News & Sicurezza

CVE ID :CVE-2026-2626 Published : March 11, 2026, 6:17 a.m. | 4 hours, 7 minutes ago Description :The divi-booster WordPress plugin before 5.0.2 does not have authorization and CSRF checks in one of its fixing function, allowing unauthenticated users to modify stored divi-booster WordPress plugin before 5.0.2 options. Furthermore, due to the use of unserialize() on the data, this could be further exploited when combined with a PHP gadget chain to achieve PHP Object Injection Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-2707 Published : March 11, 2026, 6:17 a.m. | 4 hours, 7 minutes ago Description :The weForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the REST API entry submission endpoint in all versions up to, and including, 1.6.27. This is due to inconsistent input sanitization between the frontend AJAX handler and the REST API endpoint. When entries are submitted via the REST API (`/wp-json/weforms/v1/forms/{id}/entries/`), the `prepare_entry()` method in `class-abstract-fields.php` receives the WP_REST_Request object as `$args`, bypassing the `weforms_clean()` fallback that sanitizes `$_POST` data for frontend submissions. The base field handler only applies `trim()` to the value. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts into form entry hidden field values via the REST API that execute when an administrator views the form entries page, where data is rendered using a Vue.js `v-html` directive without escaping. Severity: 6.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-2631 Published : March 11, 2026, 6:17 a.m. | 4 hours, 7 minutes ago Description :The Datalogics Ecommerce Delivery WordPress plugin before 2.6.60 exposes an unauthenticated REST endpoint that allows any remote user to modify the option `datalogics_token` without verification. This token is subsequently used for authentication in a protected endpoint that allows users to perform arbitrary WordPress `update_option()` operations. Attackers can use this to enable registartion and to set the default role as Administrator. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-1753 Published : March 11, 2026, 6:17 a.m. | 2 hours, 6 minutes ago Description :The Gutena Forms WordPress plugin before 1.6.1 does not validate option to be updated, which could allow contributors and above role to update arbitrary boolean and array options (such as users_can_register). Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-1867 Published : March 11, 2026, 6:17 a.m. | 2 hours, 6 minutes ago Description :The Guest posting / Frontend Posting / Front Editor WordPress plugin before 5.0.6 allows passing a URL parameter to regenerate a .json file based on demo data that it initially creates. If an administrator modifies the demo form and enables admin notifications in the Guest posting / Frontend Posting / Front Editor WordPress plugin before 5.0.6's settings, it is possible for an unauthenticated attacker to export and download all of the form data/settings, including the administrator's email address. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-20892 Published : March 11, 2026, 6:17 a.m. | 2 hours, 6 minutes ago Description :Code injection vulnerability exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker with administrative privileges to execute arbitrary commands. Severity: 7.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-24448 Published : March 11, 2026, 6:17 a.m. | 2 hours, 6 minutes ago Description :Use of hard-coded credentials issue exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker to obtain administrative access. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-27842 Published : March 11, 2026, 6:17 a.m. | 2 hours, 6 minutes ago Description :Authentication bypass issue exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker to bypass authentication and change the device configuration. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2023-27573 Published : March 11, 2026, 6:17 a.m. | 1 hour, 1 minute ago Description :netbox-docker before 2.5.0 has a superuser account with default credentials (admin password for the admin account, and 0123456789abcdef0123456789abcdef01234567 value for SUPERUSER_API_TOKEN). In practice on the public Internet, almost all users changed the password but only about 90% changed the token. Having a default token value was intentional and was valuable for the main intended use case of the netbox-docker product (isolated development networks). Some users engaged in an effort to repurpose netbox-docker for production. The documentation for this effort stated that the defaults must not be used. However, installation did not ensure non-default values. The Supplier was aware of the CVE ID assignment and did not object to the assignment. Severity: 9.0 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

March 2026 Patch Tuesday: Eight Critical Vulnerabilities and Two Publicly Disclosed Among 82 CVEs Patched Microsoft has addressed 82 vulnerabilities in its March 2026 security update release. These include two publicly disclosed vulnerabilities and eight Critical vulnerabilities. This month's leading risk ... Read more Published Date: Mar 11, 2026 (1 day, 1 hour ago) Vulnerabilities has been mentioned in this article. CVE-2026-26144 CVE-2026-26127 CVE-2026-26113 CVE-2026-26110 CVE-2026-21262 CVE-2026-26125 CVE-2026-26124 CVE-2026-26122 CVE-2026-23651 CVE-2026-21536

Gogs Vulnerability Enables Attackers to Silently Overwrite Large File Storage Objects Gogs Vulnerability Overwrite Large File Storage Objects A critical security flaw has been discovered in a popular open-source, self-hosted Git service, allowing attackers to overwrite Large File Stora ... Read more Published Date: Mar 11, 2026 (1 day, 1 hour ago) Vulnerabilities has been mentioned in this article. CVE-2026-25921

Microsoft .NET 0-Day Vulnerability Enables Denial-of-Service Attacks Microsoft .NET 0-Day Vulnerability An emergency security update has been released to address a newly disclosed .NET Framework vulnerability, tracked as CVE-2026-26127. This security flaw allows unauth ... Read more Published Date: Mar 11, 2026 (23 hours, 27 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-26127