News & Sicurezza

CVE ID :CVE-2025-31703 Published : March 18, 2026, 8:16 a.m. | 1 hour, 20 minutes ago Description :A vulnerability found in Dahua NVR/XVR device. A third-party malicious attacker with physical access to the device may gain access to a restricted shell via the serial port, and bypasses the shell's authentication mechanism to escalate privileges. Severity: 2.4 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Ubuntu CVE-2026-3888 Bug Lets Attackers Gain Root via systemd Cleanup Timing Exploit A high-severity security flaw affecting default installations of Ubuntu Desktop versions 24.04 and later could be exploited to escalate privileges to the root level. Tracked as CVE-2026-3888 (CVSS sco ... Read more Published Date: Mar 18, 2026 (22 hours, 31 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-3888 CVE-2026-21385 CVE-2026-21513

‘RegPwn’ Windows Registry Vulnerability Enables Full System Access to Attackers RegPwn Windows Registry Vulnerability A high-severity Windows vulnerability dubbed “RegPwn” (CVE-2026-24291) is an elevation-of-privilege flaw that allows low-privileged users to gain full SYSTEM acce ... Read more Published Date: Mar 18, 2026 (22 hours, 38 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-24291

Critical FortiClient SQL Injection Vulnerability Enables Arbitrary Database Access FortiClient SQL Injection vulnerability A critical SQL injection vulnerability in Fortinet’s FortiClient Endpoint Management Server (EMS). Tracked as CVE-2026-21643, this severe flaw carries a CVSS sc ... Read more Published Date: Mar 18, 2026 (18 hours, 57 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-21643

New Ubuntu Vulnerability Turns System Cleanup into a Root Access Backdoor The Qualys Threat Research Unit has detailed a new Local Privilege Escalation (LPE) vulnerability, tracked as CVE-2026-3888, which affects default installations of Ubuntu Desktop 24.04 and later.The v ... Read more Published Date: Mar 18, 2026 (18 hours, 57 minutes ago) Vulnerabilities has been mentioned in this article.

CVE ID :CVE-2026-3512 Published : March 18, 2026, 7:16 a.m. | 2 hours, 20 minutes ago Description :The Writeprint Stylometry plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'p' GET parameter in all versions up to and including 0.1. This is due to insufficient input sanitization and output escaping in the bjl_wprintstylo_comments_nav() function. The function directly outputs the $_GET['p'] parameter into an HTML href attribute without any escaping. This makes it possible for authenticated attackers with Contributor-level permissions or higher to inject arbitrary web scripts in pages that execute if they can successfully trick another user into performing an action such as clicking on a link. Severity: 6.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-32608 Published : March 18, 2026, 7:16 a.m. | 2 hours, 20 minutes ago Description :Glances is an open-source system cross-platform monitoring tool. The Glances action system allows administrators to configure shell commands that execute when monitoring thresholds are exceeded. These commands support Mustache template variables (e.g., `{{name}}`, `{{key}}`) that are populated with runtime monitoring data. The `secure_popen()` function, which executes these commands, implements its own pipe, redirect, and chain operator handling by splitting the command string before passing each segment to `subprocess.Popen(shell=False)`. Prior to 4.5.2, when a Mustache-rendered value (such as a process name, filesystem mount point, or container name) contains pipe, redirect, or chain metacharacters, the rendered command is split in unintended ways, allowing an attacker who controls a process name or container name to inject arbitrary commands. Version 4.5.2 fixes the issue. Severity: 7.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-15363 Published : March 18, 2026, 7:16 a.m. | 2 hours, 20 minutes ago Description :The Get Use APIs WordPress plugin before 2.0.10 executes imported JSON, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks under certain server configurations. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Cybercriminals scale up, government sector hit hardest Government agencies faced the highest volume of cyberattack campaigns in 2025, according to new findings from HPE Threat Labs, which tracked 1,186 active campaigns over the course of the year. The dat ... Read more Published Date: Mar 18, 2026 (19 hours, 37 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2023-26801 CVE-2023-1389 CVE-2017-17215 CVE-2017-9841 CVE-2014-8361

Ubuntu Desktop Systems Vulnerability Enables Attackers to Gain Full Root Access Ubuntu Desktop Systems Vulnerability A Local Privilege Escalation (LPE) vulnerability in default installations of Ubuntu Desktop 24.04 and later allows an unprivileged local attacker to gain full root ... Read more Published Date: Mar 18, 2026 (15 hours, 57 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-3888

Apple Fixes WebKit Vulnerability Enabling Same-Origin Policy Bypass on iOS and macOS Apple on Tuesday released its first round of Background Security Improvements to address a security flaw in WebKit that affects iOS, iPadOS, and macOS. The vulnerability, tracked as CVE-2026-20643 (CV ... Read more Published Date: Mar 18, 2026 (16 hours, 4 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-20643 CVE-2023-43010 CVE-2026-21385 CVE-2026-20700 CVE-2026-21513 CVE-2023-43000 CVE-2024-23222 CVE-2023-41974

CVE ID :CVE-2026-32596 Published : March 18, 2026, 6:16 a.m. | 3 hours, 20 minutes ago Description :Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.2, Glances web server runs without authentication by default when started with `glances -w`, exposing REST API with sensitive system information including process command-lines containing credentials (passwords, API keys, tokens) to any network client. Version 4.5.2 fixes the issue. Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...