News & Sicurezza

CVE ID :CVE-2026-4312 Published : March 17, 2026, 8:15 a.m. | 5 hours, 58 minutes ago Description :GCB/FCB Audit Software developed by DrangSoft has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access certain APIs to create a new administrative account. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-3237 Published : March 17, 2026, 7:16 a.m. | 6 hours, 58 minutes ago Description :In affected versions of Octopus Server it was possible for a low privileged user to manipulate an API request to change the signing key expiration and revocation time frames via an API endpoint that had incorrect permission validation. It was not possible to expose the signing keys using this vulnerability. Severity: 2.3 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

High-Severity Angular XSS Flaw Bypasses Built-In Sanitization A significant security vulnerability has been unearthed in the Angular runtime and compiler, potentially exposing thousands of web applications to Cross-Site Scripting (XSS) attacks. The flaw, tracked ... Read more Published Date: Mar 17, 2026 (1 day, 5 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-32635 CVE-2026-27970 CVE-2026-27739 CVE-2026-22610 CVE-2025-59052 CVE-2025-47813

CISA Flags Actively Exploited Wing FTP Vulnerability Leaking Server Paths The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a medium-severity security flaw impacting Wing FTP to its Known Exploited Vulnerabilities (KEV) catalog, citing evidenc ... Read more Published Date: Mar 17, 2026 (1 day, 5 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-21385 CVE-2026-21513 CVE-2025-47813 CVE-2025-47812

CVE ID :CVE-2026-4258 Published : March 17, 2026, 6:16 a.m. | 7 hours, 58 minutes ago Description :All versions of the package sjcl are vulnerable to Improper Verification of Cryptographic Signature due to missing point-on-curve validation in sjcl.ecc.basicKey.publicKey(). An attacker can recover a victim's ECDH private key by sending crafted off-curve public keys and observing ECDH outputs. The dhJavaEc() function directly returns the raw x-coordinate of the scalar multiplication result (no hashing), providing a plaintext oracle without requiring any decryption feedback. Severity: 7.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-4308 Published : March 17, 2026, 4:16 a.m. | 9 hours, 57 minutes ago Description :A weakness has been identified in frdel/agent0ai agent-zero 0.9.7. This affects the function handle_pdf_document of the file python/helpers/document_query.py. This manipulation causes server-side request forgery. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-4307 Published : March 17, 2026, 4:16 a.m. | 9 hours, 57 minutes ago Description :A security flaw has been discovered in frdel/agent0ai agent-zero 0.9.7-10. The impacted element is the function get_abs_path of the file python/helpers/files.py. The manipulation results in path traversal. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-2373 Published : March 17, 2026, 4:16 a.m. | 9 hours, 58 minutes ago Description :The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.7.1049 via the get_main_query_args() function due to insufficient restrictions on which posts can be included. This makes it possible for unauthenticated attackers to extract contents of non-public custom post types, such as Contact Form 7 submissions or WooCommerce coupons. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-0708 Published : March 17, 2026, 4:16 a.m. | 9 hours, 58 minutes ago Description :A flaw was found in libucl. A remote attacker could exploit this by providing a specially crafted Universal Configuration Language (UCL) input that contains a key with an embedded null byte. This can cause a segmentation fault (SEGV fault) in the `ucl_object_emit` function when parsing and emitting the object, leading to a Denial of Service (DoS) for the affected system. Severity: 8.3 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the ‘search’ parameter in all versions up to, and including, 4.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE ID :CVE-2026-2579 Published : March 17, 2026, 2:16 a.m. | 11 hours, 58 minutes ago Description :The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the ‘search’ parameter in all versions up to, and including, 4.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

A security vulnerability has been detected in Tiandy Easy7 Integrated Management Platform up to 7.17.0. This affects an unknown function of the file /rest/preSetTemplate/getRecByTemplateId. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.