News & Sicurezza

Critical 9.4 CVSS Zephyr RTOS Flaw Exposes Millions of IoT Devices to RCE Security researchers have disclosed a critical memory-safety vulnerability in the Zephyr Project, a high-profile, scalable real-time operating system (RTOS) designed for resource-constrained IoT devic ... Read more Published Date: Mar 09, 2026 (1 day, 8 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-1678 CVE-2026-2256 CVE-2025-31701 CVE-2025-31700

Vault Unlocked: High-Severity Flaws in Vaultwarden Expose Encrypted Secrets and Allow Privilege Escalation Security researchers have identified a series of critical vulnerabilities in Vaultwarden, the popular lightweight, self-hosted alternative to the Bitwarden API. The flaws range from unauthorized privi ... Read more Published Date: Mar 09, 2026 (1 day, 6 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-27898 CVE-2026-27803 CVE-2026-27802 CVE-2026-2256

CVE ID :CVE-2026-3791 Published : March 9, 2026, 1:15 a.m. | 5 hours, 59 minutes ago Description :A vulnerability has been found in SourceCodester Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file dashboard.php of the component Search. The manipulation of the argument searchtxt leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Critical 9.3 CVSS Flaw in SiYuan Lets Hackers Steal Private Notes via SVG Injection Security researchers have disclosed a high-severity vulnerability in SiYuan, the popular privacy-first personal knowledge management system. The flaw, tracked as CVE-2026-29183 with a CVSS score of 9. ... Read more Published Date: Mar 09, 2026 (1 day, 6 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-29183 CVE-2026-2256 CVE-2025-5806

Critical Bypasses and Secret Leaks Patched in Apache ZooKeeper The Apache Software Foundation has released an urgent security update for Apache ZooKeeper, the mission-critical service used by thousands of distributed applications for configuration, naming, and sy ... Read more Published Date: Mar 09, 2026 (1 day, 6 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-24308 CVE-2026-24281 CVE-2026-2256 CVE-2023-44981

CVE ID :CVE-2026-3790 Published : March 9, 2026, 12:16 a.m. | 6 hours, 59 minutes ago Description :A flaw has been found in SourceCodester Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file check_supplier_details.php of the component POST Parameter Handler. Executing a manipulation of the argument stock_name1 can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-3789 Published : March 9, 2026, 12:16 a.m. | 6 hours, 59 minutes ago Description :A vulnerability was detected in Bytedesk up to 1.3.9. Affected is the function getModels of the file source-code/src/main/java/com/bytedesk/ai/springai/providers/gitee/SpringAIGiteeRestService.java of the component SpringAIGiteeRestController. Performing a manipulation of the argument apiUrl results in server-side request forgery. Remote exploitation of the attack is possible. The exploit is now public and may be used. Upgrading to version 1.4.5.4 is able to address this issue. The patch is named 975e39e4dd527596987559f56c5f9f973f64eff7. Upgrading the affected component is advised. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-3788 Published : March 9, 2026, 12:16 a.m. | 6 hours, 59 minutes ago Description :A security vulnerability has been detected in Bytedesk up to 1.3.9. This impacts the function getModels of the file source-code/src/main/java/com/bytedesk/ai/springai/providers/openrouter/SpringAIOpenrouterRestService.java of the component SpringAIOpenrouterRestController. Such manipulation of the argument apiUrl leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 1.4.5.4 will fix this issue. The name of the patch is 975e39e4dd527596987559f56c5f9f973f64eff7. It is recommended to upgrade the affected component. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

1-Click to Compromise: Critical 9.3 CVSS Flaw in ZITADEL Exposes Accounts to Full Takeover Security researchers have disclosed a high-severity vulnerability in ZITADEL, the popular open-source identity and access management (IAM) platform. The flaw, tracked as CVE-2026-29191 with a CVSS sco ... Read more Published Date: Mar 09, 2026 (1 day, 3 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-29191 CVE-2026-2256 CVE-2025-27507

A weakness has been identified in UltraVNC 1.6.4.0 on Windows. This affects an unknown function in the library cryptbase.dll of the component Windows Service. This manipulation causes uncontrolled search path. The attack requires local access. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID :CVE-2026-3787 Published : March 8, 2026, 11:15 p.m. | 7 hours, 59 minutes ago Description :A weakness has been identified in UltraVNC 1.6.4.0 on Windows. This affects an unknown function in the library cryptbase.dll of the component Windows Service. This manipulation causes uncontrolled search path. The attack requires local access. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 7.3 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-3786 Published : March 8, 2026, 11:15 p.m. | 5 hours, 59 minutes ago Description :A security flaw has been discovered in EasyCMS up to 1.6. The impacted element is an unknown function of the file /RbacuserAction.class.php of the component Request Parameter Handler. The manipulation of the argument _order results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...