synergia III Disrupts Malicious Networks & the EU Sanctions State-Sponsored Attackers Operation Synergia III, an Interpol-led crackdown spanning July 2025 to January 2026, has dis ... Read more Published Date: Mar 20, 2026 (2 days, 21 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-20131 CVE-2026-20700 CVE-2025-43529 CVE-2025-43520 CVE-2025-43510 CVE-2025-14174 CVE-2025-31277

PoC Exploit Publicly Disclosed: Windows ‘libarchive’ Flaw Leaks NetNTLMv2 Hashes Security researchers Len Sadowski and Oğuz Bektaş have publicly pulled back the curtain on a vulnerability within Windows’ implementation of libarchive. The flaw, tracked as CVE-2025-59284, demonstrat ... Read more Published Date: Mar 20, 2026 (2 days, 20 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-4342 CVE-2026-24291 CVE-2026-21643 CVE-2025-59284 CVE-2025-32975 CVE-2025-29969

High-Severity ingress-nginx Flaw Exposes Kubernetes Secrets A high-severity security flaw has been identified in ingress-nginx, a widely used Ingress controller for Kubernetes clusters. The vulnerability, tracked as CVE-2026-4342 with a CVSS score of 8.8, coul ... Read more Published Date: Mar 20, 2026 (2 days, 20 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-4342 CVE-2026-3564 CVE-2025-32975 CVE-2024-9042

CISA Warns of Cisco Secure Firewall Management Center 0-Day Exploited in Ransomware Attacks CISA Warns Cisco Secure Firewall Management Center 0-Day Exploit An urgent warning highlights a critical zero-day in Cisco products, now added to the CISA Known Exploited Vulnerabilities Catalog after ... Read more Published Date: Mar 20, 2026 (2 days, 19 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-20131

Critical Jenkins Vulnerabilities Expose CI/CD Servers to RCE Attacks Jenkins Vulnerabilities Expose CI/CD Servers A critical security advisory addressing multiple high-severity vulnerabilities in Jenkins core and the LoadNinja plugin. Issued on March 18, 2026, the aler ... Read more Published Date: Mar 20, 2026 (2 days, 13 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-33004 CVE-2026-33003 CVE-2026-33002 CVE-2026-33001

CVE ID :CVE-2026-33136 Published : March 20, 2026, 11:18 a.m. | 4 hours, 24 minutes ago Description :WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability in the listar_memorandos_ativos.php endpoint. An attacker can inject arbitrary JavaScript or HTML tags into the sccd GET parameter, which is then directly echoed into the HTML response without any sanitization or encoding. The script /html/memorando/listar_memorandos_ativos.php handles dynamic success messages to users using query string parameters. Similar to other endpoints in the Memorando module, it checks if $_GET['msg'] equals 'success'. If this condition is met, it directly concatenates and reflects $_GET['sccd'] into an HTML alert . This issue is resolved in version 3.6.7. Severity: 9.3 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-33135 Published : March 20, 2026, 11:18 a.m. | 4 hours, 24 minutes ago Description :WeGIA is a web manager for charitable institutions. Versions 3.6.6 and below have a Reflected Cross-Site Scripting (XSS) vulnerability in the novo_memorandoo.php endpoint. An attacker can inject arbitrary JavaScript into the sccs GET parameter, which is directly echoed into the HTML response without any sanitization or encoding. The script /html/memorando/novo_memorandoo.php reads HTTP GET parameters to display dynamic success messages to the user. At approximately line 273, the code checks if $_GET['msg'] equals 'success'. If true, it directly concatenates $_GET['sccs'] into an HTML alert and outputs it to the browser. This issue has been fixed in version 3.6.7. Severity: 9.3 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-33134 Published : March 20, 2026, 11:18 a.m. | 4 hours, 24 minutes ago Description :WeGIA is a web manager for charitable institutions. Versions 3.6.5 and below contain an authenticated SQL Injection vulnerability in the html/matPat/restaurar_produto.php endpoint. The vulnerability allows an authenticated attacker to inject arbitrary SQL commands via the id_produto GET parameter, leading to full database compromise. In the script /html/matPat/restaurar_produto.php, the application retrieves the id_produto parameter directly from the $_GET global array and interpolates it directly into two SQL query strings without any sanitization, type-casting (e.g., (int)), or using parameterized (prepare/execute) statements. This issue has been fixed in version 3.6.6. Severity: 9.3 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-33133 Published : March 20, 2026, 11:18 a.m. | 4 hours, 24 minutes ago Description :WeGIA is a web manager for charitable institutions. In versions 3.6.5 and 3.6.6, the loadBackupDB() function imports SQL files from uploaded backup archives without any content validation. An attacker can craft a backup archive containing arbitrary SQL statements that create rogue administrator accounts, modify existing passwords, or execute any database operation. This was introduced in commit 370104c. This issue was patched in version 3.6.7. Severity: 8.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...