News & Sicurezza

The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors Introduction Google Threat Intelligence Group (GTIG) has identified a new iOS full-chain exploit that leveraged multiple zero-day vulnerabilities to fully compromise devices. Based on toolmarks in rec ... Read more Published Date: Mar 18, 2026 (20 hours, 39 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-20700 CVE-2025-43529 CVE-2025-43520 CVE-2025-43510 CVE-2025-14174 CVE-2025-31277

CVE ID :CVE-2026-32691 Published : March 18, 2026, 1:16 p.m. | 2 hours, 21 minutes ago Description :A race condition in the secrets management subsystem of Juju versions 3.0.0 through 3.6.18 allows an authenticated unit agent to claim ownership of a newly initialized secret. Between generating a Juju Secret ID and creating the secret's first revision, an attacker authenticated as another unit agent can claim ownership of a known secret. This leads to the attacking unit being able to read the content of the initial secret revision. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-32693 Published : March 18, 2026, 1:16 p.m. | 2 hours, 21 minutes ago Description :In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which allows a grantee to update the secret content, and can lead to reading or updating other secrets. When the "secret-set" tool logs an error in an exploitation attempt, the secret is still updated contrary to expectations, and the new value is visible to both the owner and the grantee. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-32692 Published : March 18, 2026, 1:16 p.m. | 2 hours, 21 minutes ago Description :An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 through 3.6.18 allows an authenticated unit agent to perform unauthorized updates to secret revisions. With sufficient information, an attacker can poison any existing secret revision within the scope of that Vault secret back-end. Severity: 7.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Critical 9.8 CVSS Schneider Electric Flaw Exposes SCADA and Data Center Systems Schneider Electric has exposed the curtain on two significant vulnerabilities affecting critical infrastructure tools. From remote terminal units (RTUs) used in monitoring to scalable management softw ... Read more Published Date: Mar 18, 2026 (21 hours, 38 minutes ago) Vulnerabilities has been mentioned in this article.

Critical Telnetd Vulnerability Enables Remote Attacker to Execute Arbitrary Code via Port 23 A critical buffer overflow vulnerability in the GNU Inetutils telnetd daemon. Tracked as CVE-2026-32746, this flaw allows an unauthenticated remote attacker to execute arbitrary code and gain root acc ... Read more Published Date: Mar 18, 2026 (22 hours, 12 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-32746

Leaving the Doors Unlocked: Critical 9.0 CVSS ScreenConnect Flaw Exposes Machine Keys ConnectWise recently issued a critical security update for its ScreenConnect platform, addressing a significant vulnerability that could have allowed unauthorized actors to hijack server-level cryptog ... Read more Published Date: Mar 18, 2026 (22 hours, 31 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-3564 CVE-2025-47813

Iran-Linked Cyber Campaigns Converge With Electronic and Psychological Warfare as Regional Conflict Escalates On February 28, 2026, a joint US-Israeli military operation launched strikes inside Iran, opening a conflict that rapidly extended into cyberspace. Iran responded with ballistic missiles and drone str ... Read more Published Date: Mar 18, 2026 (22 hours, 38 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2025-34067 CVE-2023-6895 CVE-2021-36260 CVE-2021-33044 CVE-2017-7921

9 Critical IP KVM Flaws Enable Unauthenticated Root Access Across Four Vendors Cybersecurity researchers have warned about the risks posed by low-cost IP KVM (Keyboard, Video, Mouse over Internet Protocol) devices, which can grant attackers extensive control over compromised hos ... Read more Published Date: Mar 18, 2026 (20 hours, 57 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-32298 CVE-2026-32297 CVE-2026-32296 CVE-2026-32295 CVE-2026-32294 CVE-2026-32293 CVE-2026-32292 CVE-2026-32291 CVE-2026-32290 CVE-2026-21385 CVE-2026-21513 CVE-2025-3714 CVE-2025-3713 CVE-2025-3712 CVE-2025-3711 CVE-2025-3710

CVE ID :CVE-2026-33265 Published : March 18, 2026, 12:16 p.m. | 3 hours, 21 minutes ago Description :In LibreChat 0.8.1-rc2, a logged-in user obtains a JWT for both the LibreChat API and the RAG API. Severity: 6.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Apple starts issuing lightweight security updates between software releases Apple is delivering small security updates, called Background Security Improvements, starting with iOS 26.1, iPadOS 26.1, and macOS 26.1. Apple describes Background Security Improvements as lightweigh ... Read more Published Date: Mar 18, 2026 (21 hours, 21 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-20643

CVE ID :CVE-2026-23244 Published : March 18, 2026, 11:16 a.m. | 4 hours, 21 minutes ago Description :In the Linux kernel, the following vulnerability has been resolved: nvme: fix memory allocation in nvme_pr_read_keys() nvme_pr_read_keys() takes num_keys from userspace and uses it to calculate the allocation size for rse via struct_size(). The upper limit is PR_KEYS_MAX (64K). A malicious or buggy userspace can pass a large num_keys value that results in a 4MB allocation attempt at most, causing a warning in the page allocator when the order exceeds MAX_PAGE_ORDER. To fix this, use kvzalloc() instead of kzalloc(). This bug has the same reasoning and fix with the patch below: https://lore.kernel.org/linux-block/[email protected]/ Warning log: WARNING: mm/page_alloc.c:5216 at __alloc_frozen_pages_noprof+0x5aa/0x2300 mm/page_alloc.c:5216, CPU#1: syz-executor117/272 Modules linked in: CPU: 1 UID: 0 PID: 272 Comm: syz-executor117 Not tainted 6.19.0 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:__alloc_frozen_pages_noprof+0x5aa/0x2300 mm/page_alloc.c:5216 Code: ff 83 bd a8 fe ff ff 0a 0f 86 69 fb ff ff 0f b6 1d f9 f9 c4 04 80 fb 01 0f 87 3b 76 30 ff 83 e3 01 75 09 c6 05 e4 f9 c4 04 01 0b 48 c7 85 70 fe ff ff 00 00 00 00 e9 8f fd ff ff 31 c0 e9 0d RSP: 0018:ffffc90000fcf450 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 1ffff920001f9ea0 RDX: 0000000000000000 RSI: 000000000000000b RDI: 0000000000040dc0 RBP: ffffc90000fcf648 R08: ffff88800b6c3380 R09: 0000000000000001 R10: ffffc90000fcf840 R11: ffff88807ffad280 R12: 0000000000000000 R13: 0000000000040dc0 R14: 0000000000000001 R15: ffffc90000fcf620 FS: 0000555565db33c0(0000) GS:ffff8880be26c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000002000000c CR3: 0000000003b72000 CR4: 00000000000006f0 Call Trace: alloc_pages_mpol+0x236/0x4d0...