News & Sicurezza

ScreenConnect Vulnerability Allows Hackers to Extract Unique Machine Keys and Hijack Sessions ConnectWise has issued an urgent security advisory for its ScreenConnect remote desktop software, disclosing a critical cryptographic vulnerability that could allow unauthenticated attackers to extrac ... Read more Published Date: Mar 18, 2026 (20 hours, 2 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-3564

CVE ID :CVE-2026-3278 Published : March 18, 2026, 2:16 p.m. | 1 hour, 21 minutes ago Description :Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText™ ZENworks Service Desk allows Cross-Site Scripting (XSS). The vulnerability could allow an attacker to execute arbitrary JavaScript leading to unauthorized actions on behalf of the user.This issue affects ZENworks Service Desk: 25.2, 25.3. Severity: 7.4 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-32694 Published : March 18, 2026, 2:16 p.m. | 1 hour, 21 minutes ago Description :In Juju from version 3.0.0 through 3.6.18, when a secret owner grants permissions to a secret to a grantee, the secret owner relies exclusively on a predictable XID of the secret to verify ownership. This allows a malicious grantee which can request secrets to predict past secrets granted by the same secret owner to different grantees, allowing them to use the resources granted by those past secrets. Successful exploitation relies on a very specific configuration, specific data semantic, and the administrator having the need to deploy at least two different applications, one of them controlled by the attacker. Severity: 6.6 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-25449 Published : March 18, 2026, 2:16 p.m. | 1 hour, 21 minutes ago Description :Deserialization of Untrusted Data vulnerability in Shinetheme Traveler allows Object Injection.This issue affects Traveler: from n/a before 3.2.8.1. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

PoC Exploit Publicly Disclosed: ‘RegPwn’ Flaw Grants SYSTEM Access via Windows Accessibility A newly discovered vulnerability, dubbed RegPwn, has pulled back the curtain on a significant security gap in the Windows Accessibility Infrastructure. Tracked as CVE-2026-24291, this local elevation ... Read more Published Date: Mar 18, 2026 (20 hours, 33 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-24291 CVE-2026-21643 CVE-2025-47813 CVE-2025-29969

The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors Introduction Google Threat Intelligence Group (GTIG) has identified a new iOS full-chain exploit that leveraged multiple zero-day vulnerabilities to fully compromise devices. Based on toolmarks in rec ... Read more Published Date: Mar 18, 2026 (20 hours, 39 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-20700 CVE-2025-43529 CVE-2025-43520 CVE-2025-43510 CVE-2025-14174 CVE-2025-31277

CVE ID :CVE-2026-32692 Published : March 18, 2026, 1:16 p.m. | 2 hours, 21 minutes ago Description :An authorization bypass vulnerability in the Vault secrets back-end implementation of Juju versions 3.1.6 through 3.6.18 allows an authenticated unit agent to perform unauthorized updates to secret revisions. With sufficient information, an attacker can poison any existing secret revision within the scope of that Vault secret back-end. Severity: 7.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-32693 Published : March 18, 2026, 1:16 p.m. | 2 hours, 21 minutes ago Description :In Juju from version 3.0.0 through 3.6.18, the authorization of the "secret-set" tool is not performed correctly, which allows a grantee to update the secret content, and can lead to reading or updating other secrets. When the "secret-set" tool logs an error in an exploitation attempt, the secret is still updated contrary to expectations, and the new value is visible to both the owner and the grantee. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-32691 Published : March 18, 2026, 1:16 p.m. | 2 hours, 21 minutes ago Description :A race condition in the secrets management subsystem of Juju versions 3.0.0 through 3.6.18 allows an authenticated unit agent to claim ownership of a newly initialized secret. Between generating a Juju Secret ID and creating the secret's first revision, an attacker authenticated as another unit agent can claim ownership of a known secret. This leads to the attacking unit being able to read the content of the initial secret revision. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Critical 9.8 CVSS Schneider Electric Flaw Exposes SCADA and Data Center Systems Schneider Electric has exposed the curtain on two significant vulnerabilities affecting critical infrastructure tools. From remote terminal units (RTUs) used in monitoring to scalable management softw ... Read more Published Date: Mar 18, 2026 (21 hours, 38 minutes ago) Vulnerabilities has been mentioned in this article.

Critical Telnetd Vulnerability Enables Remote Attacker to Execute Arbitrary Code via Port 23 A critical buffer overflow vulnerability in the GNU Inetutils telnetd daemon. Tracked as CVE-2026-32746, this flaw allows an unauthenticated remote attacker to execute arbitrary code and gain root acc ... Read more Published Date: Mar 18, 2026 (22 hours, 12 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-32746

Leaving the Doors Unlocked: Critical 9.0 CVSS ScreenConnect Flaw Exposes Machine Keys ConnectWise recently issued a critical security update for its ScreenConnect platform, addressing a significant vulnerability that could have allowed unauthorized actors to hijack server-level cryptog ... Read more Published Date: Mar 18, 2026 (22 hours, 31 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-3564 CVE-2025-47813