News & Sicurezza

Precurio Intranet Portal 4.4 contains a cross-site request forgery (CSRF) weakness that can allow an attacker to induce an authenticated user to submit a crafted request to a profile update endpoint that handles file uploads. If the application stores attacker-controlled content as an executable server-side file (e.g., in a web-accessible location with an executable extension), this can lead to arbitrary code execution in the context of the web server.

CVE ID :CVE-2026-32986 Published : March 20, 2026, 4:16 p.m. | 1 hour, 26 minutes ago Description :A Second-Order Cross-Site Scripting (XSS) vulnerability exists in Textpattern CMS version 4.9.0 due to improper sanitization and contextual encoding of user-supplied input embedded within Atom feed XML elements. User-controlled parameters (e.g., category) are reflected into Atom fields such as and without proper XML escaping. While the payload may not execute directly in modern browsers in raw XML context, it can execute when the feed is consumed by HTML-based feed readers, admin dashboards, or CMS aggregators that insert the feed content into the DOM using unsafe methods (e.g., innerHTML), resulting in JavaScript execution in a trusted context. Severity: 6.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-67260 Published : March 20, 2026, 4:16 p.m. | 1 hour, 26 minutes ago Description :The Terrapack software, from ASTER TEC / ASTER S.p.A., with the indicated components and versions has a file upload vulnerability that may allow attackers to execute arbitrary code. Vulnerable components include Terrapack TkWebCoreNG:: 1.0.20200914, Terrapack TKServerCGI 2.5.4.150, and Terrapack TpkWebGIS Client 1.0.0. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-46597 Published : March 20, 2026, 4:16 p.m. | 1 hour, 26 minutes ago Description :Bitcoin Core 0.13.0 through 29.x has an integer overflow. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Oracle komt met noodpatch voor kritiek lek in Identity en Web Services Manager Oracle heeft buiten de vaste patchcyclus om een noodpatch uitgebracht voor een kritieke kwetsbaarheid in Oracle Identity Manager en Oracle Web Services Manager. Het beveiligingslek (CVE-2026-21992) m ... Read more Published Date: Mar 20, 2026 (2 days, 22 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-21992

Microsoft dicht weer kritieke Copilot-lekken die datadiefstal mogelijk maakten Microsoft heeft wederom verschillende kritieke kwetsbaarheden in chatbot Copilot gepatcht waardoor aanvallers data van gebruikers hadden kunnen stelen. "Information disclosure" beveiligingslekken word ... Read more Published Date: Mar 20, 2026 (2 days, 21 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-26136 CVE-2026-24299

CVE ID :CVE-2026-4519 Published : March 20, 2026, 3:16 p.m. | 2 hours, 26 minutes ago Description :The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open(). Severity: 5.7 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

A vulnerability was determined in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/websHostFilter. This manipulation causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

CVE ID :CVE-2026-4487 Published : March 20, 2026, 3:16 p.m. | 2 hours, 26 minutes ago Description :A vulnerability was determined in UTT HiPER 1200GW up to 2.5.3-170306. This impacts the function strcpy of the file /goform/websHostFilter. This manipulation causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Severity: 9.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-33312 Published : March 20, 2026, 3:16 p.m. | 26 minutes ago Description :Vikunja is an open-source self-hosted task management platform. Starting in version 0.20.2 and prior to version 2.2.0, the `DELETE /api/v1/projects/:project/background` endpoint checks `CanRead` permission instead of `CanUpdate`, allowing any user with read-only access to a project to permanently delete its background image. Version 2.2.0 fixes the issue. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-29794 Published : March 20, 2026, 3:16 p.m. | 26 minutes ago Description :Vikunja is an open-source self-hosted task management platform. Starting in version 0.8 and prior to version 2.2.0, unauthenticated users are able to bypass the application's built-in rate-limits by spoofing the `X-Forwarded-For` or `X-Real-IP` headers due to the rate-limit relying on the value of `(echo.Context).RealIP`. Unauthenticated users can abuse endpoints available to them for different potential impacts. The immediate concern would be brute-forcing usernames or specific accounts' passwords. This bypass allows unlimited requests against unauthenticated endpoints. Version 2.2.0 patches the issue. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

OpenClaw versions prior to 2026.3.12 contain an authorization bypass vulnerability in the WebSocket connect path that allows shared-token or password-authenticated connections to self-declare elevated scopes without server-side binding. Attackers can exploit this logic flaw to present unauthorized scopes such as operator.admin and perform admin-only gateway operations.