News & Sicurezza

CISA warns max-severity n8n bug is being exploited in the wild The US Cybersecurity and Infrastructure Security Agency (CISA) has confirmed that hackers are exploiting a max-severity remote code execution (RCE) vulnerability in workflow automation platform n8n. C ... Read more Published Date: Mar 12, 2026 (23 hours, 43 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-25049 CVE-2026-21858 CVE-2025-68613

CVE ID :CVE-2026-2987 Published : March 12, 2026, 1:16 p.m. | 1 hour, 10 minutes ago Description :The Simple Ajax Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'c' parameter in versions up to, and including, 20260217 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Severity: 6.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-2514 Published : March 12, 2026, 1:16 p.m. | 1 hour, 10 minutes ago Description :In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, a vulnerability exists whereby an adversary with access to Flowmon monitoring ports may craft malicious network data that, when processed by Flowmon ADS and viewed by an authenticated user, could result in unintended actions being executed in the user's browser context. Severity: 8.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-2513 Published : March 12, 2026, 1:16 p.m. | 1 hour, 10 minutes ago Description :A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3, whereby an administrator who clicks a malicious link provided by an attacker may inadvertently trigger unintended actions within their authenticated web session. Severity: 8.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-0809 Published : March 12, 2026, 1:16 p.m. | 1 hour, 10 minutes ago Description :Use of a custom token encoding algorithm in Streamsoft Prestiż software allows the value of the KSeF (Krajowy System e-Faktur) token to be guessed after analyzing how tokens with know values are encoded. This issue was fixed in version 20.0.380.92. Severity: 6.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

ThreatsDay Bulletin: OAuth Trap, EDR Killer, Signal Phishing, Zombie ZIP, AI Platform Hack & More Another Thursday, another pile of weird security stuff that somehow happened in just seven days. Some of it is clever. Some of it is lazy. A few bits fall into that uncomfortable category of “yeah… th ... Read more Published Date: Mar 12, 2026 (1 day ago) Vulnerabilities has been mentioned in this article.

Paloalto Cortex XDR Broker Vulnerability Attackers to Obtain and Modify Sensitive Information Paloalto Cortex XDR Broker Vulnerability A security advisory has been issued for a newly discovered vulnerability affecting the Cortex XDR Broker Virtual Machine (VM). This flaw could allow a highly p ... Read more Published Date: Mar 12, 2026 (1 day ago) Vulnerabilities has been mentioned in this article. CVE-2026-0231

CVE ID :CVE-2026-4040 Published : March 12, 2026, 12:15 p.m. | 2 hours, 10 minutes ago Description :A vulnerability was identified in OpenClaw up to 2026.2.17. This issue affects the function tools.exec.safeBins of the component File Existence Handler. The manipulation leads to information exposure through discrepancy. The attack needs to be performed locally. Upgrading to version 2026.2.19-beta.1 is capable of addressing this issue. The identifier of the patch is bafdbb6f112409a65decd3d4e7350fbd637c7754. Upgrading the affected component is advised. Severity: 4.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-4039 Published : March 12, 2026, 12:15 p.m. | 2 hours, 10 minutes ago Description :A vulnerability was determined in OpenClaw 2026.2.19-2. This vulnerability affects the function applySkillConfigenvOverrides of the component Skill Env Handler. Executing a manipulation can lead to code injection. It is possible to launch the attack remotely. Upgrading to version 2026.2.21-beta.1 is able to resolve this issue. This patch is called 8c9f35cdb51692b650ddf05b259ccdd75cc9a83c. It is recommended to upgrade the affected component. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

The State of Cyber Warfare in 2026: Nation-State Attacks, AI Weapons, and the New Digital Battlefield Cyber operations no longer occur only during wartime. Digital activity now runs continuously alongside diplomacy, sanctions, and military tensions. This has become particularly visible amid escalating ... Read more Published Date: Mar 12, 2026 (23 hours, 25 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-22719 CVE-2026-2441 CVE-2026-21509 CVE-2026-24423 CVE-2025-8088 CVE-2025-22247

CVE ID :CVE-2026-3989 Published : March 12, 2026, 12:15 p.m. | 2 hours, 10 minutes ago Description :SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization. An attacker can take advantage of this by providing a malicious .pkl file, which will execute the attackers code on the device running the script. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-3060 Published : March 12, 2026, 12:15 p.m. | 2 hours, 10 minutes ago Description :SGLang' encoder parallel disaggregation system is vulnerable to unauthenticated remote code execution through the disaggregation module, which deserializes untrusted data using pickle.loads() without authentication. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...