News & Sicurezza

CVE ID :CVE-2026-2741 Published : March 10, 2026, 2:22 p.m. | 2 hours, 54 minutes ago Description :Specially crafted ZIP archives can escape the intended extraction directory during Node.js download and extraction in Vaadin 14.2.0 through 14.14.0, 23.0.0 through 23.6.6, 24.0.0 through 24.9.8, and 25.0.0 through 25.0.2. Vaadin’s build process can automatically download and extract Node.js if it is not installed locally. If an attacker can intercept or control this download via DNS hijacking, a MITM attack, a compromised mirror, or a supply chain attack, they can serve a malicious archive containing path traversal sequences that write files outside the intended extraction directory. Users of affected versions should use a globally preinstalled Node.js version compatible with their Vaadin version, or upgrade as follows: 14.2.0-14.14.0 to 14.14.1, 23.0.0-23.6.6 to 23.6.7, 24.0.0-24.9.8 to 24.9.9, and 25.0.0-25.0.2 to 25.0.3 or newer. Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-11739 Published : March 10, 2026, 2:22 p.m. | 2 hours, 54 minutes ago Description :CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated attacker sends a crafted data stream, triggering unsafe deserialization. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-13957 Published : March 10, 2026, 2:22 p.m. | 2 hours, 54 minutes ago Description :CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause information disclosure and remote code execution when SOCKS Proxy is enabled, and administrator credentials and PostgreSQL database credentials are known. SOCKS Proxy is disabled by default. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CISA Warns of Ivanti Endpoint Manager Authentication Bypass Vulnerability Exploited in Attacks A serious security flaw in Ivanti Endpoint Manager has caught federal attention after the Cybersecurity and Infrastructure Security Agency (CISA) added it to the Known Exploited Vulnerabilities (KEV) ... Read more Published Date: Mar 10, 2026 (17 hours, 44 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-1603 CVE-2026-1602

CVE ID :CVE-2026-3843 Published : March 10, 2026, 6:19 p.m. | 57 minutes ago Description :Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 on Linux contains a SQL Injection vulnerability (CWE-89) in the system configuration module. A remote attacker can send specially crafted HTTP POST requests to the /php/request.php endpoint via the sql parameter in application/x-www-form-urlencoded data (e.g., action=do&sql=&reload_driver=0) to execute arbitrary SQL commands and potentially achieve remote code execution. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-22614 Published : March 10, 2026, 12:22 p.m. | 4 hours, 54 minutes ago Description :The encryption mechanism used in Eaton's EasySoft project file was insecure and susceptible to brute force attacks, an attacker with access to this file and the local host machine could potentially read the sensitive information stored and tamper with the project file. This security issue has been fixed in the latest version of Eaton EasySoft which is available on the Eaton download centre. Severity: 6.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-21791 Published : March 10, 2026, 12:22 p.m. | 4 hours, 54 minutes ago Description :HCL Sametime for Android is impacted by a sensitive information disclosure. Hostnames information is written in application logs and certain URL Severity: 3.3 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

SAP Security Update – Patch for Multiple Vulnerabilities that Enable Remote Code Execution SAP released 15 new security notes on its March 2026 Patch Day, addressing a range of vulnerabilities across its product portfolio, including two critical-rated flaws that could enable remote code exe ... Read more Published Date: Mar 10, 2026 (17 hours, 21 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-27689 CVE-2026-27688 CVE-2026-27687 CVE-2026-27686 CVE-2026-27685 CVE-2026-27684 CVE-2026-24317 CVE-2026-24316 CVE-2026-24313 CVE-2026-24311 CVE-2026-24310 CVE-2026-24309 CVE-2026-0489 CVE-2025-9232 CVE-2025-9230 CVE-2019-17571

The Zero-Day Scramble is Avoidable: A Guide to Attack Surface Reduction You can't control when the next critical vulnerability drops. You can control how much of your environment is exposed when it does. The problem is that most teams have more internet-facing exposure th ... Read more Published Date: Mar 10, 2026 (18 hours, 18 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-21385 CVE-2026-21513 CVE-2025-53770

The ‘Must-Patch’ List: CISA Adds Actively Exploited SolarWinds, Ivanti, and Omnissa Flaws to KEV The Cybersecurity and Infrastructure Security Agency (CISA) has expanded its Known Exploited Vulnerabilities (KEV) Catalog, adding three high-stakes flaws that are currently being leveraged by malicio ... Read more Published Date: Mar 10, 2026 (18 hours, 32 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-2256 CVE-2026-1603 CVE-2025-37164 CVE-2025-26399 CVE-2024-20953 CVE-2021-22054

VS waarschuwt voor actief misbruik van lek in Ivanti Endpoint Manager De Amerikaanse autoriteiten waarschuwen voor actief misbruik van een kwetsbaarheid in Ivanti Endpoint Manager (EPM). Het gaat om een authentication bypass kwetsbaarheid waardoor een ongeauthenticeerde ... Read more Published Date: Mar 10, 2026 (18 hours, 44 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-1603

CVE ID :CVE-2026-1261 Published : March 10, 2026, 10:20 a.m. | 6 hours, 56 minutes ago Description :The MetForm Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Quiz feature in all versions up to, and including, 3.9.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Severity: 7.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...