News & Sicurezza

CVE ID :CVE-2026-22318 Published : March 18, 2026, 8:16 a.m. | 3 hours, 21 minutes ago Description :A stack-based buffer overflow vulnerability in the device's file transfer parameter workflow allows a high-privileged attacker to send oversized POST parameters, causing memory corruption in an internal process, resulting in a DoS attack. Severity: 4.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

A command injection vulnerability in the device’s Root CA certificate transfer workflow allows a high-privileged attacker to send crafted HTTP POST requests that result in arbitrary command execution on the underlying Linux OS with root privileges.

CVE ID :CVE-2026-22317 Published : March 18, 2026, 8:16 a.m. | 3 hours, 21 minutes ago Description :A command injection vulnerability in the device’s Root CA certificate transfer workflow allows a high-privileged attacker to send crafted HTTP POST requests that result in arbitrary command execution on the underlying Linux OS with root privileges. Severity: 7.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-22316 Published : March 18, 2026, 8:16 a.m. | 3 hours, 21 minutes ago Description :A remote attacker with user privileges for the webUI can use the setting of the TFTP Filename with a POST Request to trigger a stack-based Buffer Overflow, resulting in a DoS attack. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-31703 Published : March 18, 2026, 8:16 a.m. | 1 hour, 20 minutes ago Description :A vulnerability found in Dahua NVR/XVR device. A third-party malicious attacker with physical access to the device may gain access to a restricted shell via the serial port, and bypasses the shell's authentication mechanism to escalate privileges. Severity: 2.4 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Ubuntu CVE-2026-3888 Bug Lets Attackers Gain Root via systemd Cleanup Timing Exploit A high-severity security flaw affecting default installations of Ubuntu Desktop versions 24.04 and later could be exploited to escalate privileges to the root level. Tracked as CVE-2026-3888 (CVSS sco ... Read more Published Date: Mar 18, 2026 (22 hours, 31 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-3888 CVE-2026-21385 CVE-2026-21513

‘RegPwn’ Windows Registry Vulnerability Enables Full System Access to Attackers RegPwn Windows Registry Vulnerability A high-severity Windows vulnerability dubbed “RegPwn” (CVE-2026-24291) is an elevation-of-privilege flaw that allows low-privileged users to gain full SYSTEM acce ... Read more Published Date: Mar 18, 2026 (22 hours, 38 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-24291

Critical FortiClient SQL Injection Vulnerability Enables Arbitrary Database Access FortiClient SQL Injection vulnerability A critical SQL injection vulnerability in Fortinet’s FortiClient Endpoint Management Server (EMS). Tracked as CVE-2026-21643, this severe flaw carries a CVSS sc ... Read more Published Date: Mar 18, 2026 (18 hours, 57 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-21643

New Ubuntu Vulnerability Turns System Cleanup into a Root Access Backdoor The Qualys Threat Research Unit has detailed a new Local Privilege Escalation (LPE) vulnerability, tracked as CVE-2026-3888, which affects default installations of Ubuntu Desktop 24.04 and later.The v ... Read more Published Date: Mar 18, 2026 (18 hours, 57 minutes ago) Vulnerabilities has been mentioned in this article.

CVE ID :CVE-2026-32608 Published : March 18, 2026, 7:16 a.m. | 2 hours, 20 minutes ago Description :Glances is an open-source system cross-platform monitoring tool. The Glances action system allows administrators to configure shell commands that execute when monitoring thresholds are exceeded. These commands support Mustache template variables (e.g., `{{name}}`, `{{key}}`) that are populated with runtime monitoring data. The `secure_popen()` function, which executes these commands, implements its own pipe, redirect, and chain operator handling by splitting the command string before passing each segment to `subprocess.Popen(shell=False)`. Prior to 4.5.2, when a Mustache-rendered value (such as a process name, filesystem mount point, or container name) contains pipe, redirect, or chain metacharacters, the rendered command is split in unintended ways, allowing an attacker who controls a process name or container name to inject arbitrary commands. Version 4.5.2 fixes the issue. Severity: 7.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-15363 Published : March 18, 2026, 7:16 a.m. | 2 hours, 20 minutes ago Description :The Get Use APIs WordPress plugin before 2.0.10 executes imported JSON, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks under certain server configurations. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-3512 Published : March 18, 2026, 7:16 a.m. | 2 hours, 20 minutes ago Description :The Writeprint Stylometry plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'p' GET parameter in all versions up to and including 0.1. This is due to insufficient input sanitization and output escaping in the bjl_wprintstylo_comments_nav() function. The function directly outputs the $_GET['p'] parameter into an HTML href attribute without any escaping. This makes it possible for authenticated attackers with Contributor-level permissions or higher to inject arbitrary web scripts in pages that execute if they can successfully trick another user into performing an action such as clicking on a link. Severity: 6.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...