News & Sicurezza

CVE ID : CVE-2018-25174 Published : March 6, 2026, 1:15 p.m. | 1 hour, 35 minutes ago Description : ABC ERP 0.6.4 contains a cross-site request forgery vulnerability that allows attackers to modify administrator credentials by submitting forged requests to _configurar_perfil.php. Attackers can craft malicious forms or links containing parameters like usuario, contrasena1, contrasena2, nombre, and email to change admin account settings without authentication. Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Amazon AWS-LC Vulnerabilities Allows Attackers to Bypass Certificate Chain Verification Amazon AWS-LC Vulnerabilities Bypass Certificate Chain Verification A critical security bulletin addressing three distinct vulnerabilities in AWS-LC, its open-source, general-purpose cryptographic lib ... Read more Published Date: Mar 06, 2026 (2 days, 21 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-1492 CVE-2026-3338 CVE-2026-3337 CVE-2026-3336

WordPress Membership Plugin Vulnerability Let Attackers Create Admin Accounts WordPress Membership Plugin Vulnerability A critical security flaw, identified as CVE-2026-1492, has been found in the User Registration & Membership plugin for WordPress. This vulnerability allows un ... Read more Published Date: Mar 06, 2026 (2 days, 19 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-1492 CVE-2026-1779

Cisco Patches 48 Firewall Vulnerabilities with Two CVSS 10 Flaws Cisco has issued security updates addressing dozens of vulnerabilities affecting several of its firewall platforms, including Cisco Secure Firewall Adaptive Security Appliance, Cisco Secure Firewall M ... Read more Published Date: Mar 06, 2026 (2 days, 13 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-20131 CVE-2026-20079

INC Ransom’s Franchise Model Is Putting Critical Infrastructure on the Chopping Block When Australia’s cyber watchdog issued a fresh advisory on INC Ransom, security teams worldwide are bound to take note — not because INC is new, but because the group’s business model has quietly made ... Read more Published Date: Mar 06, 2026 (2 days, 13 hours ago) Vulnerabilities has been mentioned in this article. CVE-2024-57727 CVE-2023-48788 CVE-2023-4966 CVE-2023-3519

CVE ID : CVE-2026-1468 Published : March 6, 2026, 11:16 a.m. | 31 minutes ago Description : QuickCMS is vulnerable to Cross-Site Request Forgery across multiple endpoints. An attacker can craft special website, which when visited by the victim, will automatically send a POST request with victim's privileges. This software does not implement any protection against this type of attack. All forms available in this software are potentially vulnerable. The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.8 was tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable. Severity: 5.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Vulnerability in QuickCMS software Vulnerability in QuickCMS software CVE ID CVE-2026-1468 Publication date 06 March 2026 Vendor OpenSolution Product QuickCMS Vulnerable versions 6.8 Vulnerability type (CWE) Cross-Site Request Forgery ... Read more Published Date: Mar 06, 2026 (2 days, 14 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-1468

Iran-Linked MuddyWater Hackers Target U.S. Networks With New Dindoor Backdoor New research from Broadcom's Symantec and Carbon Black Threat Hunter Team has discovered evidence of an Iranian hacking group embedding itself in several U.S. companies' networks, including banks, air ... Read more Published Date: Mar 06, 2026 (2 days, 14 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-20127 CVE-2026-22769 CVE-2025-34067 CVE-2023-6895 CVE-2021-36260 CVE-2021-33044 CVE-2017-7921

CVE ID : CVE-2026-23925 Published : March 6, 2026, 9:15 a.m. | 2 hours, 31 minutes ago Description : An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthorized hosts. Note that the User role is normally not sufficient to create and edit templates/hosts even with write permissions. Severity: 5.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-3589 Published : March 6, 2026, 10:16 a.m. | 1 hour, 31 minutes ago Description : The WooCommerce WordPress plugin from versions 5.4.0 to 10.5.2 does not properly handle batch requests, which could allow unauthenticated users to make a logged in admin call non store/WC REST endpoints, and create arbitrary admin users via a CSRF attack for example. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

March 2026 Patch Tuesday forecast: Is AI security an oxymoron? Developers and analysts are using more AI tools to produce code and to test both the performance and security of the finished products. They are also embedding AI functionality in their products direc ... Read more Published Date: Mar 06, 2026 (2 days, 16 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-28289 CVE-2026-20128 CVE-2026-20122 CVE-2026-20700 CVE-2026-0628

CVE ID : CVE-2026-2330 Published : March 6, 2026, 8:16 a.m. | 3 hours, 31 minutes ago Description : An attacker may access restricted filesystem areas on the device via the CROWN REST interface due to incomplete whitelist enforcement. Certain directories intended for internal testing were not covered by the whitelist and are accessible without authentication. An unauthenticated attacker could place a manipulated parameter file that becomes active after a reboot, allowing modification of critical device settings, including network configuration and application parameters. Severity: 9.4 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...