News & Sicurezza

CVE ID :CVE-2026-3792 Published : March 9, 2026, 2:15 a.m. | 4 hours, 59 minutes ago Description :A vulnerability was found in SourceCodester Sales and Inventory System 1.0. This affects an unknown part of the file purchase_invoice.php of the component GET Parameter Handler. The manipulation of the argument purchaseid results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-3795 Published : March 9, 2026, 3:15 a.m. | 3 hours, 59 minutes ago Description :A security flaw has been discovered in doramart DoraCMS 3.0.x. Impacted is the function createFileBypath of the file /DoraCMS/server/app/router/api/v1.js. Performing a manipulation results in path traversal. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-3793 Published : March 9, 2026, 3:15 a.m. | 3 hours, 59 minutes ago Description :A vulnerability was determined in SourceCodester Sales and Inventory System 1.0. This vulnerability affects unknown code of the file sales_invoice1.php of the component GET Parameter Handler. This manipulation of the argument sellid causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Escalation in the Shadows: Iranian APT Seedworm Deploys ‘Dindoor’ Backdoor in New Cyberoffensive As geopolitical tensions escalate in the Middle East, the digital battlefield is seeing a parallel surge in activity. The Threat Hunter Team has released a critical report documenting a spike in cyber ... Read more Published Date: Mar 09, 2026 (1 day, 10 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-2256 CVE-2025-59287

Critical 9.4 CVSS Zephyr RTOS Flaw Exposes Millions of IoT Devices to RCE Security researchers have disclosed a critical memory-safety vulnerability in the Zephyr Project, a high-profile, scalable real-time operating system (RTOS) designed for resource-constrained IoT devic ... Read more Published Date: Mar 09, 2026 (1 day, 8 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-1678 CVE-2026-2256 CVE-2025-31701 CVE-2025-31700

Vault Unlocked: High-Severity Flaws in Vaultwarden Expose Encrypted Secrets and Allow Privilege Escalation Security researchers have identified a series of critical vulnerabilities in Vaultwarden, the popular lightweight, self-hosted alternative to the Bitwarden API. The flaws range from unauthorized privi ... Read more Published Date: Mar 09, 2026 (1 day, 6 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-27898 CVE-2026-27803 CVE-2026-27802 CVE-2026-2256

CVE ID :CVE-2026-3791 Published : March 9, 2026, 1:15 a.m. | 5 hours, 59 minutes ago Description :A vulnerability has been found in SourceCodester Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file dashboard.php of the component Search. The manipulation of the argument searchtxt leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Critical 9.3 CVSS Flaw in SiYuan Lets Hackers Steal Private Notes via SVG Injection Security researchers have disclosed a high-severity vulnerability in SiYuan, the popular privacy-first personal knowledge management system. The flaw, tracked as CVE-2026-29183 with a CVSS score of 9. ... Read more Published Date: Mar 09, 2026 (1 day, 6 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-29183 CVE-2026-2256 CVE-2025-5806

Critical Bypasses and Secret Leaks Patched in Apache ZooKeeper The Apache Software Foundation has released an urgent security update for Apache ZooKeeper, the mission-critical service used by thousands of distributed applications for configuration, naming, and sy ... Read more Published Date: Mar 09, 2026 (1 day, 6 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-24308 CVE-2026-24281 CVE-2026-2256 CVE-2023-44981

CVE ID :CVE-2026-3789 Published : March 9, 2026, 12:16 a.m. | 6 hours, 59 minutes ago Description :A vulnerability was detected in Bytedesk up to 1.3.9. Affected is the function getModels of the file source-code/src/main/java/com/bytedesk/ai/springai/providers/gitee/SpringAIGiteeRestService.java of the component SpringAIGiteeRestController. Performing a manipulation of the argument apiUrl results in server-side request forgery. Remote exploitation of the attack is possible. The exploit is now public and may be used. Upgrading to version 1.4.5.4 is able to address this issue. The patch is named 975e39e4dd527596987559f56c5f9f973f64eff7. Upgrading the affected component is advised. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-3790 Published : March 9, 2026, 12:16 a.m. | 6 hours, 59 minutes ago Description :A flaw has been found in SourceCodester Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file check_supplier_details.php of the component POST Parameter Handler. Executing a manipulation of the argument stock_name1 can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-3788 Published : March 9, 2026, 12:16 a.m. | 6 hours, 59 minutes ago Description :A security vulnerability has been detected in Bytedesk up to 1.3.9. This impacts the function getModels of the file source-code/src/main/java/com/bytedesk/ai/springai/providers/openrouter/SpringAIOpenrouterRestService.java of the component SpringAIOpenrouterRestController. Such manipulation of the argument apiUrl leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.4.5.4 will fix this issue. The name of the patch is 975e39e4dd527596987559f56c5f9f973f64eff7. It is recommended to upgrade the affected component. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...