News & Sicurezza

CVE ID :CVE-2026-2559 Published : March 18, 2026, 4:16 p.m. | 1 hour, 21 minutes ago Description :The Post SMTP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `handle_office365_oauth_redirect()` function in all versions up to, and including, 3.8.0. This is due to the function being hooked to `admin_init` without any `current_user_can()` check or nonce verification. This makes it possible for authenticated attackers, with Subscriber-level access and above, to overwrite the site's Office 365 OAuth mail configuration (access token, refresh token, and user email) via a crafted URL. The configuration option is used during wizard setup of Microsoft365 SMTP, only available in the Pro option of the plugin. This could cause an Administrator to believe an attacker-controlled Azure app is their own, and lead them to connect the plugin to the attacker's account during configuration after upgrading to Pro. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-24063 Published : March 18, 2026, 4:16 p.m. | 1 hour, 21 minutes ago Description :When a plugin is installed using the Arturia Software Center (MacOS), it also installs an uninstall.sh bash script in a root owned path. This script is written to disk with the file permissions 777, meaning it is writable by any user. When uninstalling a plugin via the Arturia Software Center the Privileged Helper gets instructed to execute this script. When the bash script is manipulated by an attacker this scenario will lead to privilege escalation. Severity: 8.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-24062 Published : March 18, 2026, 4:16 p.m. | 1 hour, 21 minutes ago Description :The "Privileged Helper" component of the Arturia Software Center (MacOS) does not perform sufficient client code signature validation when a client connects. This leads to an attacker being able to connect to the helper and execute privileged actions leading to local privilege escalation. Severity: 7.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-67829 Published : March 18, 2026, 4:16 p.m. | 1 hour, 21 minutes ago Description :Mura before 10.1.14 allows beanFeed.cfc getQuery sortDirection SQL injection. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-55045 Published : March 18, 2026, 4:16 p.m. | 1 hour, 21 minutes ago Description :The update address CSRF vulnerability in MuraCMS through 10.1.10 allows attackers to manipulate user address information through CSRF. The vulnerable cUsers.updateAddress function lacks CSRF token validation, enabling malicious websites to forge requests that add, modify, or delete user addresses when an authenticated administrator visits a crafted webpage. Successful exploitation of the update address CSRF vulnerability results in unauthorized manipulation of user address information within the MuraCMS system, potentially compromising user data integrity and organizational communications. When an authenticated administrator visits a malicious webpage containing the CSRF exploit, their browser automatically submits a hidden form that can add malicious addresses with attacker-controlled email addresses and phone numbers, update existing addresses to redirect communications to attacker-controlled locations or deleted legitimate address records to disrupt business operations. This can lead to misdirected sensitive communications, compromise of user privacy through injection of attacker contact information, disruption of legitimate business correspondence, and potential social engineering attacks via the corrupted address data. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-55046 Published : March 18, 2026, 4:16 p.m. | 1 hour, 21 minutes ago Description :MuraCMS through 10.1.10 contains a CSRF vulnerability that allows attackers to permanently destroy all deleted content stored in the trash system through a simple CSRF attack. The vulnerable cTrash.empty function lacks CSRF token validation, enabling malicious websites to forge requests that irreversibly delete all trashed content when an authenticated administrator visits a crated webpage. Successful exploitation of the CSRF vulnerability results in potentially catastrophic data loss within the MuraCMS system. When an authenticated administrator visits a malicious page containing the CSRF exploit, their browser automatically submits a hidden form that permanently empties the entire trash system without any validation, confirmation dialog, or user consent. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Interlock Ransomware Exploits Cisco FMC Zero-Day CVE-2026-20131 for Root Access Amazon Threat Intelligence is warning of an active Interlock ransomware campaign that's exploiting a recently disclosed critical security flaw in Cisco Secure Firewall Management Center (FMC) Software ... Read more Published Date: Mar 18, 2026 (20 hours, 39 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-20131 CVE-2026-21385 CVE-2026-21513

Onderzoekers ontdekken iOS-exploit gebruikt om iPhones te infecteren Onderzoekers hebben een iOS-exploit ontdekt die sinds eind vorig jaar door meerdere actoren is gebruikt om iPhones bij gerichte aanvallen met malware te infecteren. Afhankelijk van de betreffende acto ... Read more Published Date: Mar 18, 2026 (21 hours, 7 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-20700 CVE-2025-43529 CVE-2025-14174

Apple WebKit Vulnerability Enables Malicious Web Content Bypass on iOS and macOS Apple WebKit Vulnerability Enables Malicious Web Content Bypass on iOS and macOS Apple has released critical security patches to address a high-severity WebKit vulnerability that allows maliciously cr ... Read more Published Date: Mar 18, 2026 (21 hours, 11 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-20643

CVE ID :CVE-2026-32609 Published : March 18, 2026, 3:16 p.m. | 21 minutes ago Description :Glances is an open-source system cross-platform monitoring tool. The GHSA-gh4x fix (commit 5d3de60) addressed unauthenticated configuration secrets exposure on the `/api/v4/config` endpoints by introducing `as_dict_secure()` redaction. However, the `/api/v4/args` and `/api/v4/args/{item}` endpoints were not addressed by this fix. These endpoints return the complete command-line arguments namespace via `vars(self.args)`, which includes the password hash (salt + pbkdf2_hmac), SNMP community strings, SNMP authentication keys, and the configuration file path. When Glances runs without `--password` (the default), these endpoints are accessible without any authentication. Version 4.5.2 provides a more complete fix. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

FancyBear Server Exposure Reveals Stolen Credentials, 2FA Secrets and NATO-Linked Targets A serious operational security failure by Russian state-linked hacking group FancyBear has given security researchers an unusually clear view into an active espionage campaign targeting government and ... Read more Published Date: Mar 18, 2026 (21 hours, 56 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2023-43770

ScreenConnect Vulnerability Allows Hackers to Extract Unique Machine Keys and Hijack Sessions ConnectWise has issued an urgent security advisory for its ScreenConnect remote desktop software, disclosing a critical cryptographic vulnerability that could allow unauthenticated attackers to extrac ... Read more Published Date: Mar 18, 2026 (20 hours, 2 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-3564