News & Sicurezza

CVE ID :CVE-2026-3974 Published : March 12, 2026, 3:15 a.m. | 5 hours, 10 minutes ago Description :A vulnerability was identified in Tenda W3 1.0.0.3(2204). This vulnerability affects the function formexeCommand of the file /goform/exeCommand of the component HTTP Handler. Such manipulation of the argument cmdinput leads to stack-based buffer overflow. The attack may be performed from remote. The exploit is publicly available and might be used. Severity: 9.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-3976 Published : March 12, 2026, 3:15 a.m. | 7 hours, 10 minutes ago Description :A weakness has been identified in Tenda W3 1.0.0.3(2204). Impacted is the function formWifiMacFilterSet of the file /goform/WifiMacFilterSet of the component POST Parameter Handler. Executing a manipulation of the argument index/GO can lead to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. Severity: 9.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

The My Sticky Bar plugin for WordPress is vulnerable to SQL injection via the `stickymenu_contact_lead_form` AJAX action in all versions up to, and including, 2.8.6. This is due to the handler using attacker-controlled POST parameter names directly as SQL column identifiers in `$wpdb->insert()`. While parameter values are sanitized with `esc_sql()` and `sanitize_text_field()`, the parameter keys are used as-is to build the column list in the INSERT statement. This makes it possible for unauthenticated attackers to inject SQL via crafted parameter names, enabling blind time-based data extraction from the database.

CVE ID :CVE-2026-3657 Published : March 12, 2026, 3:15 a.m. | 5 hours, 10 minutes ago Description :The My Sticky Bar plugin for WordPress is vulnerable to SQL injection via the `stickymenu_contact_lead_form` AJAX action in all versions up to, and including, 2.8.6. This is due to the handler using attacker-controlled POST parameter names directly as SQL column identifiers in `$wpdb->insert()`. While parameter values are sanitized with `esc_sql()` and `sanitize_text_field()`, the parameter keys are used as-is to build the column list in the INSERT statement. This makes it possible for unauthenticated attackers to inject SQL via crafted parameter names, enabling blind time-based data extraction from the database. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-15038 Published : March 12, 2026, 3:15 a.m. | 3 hours, 9 minutes ago Description :An Out-of-Bounds Read vulnerability exists in the ASUS Business System Control Interface driver. This vulnerability can be triggered by an unprivileged local user sending a specially crafted IOCTL request, potentially leading to a disclosure of kernel information or a system crash. Refer to the "Security Update for ASUS Business System Control Interface" section on the ASUS Security Advisory for more information. Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-1878 Published : March 12, 2026, 3:15 a.m. | 3 hours, 9 minutes ago Description :An Insufficient Integrity Verification vulnerability in the ASUS ROG peripheral driver installation process allows privilege escalation to SYSTEM. The vulnerability is due to improper access control on the installation directory, which enables the exploitation of a race condition where the legitimate installer is substituted with an unexpected payload immediately after download, resulting in arbitrary code execution. Refer to the "Security Update for ASUS ROG peripheral driver" section on the ASUS Security Advisory for more information. Severity: 5.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-3226 Published : March 12, 2026, 3:15 a.m. | 3 hours, 9 minutes ago Description :The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized email notification triggering due to missing capability checks on all 10 functions in the SendEmailAjax class in all versions up to, and including, 4.3.2.8. The AbstractAjax::catch_lp_ajax() dispatcher verifies a wp_rest nonce but performs no current_user_can() check before dispatching to handler functions. The wp_rest nonce is embedded in the frontend JavaScript for all authenticated users. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger arbitrary email notifications to admins, instructors, and users, enabling email flooding, social engineering, and impersonation of admin decisions regarding instructor requests. Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-15037 Published : March 12, 2026, 3:15 a.m. | 3 hours, 9 minutes ago Description :An Incorrect Permission Assignment vulnerability exists in the ASUS Business System Control Interface driver. This vulnerability can be triggered by an unprivileged local user sending a specially crafted IOCTL request, potentially leading to unauthorized access to sensitive hardware resources and kernel information disclosure. Refer to the "ASUS Business System Control Interface" section on the ASUS Security Advisory for more information. Severity: 6.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CISA Mandates Urgent Patch for Maximum 10.0 CVSS n8n RCE Flaw The Cybersecurity and Infrastructure Security Agency (CISA) has officially added a new, high-stakes entry to its Known Exploited Vulnerabilities (KEV) Catalog. The vulnerability, tracked as CVE-2025-6 ... Read more Published Date: Mar 12, 2026 (1 day ago) Vulnerabilities has been mentioned in this article. CVE-2026-31976 CVE-2025-68613 CVE-2021-26829 CVE-2020-2883

CVE ID :CVE-2026-3977 Published : March 12, 2026, 4:16 a.m. | 6 hours, 9 minutes ago Description :A security vulnerability has been detected in projectsend up to r1945. The affected element is an unknown function of the component AJAX Endpoints. The manipulation leads to missing authorization. The attack can be initiated remotely. The identifier of the patch is 35dfd6f08f7d517709c77ee73e57367141107e6b. To fix this issue, it is recommended to deploy a patch. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

High-Privilege Havoc: Splunk Patches RCE Flaw Lurking in File Previews Splunk has released a critical security advisory regarding a high-severity Remote Command Execution (RCE) vulnerability, tracked as CVE-2026-20163 with a CVSS score of 8.0. The flaw resides in the Spl ... Read more Published Date: Mar 12, 2026 (22 hours, 22 minutes ago) Vulnerabilities has been mentioned in this article.

Cyber Escalation in the Middle East: Disruption, Deception, and the Quest for Data A new report from Rapid7 Labs highlights a significant spike in retaliatory cyber activity targeting both regional and Western infrastructure, characterized by a mix of state-directed espionage and a ... Read more Published Date: Mar 12, 2026 (22 hours, 37 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-21514 CVE-2026-1281 CVE-2025-52691 CVE-2025-68613 CVE-2025-9316 CVE-2025-32433 CVE-2024-4577