News & Sicurezza

Next Click Ventures RealtyScript 4.0.2 contains a stored cross-site scripting vulnerability in the location_name parameter of the admin locations interface. Attackers can submit POST requests to the locations.php endpoint with JavaScript payloads in the location_name field to execute arbitrary code in administrator browsers.

Next Click Ventures RealtyScript 4.0.2 fails to properly sanitize file uploads, allowing attackers to store malicious scripts through the file POST parameter in admin/tools.php. Attackers can upload files containing JavaScript code that executes in the context of admin/tools.php when accessed by other users.

Qool CMS contains multiple persistent cross-site scripting vulnerabilities in several administrative scripts where POST parameters are not properly sanitized before being stored and returned to users. Attackers can inject malicious JavaScript code through parameters like 'title', 'name', 'email', 'username', 'link', and 'task' in endpoints such as addnewtype, addnewdatafield, addmenu, addusergroup, addnewuserfield, adduser, addgeneraldata, and addcontentitem to execute arbitrary scripts in administrator browsers.

⚡ Weekly Recap: Chrome 0-Days, Router Botnets, AWS Breach, Rogue AI Agents & More Some weeks in security feel normal. Then you read a few tabs and get that immediate “ah, great, we’re doing this now” feeling. This week has that energy. Fresh messes, old problems getting sharper, an ... Read more Published Date: Mar 16, 2026 (1 day, 18 hours ago) Vulnerabilities has been mentioned in this article.

The Poisoned Pickle: Critical Unpatched RCE Flaws Expose SGLang AI Infrastructure Security researchers have issued a warning to the AI development community following the discovery of critical vulnerabilities in SGLang, a popular open-source serving framework for Large Language Mod ... Read more Published Date: Mar 16, 2026 (1 day, 18 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-28792 CVE-2026-3989 CVE-2026-3060 CVE-2026-3059 CVE-2025-54135 CVE-2025-54136 CVE-2025-49596

Ransomware Under Pressure: Tactics, Techniques, and Procedures in a Shifting Threat Landscape Written by: Bavi Sadayappan, Zach Riddle, Ioana Teaca, Kimberly Goody, Genevieve Stark Introduction Since 2018, when many financially motivated threat actors began shifting their monetization strategy ... Read more Published Date: Mar 16, 2026 (1 day, 18 hours ago) Vulnerabilities has been mentioned in this article. CVE-2025-61882 CVE-2025-8088 CVE-2025-53771 CVE-2025-53770 CVE-2025-31324 CVE-2025-31161 CVE-2024-55591 CVE-2024-40766 CVE-2024-37085 CVE-2024-3400 CVE-2024-21762 CVE-2023-4966 CVE-2021-40539 CVE-2021-27878 CVE-2021-27877 CVE-2019-6693

Critical 9.7 CVSS TinaCMS Flaw Exposes Local Developer Machines Security researchers have exposed a devastating vulnerability in TinaCMS, a popular headless content management system used by developers globally to manage Markdown and MDX content. The flaw, tracked ... Read more Published Date: Mar 16, 2026 (1 day, 17 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-28792

Vulnerabilities in Raytha software Vulnerabilities in Raytha software CVE ID CVE-2025-15540 Publication date 16 March 2026 Vendor Raytha Product Raytha Vulnerable versions All before 1.4.6 Vulnerability type (CWE) Improper Control of G ... Read more Published Date: Mar 16, 2026 (1 day, 17 hours ago) Vulnerabilities has been mentioned in this article. CVE-2025-69246 CVE-2025-69245 CVE-2025-69243 CVE-2025-69242 CVE-2025-69241 CVE-2025-69240 CVE-2025-69239 CVE-2025-69238 CVE-2025-69237 CVE-2025-69236 CVE-2025-15540

High-Severity Flaw Exposes LiteSpeed Web Servers to OS Command Injection A significant security warning has been issued for administrators utilizing LiteSpeed Web Server, a popular high-performance replacement for Apache. According to a vulnerability note from JPCERT/CC, a ... Read more Published Date: Mar 16, 2026 (1 day, 17 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-31386 CVE-2026-26954

Critical 10.0 CVSS SandboxJS Flaw Grants Complete Remote Code Execution A severe security flaw has been identified in SandboxJS, a popular JavaScript sandboxing library used to safely execute untrusted code within web and Node.js applications. The vulnerability, tracked a ... Read more Published Date: Mar 16, 2026 (1 day, 14 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-26954 CVE-2026-25881 CVE-2026-23830

CVE ID :CVE-2026-25783 Published : March 16, 2026, 12:04 p.m. | 2 hours, 6 minutes ago Description :Mattermost versions 11.3.x Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-24458 Published : March 16, 2026, 12:02 p.m. | 2 hours, 8 minutes ago Description :Mattermost versions 11.3.x Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...