News & Sicurezza

CVE ID :CVE-2026-21285 Published : March 11, 2026, 2:19 a.m. | 58 minutes ago Description :Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized access to a feature. Exploitation of this issue does not require user interaction. Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-21360 Published : March 11, 2026, 3:15 a.m. | 2 hours, 2 minutes ago Description :Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to access unauthorized files or directories outside the intended restricted path. Exploitation of this issue does not require user interaction. Severity: 6.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-21296 Published : March 11, 2026, 3:15 a.m. | 2 hours, 2 minutes ago Description :Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized view access of data. Exploitation of this issue does not require user interaction. Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-21295 Published : March 11, 2026, 3:15 a.m. | 2 hours, 2 minutes ago Description :Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. An attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction. Severity: 3.1 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-1781 Published : March 11, 2026, 2:16 a.m. | 1 hour, 1 minute ago Description :The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.11.1. This is due to the plugin trusting the `_mc4wp_action` POST parameter without validation, allowing unauthenticated attackers to force the form to process unsubscribe actions instead of subscribe actions. This makes it possible for unauthenticated attackers to arbitrarily unsubscribe any email address from the connected Mailchimp audience via the `_mc4wp_action` parameter, granted they can obtain the form ID (which is publicly exposed in the HTML source). Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-2324 Published : March 11, 2026, 2:16 a.m. | 1 hour, 1 minute ago Description :The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.7. This is due to missing or incorrect nonce validation on the reload_preview() function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Severity: 6.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-12473 Published : March 11, 2026, 2:16 a.m. | 1 hour, 1 minute ago Description :The RTMKit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'themebuilder' parameter in all versions up to, and including, 1.6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a site administrator into performing an action such as clicking on a link. Severity: 6.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Industrial Alert: Critical Stored XSS Vulnerability Discovered in Siemens SIMATIC S7-1500 A high-severity security flaw has been uncovered in the Siemens SIMATIC S7-1500 CPU family, a cornerstone of modern industrial automation. The vulnerability, tracked as CVE-2025-40943, could allow a r ... Read more Published Date: Mar 11, 2026 (1 day, 1 hour ago) Vulnerabilities has been mentioned in this article. CVE-2025-40943 CVE-2025-40804 CVE-2024-47901

Microsoft Patch Tuesday March 2026: 93 Vulnerabilities Addressed, Including Two Zero-Days The March 2026 edition of Microsoft Patch Tuesday has arrived, bringing a massive wave of security updates to protect enterprise and consumer environments. This month, Microsoft has addressed a total ... Read more Published Date: Mar 11, 2026 (23 hours, 29 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-26127 CVE-2026-21262 CVE-2025-55234 CVE-2024-43573 CVE-2024-43572

CVE ID :CVE-2026-27266 Published : March 11, 2026, 1:16 a.m. | 2 hours ago Description :Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. Severity: 5.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Microsoft Patch Tuesday – March 2026 Released: March 10, 2026Executive SummaryMicrosoft’s March 2026 Patch Tuesday addresses 83 vulnerabilities across Windows, Microsoft Office, SQL Server, Azure cloud services, and .NET — with 8 rated C ... Read more Published Date: Mar 11, 2026 (1 day ago) Vulnerabilities has been mentioned in this article. CVE-2026-26148 CVE-2026-26144 CVE-2026-26141 CVE-2026-26127 CVE-2026-26118 CVE-2026-26117 CVE-2026-26114 CVE-2026-26113 CVE-2026-26110 CVE-2026-26106 CVE-2026-23654 CVE-2026-21262

Maximum 10.0 CVSS Flaws in OneUptime Allow Full Account Takeovers and RCE OneUptime, a popular multi-tenant platform for monitoring websites and APIs, has released urgent patches to address two maximum-severity vulnerabilities. These flaws, both carrying a CVSS score of 10. ... Read more Published Date: Mar 11, 2026 (1 day ago) Vulnerabilities has been mentioned in this article. CVE-2026-30957 CVE-2026-30956 CVE-2026-27728 CVE-2025-58176 CVE-2024-36401