News & Sicurezza

CVE ID :CVE-2026-32609 Published : March 18, 2026, 3:16 p.m. | 21 minutes ago Description :Glances is an open-source system cross-platform monitoring tool. The GHSA-gh4x fix (commit 5d3de60) addressed unauthenticated configuration secrets exposure on the `/api/v4/config` endpoints by introducing `as_dict_secure()` redaction. However, the `/api/v4/args` and `/api/v4/args/{item}` endpoints were not addressed by this fix. These endpoints return the complete command-line arguments namespace via `vars(self.args)`, which includes the password hash (salt + pbkdf2_hmac), SNMP community strings, SNMP authentication keys, and the configuration file path. When Glances runs without `--password` (the default), these endpoints are accessible without any authentication. Version 4.5.2 provides a more complete fix. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

FancyBear Server Exposure Reveals Stolen Credentials, 2FA Secrets and NATO-Linked Targets A serious operational security failure by Russian state-linked hacking group FancyBear has given security researchers an unusually clear view into an active espionage campaign targeting government and ... Read more Published Date: Mar 18, 2026 (21 hours, 56 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2023-43770

ScreenConnect Vulnerability Allows Hackers to Extract Unique Machine Keys and Hijack Sessions ConnectWise has issued an urgent security advisory for its ScreenConnect remote desktop software, disclosing a critical cryptographic vulnerability that could allow unauthenticated attackers to extrac ... Read more Published Date: Mar 18, 2026 (20 hours, 2 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-3564

CVE ID :CVE-2026-32694 Published : March 18, 2026, 2:16 p.m. | 1 hour, 21 minutes ago Description :In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusively on a predictable XID of the secret to verify ownership. This allows a malicious grantee which can request secrets to predict past secrets granted by the same secret owner to different grantees, allowing them to use the resources granted by those past secrets. Successful exploitation relies on a very specific configuration, specific data semantic, and the administrator having the need to deploy at least two different applications, one of them controlled by the attacker. Severity: 6.6 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-3278 Published : March 18, 2026, 2:16 p.m. | 1 hour, 21 minutes ago Description :Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText™ ZENworks Service Desk allows Cross-Site Scripting (XSS). The vulnerability could allow an attacker to execute arbitrary JavaScript leading to unauthorized actions on behalf of the user.This issue affects ZENworks Service Desk: 25.2, 25.3. Severity: 7.4 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-25449 Published : March 18, 2026, 2:16 p.m. | 1 hour, 21 minutes ago Description :Deserialization of Untrusted Data vulnerability in Shinetheme Traveler allows Object Injection.This issue affects Traveler: from n/a before 3.2.8.1. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

PoC Exploit Publicly Disclosed: ‘RegPwn’ Flaw Grants SYSTEM Access via Windows Accessibility A newly discovered vulnerability, dubbed RegPwn, has pulled back the curtain on a significant security gap in the Windows Accessibility Infrastructure. Tracked as CVE-2026-24291, this local elevation ... Read more Published Date: Mar 18, 2026 (20 hours, 33 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-24291 CVE-2026-21643 CVE-2025-47813 CVE-2025-29969

The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors Introduction Google Threat Intelligence Group (GTIG) has identified a new iOS full-chain exploit that leveraged multiple zero-day vulnerabilities to fully compromise devices. Based on toolmarks in rec ... Read more Published Date: Mar 18, 2026 (20 hours, 39 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-20700 CVE-2025-43529 CVE-2025-43520 CVE-2025-43510 CVE-2025-14174 CVE-2025-31277

CVE ID :CVE-2026-32693 Published : March 18, 2026, 1:16 p.m. | 2 hours, 21 minutes ago Description :In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which allows a grantee to update the secret content, and can lead to reading or updating other secrets. When the "secret-set" tool logs an error in an exploitation attempt, the secret is still updated contrary to expectations, and the new value is visible to both the owner and the grantee. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-32691 Published : March 18, 2026, 1:16 p.m. | 2 hours, 21 minutes ago Description :A race condition in the secrets management subsystem of Juju versions 3.0.0 through 3.6.18 allows an authenticated unit agent to claim ownership of a newly initialized secret. Between generating a Juju Secret ID and creating the secret's first revision, an attacker authenticated as another unit agent can claim ownership of a known secret. This leads to the attacking unit being able to read the content of the initial secret revision. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-32692 Published : March 18, 2026, 1:16 p.m. | 2 hours, 21 minutes ago Description :An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 through 3.6.18 allows an authenticated unit agent to perform unauthorized updates to secret revisions. With sufficient information, an attacker can poison any existing secret revision within the scope of that Vault secret back-end. Severity: 7.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Critical 9.8 CVSS Schneider Electric Flaw Exposes SCADA and Data Center Systems Schneider Electric has exposed the curtain on two significant vulnerabilities affecting critical infrastructure tools. From remote terminal units (RTUs) used in monitoring to scalable management softw ... Read more Published Date: Mar 18, 2026 (21 hours, 38 minutes ago) Vulnerabilities has been mentioned in this article.