News & Sicurezza

CVE ID :CVE-2026-28432 Published : March 10, 2026, 7:43 a.m. | 1 hour, 32 minutes ago Description :Misskey is an open source, federated social media platform. All Misskey servers prior to 2026.3.1 contain a vulnerability that allows bypassing HTTP signature verification. Although this is a vulnerability related to federation, it affects all servers regardless of whether federation is enabled or disabled. This vulnerability is fixed in 2026.3.1. Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-28431 Published : March 10, 2026, 7:43 a.m. | 1 hour, 32 minutes ago Description :Misskey is an open source, federated social media platform. All Misskey servers running versions 8.45.0 and later, but prior to 2026.3.1, contain a vulnerability that allows bad actors access to data that they ordinarily wouldn't be able to access due to insufficient permission checks and proper input validation. This vulnerability occurs regardless of whether federation is enabled or not. This vulnerability could lead to a significant data breach. This vulnerability is fixed in 2026.3.1. Severity: 9.2 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Critical Alert: SAP’s Latest Security Update Fixes 9.8 CVSS RCE and Deserialization Flaws Today, 2026, SAP released its monthly security patch update, addressing 15 new security notes across its product ecosystem. This month’s update is particularly significant, featuring two Critical prio ... Read more Published Date: Mar 10, 2026 (19 hours, 57 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-27689 CVE-2026-27688 CVE-2026-27685 CVE-2026-27684 CVE-2026-24317 CVE-2026-24316 CVE-2026-24309 CVE-2026-0953 CVE-2026-0489 CVE-2026-2256 CVE-2026-0488 CVE-2025-7775 CVE-2025-36038 CVE-2025-0070 CVE-2025-0066 CVE-2024-47578 CVE-2019-17571

CISA Flags SolarWinds, Ivanti, and Workspace One Vulnerabilities as Actively Exploited The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added three security flaws to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. Th ... Read more Published Date: Mar 10, 2026 (19 hours, 1 minute ago) Vulnerabilities has been mentioned in this article. CVE-2026-21385 CVE-2026-21513 CVE-2026-1603 CVE-2025-26399 CVE-2021-22054

CVE ID :CVE-2026-1508 Published : March 10, 2026, 6 a.m. | 1 hour, 15 minutes ago Description :The Court Reservation WordPress plugin before 1.10.9 does not have CSRF check in place when deleting events, which could allow attackers to make a logged in admin delete them via a CSRF attack Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-0953 Published : March 10, 2026, 5:26 a.m. | 1 hour, 49 minutes ago Description :The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.9.5 via the Social Login addon. This is due to the plugin failing to verify that the email provided in the authentication request matches the email from the validated OAuth token. This makes it possible for unauthenticated attackers to log in as any existing user, including administrators, by supplying a valid OAuth token from their own account along with the victim's email address. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2025-2399 Published : March 10, 2026, 4:44 p.m. | 32 minutes ago Description :Improper Validation of Specified Index, Position, or Offset in Input vulnerability in Mitsubishi Electric CNC M800V Series M800VW and M800VS, M80V Series M80V and M80VW, M800 Series M800W and M800S, M80 Series M80 and M80W, E80 Series E80, C80 Series C80, M700V Series M750VW, M720VW, 730VW, M720VS, M730VS, and M750VS, M70V Series M70V, E70 Series E70, and Software Tools NC Trainer2 and NC Trainer2 plus allows a remote attacker to cause an out-of-bounds read, resulting in a denial-of-service condition by sending specially crafted packets to TCP port 683. Severity: 5.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-3585 Published : March 10, 2026, 3:33 a.m. | 3 hours, 41 minutes ago Description :The The Events Calendar plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 6.15.17 via the 'ajax_create_import' function. This makes it possible for authenticated attackers, with Author-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Total Platform Compromise: Critical 9.6 CVSS Flaws in Budibase Expose Production Secrets Budibase, the popular open-source low-code platform designed for building internal business applications, has released critical security patches to address two major vulnerabilities. Two critical flaw ... Read more Published Date: Mar 10, 2026 (22 hours, 13 minutes ago) Vulnerabilities has been mentioned in this article.

Under Active Attack: Critical 9.8 CVSS Tutor LMS Pro Flaw Exploited in the Wild for Full Site Takeover A high-severity vulnerability has been uncovered in Tutor LMS Pro, a popular WordPress plugin used by over 30,000 active sites to manage online courses. The flaw, tracked as CVE-2026-0953, carries a C ... Read more Published Date: Mar 10, 2026 (22 hours, 38 minutes ago) Vulnerabilities has been mentioned in this article.

Home Network Alert: TP-Link Patches RCE Vulnerability in Archer AXE75 Routers TP-Link has issued an urgent security advisory for users of its high-performance Archer AXE75 routers. A newly discovered command injection flaw, tracked as CVE-2025-15568, could allow attackers to se ... Read more Published Date: Mar 10, 2026 (22 hours, 44 minutes ago) Vulnerabilities has been mentioned in this article.

Kubernetes Security Alert: “Ingress-Nginx” Injection Flaw Risks Cluster-Wide Secret Exposure A critical security vulnerability has been identified in ingress-nginx, the widely used Ingress controller for Kubernetes. Tracked as CVE-2026-3288 with a high-severity CVSS score of 8.8, the flaw cen ... Read more Published Date: Mar 10, 2026 (20 hours, 54 minutes ago) Vulnerabilities has been mentioned in this article.