News & Sicurezza

CVE ID :CVE-2026-21886 Published : March 17, 2026, 4:16 p.m. | 1 hour, 58 minutes ago Description :OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.9.1, the GraphQL mutations "IndividualDeletionDeleteMutation" is intended to allow users to delete individual entity objects respectively. However, it was observed that this mutation can be misused to delete unrelated and sensitive objects such as analyses reports etc. This behavior stems from the lack of validation in the API to ensure that the targeted object is contextually related to the mutation being executed. Version 6.9.1 fixes the issue. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

A vulnerability was determined in UTT HiPER 810G up to 1.7.7-171114. Affected is the function strcpy of the file /goform/formApLbConfig. This manipulation of the argument loadBalanceNameOld causes buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

CVE ID :CVE-2026-4318 Published : March 17, 2026, 3:16 p.m. | 2 hours, 58 minutes ago Description :A vulnerability was determined in UTT HiPER 810G up to 1.7.7-171114. Affected is the function strcpy of the file /goform/formApLbConfig. This manipulation of the argument loadBalanceNameOld causes buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Severity: 9.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-3564 Published : March 17, 2026, 3:16 p.m. | 2 hours, 58 minutes ago Description :A condition in ScreenConnect may allow an actor with access to server-level cryptographic material used for authentication to obtain unauthorized access, including elevated privileges, in certain scenarios. Severity: 9.0 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-13406 Published : March 17, 2026, 3:16 p.m. | 2 hours, 58 minutes ago Description :NULL Pointer Dereference vulnerability in Softing Industrial Automation GmbH smartLink SW-HT (Webserver modules) allows HTTP DoS.This issue affects smartLink SW-HT: 1.43. Severity: 6.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Critical Spring AI Flaws Expose Databases to SQL and JSONPath Injection Security researchers have issued a dual-threat alert for developers utilizing the Spring AI framework, a popular tool for integrating Artificial Intelligence into Java applications. Two high-severity ... Read more Published Date: Mar 17, 2026 (1 day ago) Vulnerabilities has been mentioned in this article.

CVE ID :CVE-2026-4324 Published : March 17, 2026, 2:16 p.m. | 3 hours, 58 minutes ago Description :A flaw was found in the Katello plugin for Red Hat Satellite. This vulnerability, caused by improper sanitization of user-provided input, allows a remote attacker to inject arbitrary SQL commands into the sort_by parameter of the /api/hosts/bootc_images API endpoint. This can lead to a Denial of Service (DoS) by triggering database errors, and potentially enable Boolean-based Blind SQL injection, which could allow an attacker to extract sensitive information from the database. Severity: 5.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-3888 Published : March 17, 2026, 2:16 p.m. | 3 hours, 58 minutes ago Description :Local privilege escalation in snapd on Linux allows local attackers to get root privilege by re-creating snap's private /tmp directory when systemd-tmpfiles is configured to automatically clean up this directory. This issue affects Ubuntu 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, and 24.04 LTS. Severity: 7.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Angular XSS Vulnerability Exposes Thousands of web Applications to XSS Attacks Angular XSS Vulnerability Exposes web Applications A high-severity Cross-Site Scripting (XSS) vulnerability has been discovered in the widely used Angular framework. Tracked as CVE-2026-32635 and cate ... Read more Published Date: Mar 17, 2026 (1 day ago) Vulnerabilities has been mentioned in this article. CVE-2026-32635

Publicly Disclosed: Bishop Fox Reveals Critical Pre-Auth SQL Injection in FortiClient EMS Cybersecurity researchers at Bishop Fox have released a technical deep-dive into a critical vulnerability affecting FortiClient EMS, Fortinet’s centralized management solution for endpoint security. T ... Read more Published Date: Mar 17, 2026 (1 day ago) Vulnerabilities has been mentioned in this article.

CISA Warns of Wing FTP Server Vulnerability Exploited in Attacks CISA Warns Wing FTP Server Vulnerability Exploit A high-priority alert has been issued for a critical vulnerability in Wing FTP Server, added to the Known Exploited Vulnerabilities (KEV) catalog on Ma ... Read more Published Date: Mar 17, 2026 (1 day ago) Vulnerabilities has been mentioned in this article. CVE-2025-47813

CVE ID :CVE-2025-62320 Published : March 17, 2026, 1:16 p.m. | 4 hours, 58 minutes ago Description :HTML Injection can be carried out in Product when a web application does not properly check or clean user input before showing it on a webpage. Because of this, an attacker may insert unwanted HTML code into the page. When the browser loads the page, it may automatically interact with external resources included in that HTML, which can cause unexpected requests from the user’s browser. Severity: 4.7 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...