News & Sicurezza

Google Fixes Two Chrome Zero-Days Exploited in the Wild Affecting Skia and V8 Google on Thursday released security updates for its Chrome web browser to address two high-severity vulnerabilities that it said have been exploited in the wild. The list of vulnerabilities is as fol ... Read more Published Date: Mar 13, 2026 (3 days, 3 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-3910 CVE-2026-3909 CVE-2026-21385 CVE-2026-2441 CVE-2026-21513

Google komt met update voor actief aangevallen kwetsbaarheden in Chrome Google heeft beveiligingsupdates uitgebracht voor twee actief aangevallen kwetsbaarheden in Chrome. Beide beveiligingslekken werden zelf door Google op 10 maart ontdekt. Het gaat om CVE-2026-3909 en C ... Read more Published Date: Mar 13, 2026 (3 days, 3 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-3910 CVE-2026-3909

CVE ID :CVE-2025-15515 Published : March 13, 2026, 8:21 a.m. | 4 hours, 7 minutes ago Description :The authentication mechanism for a specific feature in the EasyShare module contains a vulnerability. If specific conditions are met on a local network, it can cause data leakage Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-3891 Published : March 13, 2026, 7:55 p.m. | 7 minutes ago Description :The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lkn_pix_for_woocommerce_c6_save_settings' function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-2890 Published : March 13, 2026, 8:21 a.m. | 4 hours, 7 minutes ago Description :The Formidable Forms plugin for WordPress is vulnerable to a payment integrity bypass in all versions up to, and including, 6.28. This is due to the Stripe Link return handler (`handle_one_time_stripe_link_return_url`) marking payment records as complete based solely on the Stripe PaymentIntent status without comparing the intent's charged amount against the expected payment amount, and the `verify_intent()` function validating only client secret ownership without binding intents to specific forms or actions. This makes it possible for unauthenticated attackers to reuse a PaymentIntent from a completed low-value payment to mark a high-value payment as complete, effectively bypassing payment for goods or services. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-3045 Published : March 13, 2026, 7:55 p.m. | 7 minutes ago Description :The Appointment Booking Calendar — Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data in all versions up to and including 1.6.9.29. This is due to two compounding weaknesses: (1) a non-user-bound `public_nonce` is exposed to unauthenticated users through the public `/wp-json/ssa/v1/embed-inner` REST endpoint, and (2) the `get_item()` method in `SSA_Settings_Api` relies on `nonce_permissions_check()` for authorization (which accepts the public nonce) but does not call `remove_unauthorized_settings_for_current_user()` to filter restricted fields. This makes it possible for unauthenticated attackers to access admin-only plugin settings including the administrator email, phone number, internal access tokens, notification configurations, and developer settings via the `/wp-json/ssa/v1/settings/{section}` endpoint. The exposure of appointment tokens also allows an attacker to modify or cancel appointments. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-1704 Published : March 13, 2026, 8:21 a.m. | 4 hours, 7 minutes ago Description :The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.6.9.29. This is due to the `get_item_permissions_check` method granting access to users with the `ssa_manage_appointments` capability without validating staff ownership of the requested appointment. This makes it possible for authenticated attackers, with custom-level access and above (users granted the ssa_manage_appointments capability, such as Team Members), to view appointment records belonging to other staff members and access sensitive customer personally identifiable information via the appointment ID parameter. Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Chrome Zero-Day Vulnerabilities Actively Exploited in the Wild to Execute Malicious Code Google has released an urgent security update for its Chrome browser after confirming that two high-severity zero-day vulnerabilities are being actively exploited in the wild. The stable channel has b ... Read more Published Date: Mar 13, 2026 (3 days, 4 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-3910 CVE-2026-3909

Hive0163 Ransomware Operators Use AI-Generated Slopoly Malware Researchers have identified a suspected case of AI-generated malware being used during a ransomware attack. The malware, which analysts dubbed “Slopoly,” was linked to a financially motivated cybercri ... Read more Published Date: Mar 13, 2026 (3 days, 5 hours ago) Vulnerabilities has been mentioned in this article. CVE-2025-32434

CVE ID :CVE-2026-22201 Published : March 13, 2026, 6:19 a.m. | 4 hours, 9 minutes ago Description :wpDiscuz before 7.6.47 contains an IP spoofing vulnerability in the getIP() function that allows attackers to bypass IP-based rate limiting and ban enforcement by trusting untrusted HTTP headers. Attackers can set HTTP_CLIENT_IP or HTTP_X_FORWARDED_FOR headers to spoof their IP address and circumvent security controls. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-8766 Published : March 13, 2026, 6:19 a.m. | 6 hours, 9 minutes ago Description :A container privilege escalation flaw was found in certain Multi-Cloud Object Gateway Core images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container Severity: 6.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-57849 Published : March 13, 2026, 6:19 a.m. | 6 hours, 9 minutes ago Description :A container privilege escalation flaw was found in certain Fuse images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a non-root user, can leverage their membership in the root group to modify the /etc/passwd file. This could allow the attacker to add a new user with any arbitrary UID, including UID 0, leading to full root privileges within the container. Severity: 6.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...