News & Sicurezza

Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. This triggers prolonged loop execution that consumes excessive system resources, potentially rendering the system unavailable. Successful exploitation results in a denial-of-service condition that impacts availability, while confidentiality and integrity remain unaffected.

SAP NetWeaver Enterprise Portal Administration is vulnerable if a privileged user uploads untrusted or malicious content that, upon deserialization, could result in a high impact on the confidentiality, integrity, and availability of the host system.

The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.9.5 via the Social Login addon. This is due to the plugin failing to verify that the email provided in the authentication request matches the email from the validated OAuth token. This makes it possible for unauthenticated attackers to log in as any existing user, including administrators, by supplying a valid OAuth token from their own account along with the victim's email address.

Microsoft Patch Tuesday March 2026 – 78 Vulnerabilities Fixed, Including One 0-day Microsoft released its March 2026 Patch Tuesday security update on March 10, 2026, addressing 78 vulnerabilities across Windows, Microsoft Office, Azure, SQL Server, and .NET. The update includes one ... Read more Published Date: Mar 10, 2026 (19 hours, 47 minutes ago) Vulnerabilities has been mentioned in this article.

Cloudflare Pingora Vulnerabilities Allows Request Smuggling & Cache Poisoning Attacks Cloudflare Pingora Vulnerabilities Cloudflare has released version 0.8.0 of its open-source Pingora framework to patch three critical vulnerabilities: CVE-2026-2833, CVE-2026-2835, and CVE-2026-2836. ... Read more Published Date: Mar 10, 2026 (20 hours, 2 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-2836 CVE-2026-2835 CVE-2026-2833

Malformed ZIP Files Allows Attackers to Bypass Antivirus and EDR Detections Malformed ZIP Files Bypass Antivirus and EDR Detections A critical flaw in how antivirus and Endpoint Detection and Response (EDR) systems process archive files. Tracked as CVE-2026-0866, this weaknes ... Read more Published Date: Mar 10, 2026 (18 hours, 6 minutes ago) Vulnerabilities has been mentioned in this article.

Ivanti Desktop and Server Management Vulnerability Allows Attackers to Escalate Privileges Ivanti has issued a security update for its Desktop and Server Management (DSM) software, addressing a high-severity vulnerability that could allow a local authenticated attacker to escalate their pri ... Read more Published Date: Mar 10, 2026 (16 hours, 15 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-3483

Unauthenticated Takeover: Critical 9.6 CVSS Zoom Flaw Exposes Windows Users to Remote Privilege Escalation Zoom has released a series of security advisories detailing four significant vulnerabilities affecting its Windows clients, including a “Critical” rated flaw that allows for unauthenticated privilege ... Read more Published Date: Mar 10, 2026 (16 hours, 53 minutes ago) Vulnerabilities has been mentioned in this article.

FortiGate Devices Exploited to Breach Networks and Steal Service Account Credentials Cybersecurity researchers are calling attention to a new campaign where threat actors are abusing FortiGate Next-Generation Firewall (NGFW) appliances as entry points to breach victim networks. The ac ... Read more Published Date: Mar 10, 2026 (16 hours, 57 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-21385 CVE-2026-21513 CVE-2026-24858 CVE-2025-59719 CVE-2025-59718

Mental health apps are leaking your private thoughts. How do you protect yourself? | Kaspersky official blog In February 2026, the cybersecurity firm Oversecured published a report that makes you want to factory reset your phone and move into a remote cabin in the woods. Researchers audited 10 popular Androi ... Read more Published Date: Mar 10, 2026 (17 hours, 22 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2024-3094

CVE ID :CVE-2026-2742 Published : March 10, 2026, 2:22 p.m. | 2 hours, 54 minutes ago Description :An authentication bypass vulnerability exists in Vaadin 14.0.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.7 and 25.0.0 through 25.0.1, applications using Spring Security due to inconsistent path pattern matching of reserved framework paths. Accessing the /VAADIN endpoint without a trailing slash bypasses security filters, and allowing unauthenticated users to trigger framework initialization and create sessions without proper authorization. Users of affected versions using Spring Security should upgrade as follows: 14.0.0-14.14.0 upgrade to 14.14.1, 23.0.0-23.6.6 to 23.6.7, 24.0.0 - 24.9.7 to 24.9.8, and 25.0.0-25.0.1 upgrade to 25.0.2 or newer. Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-13957 Published : March 10, 2026, 2:22 p.m. | 2 hours, 54 minutes ago Description :CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause information disclosure and remote code execution when SOCKS Proxy is enabled, and administrator credentials and PostgreSQL database credentials are known. SOCKS Proxy is disabled by default. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...