News & Sicurezza

CVE ID : CVE-2026-2899 Published : March 5, 2026, 4:15 a.m. | 1 hour, 29 minutes ago Description : The Fluent Forms Pro Add On Pack plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.1.17. This is due to the `deleteFile()` method in the `Uploader` class lacking nonce verification and capability checks. The AJAX action is registered via `addPublicAjaxAction()` which creates both `wp_ajax_` and `wp_ajax_nopriv_` hooks. This makes it possible for unauthenticated attackers to delete arbitrary WordPress media attachments via the `attachment_id` parameter. Note: The researcher described file deletion via the `path` parameter using `sanitize_file_name()`, but the actual code uses `Protector::decrypt()` for path-based deletion which prevents exploitation. The vulnerability is exploitable via the `attachment_id` parameter instead. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-3034 Published : March 5, 2026, 4:15 a.m. | 1 hour, 29 minutes ago Description : The OoohBoi Steroids for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _ob_spacerat_link, _ob_bbad_link, and _ob_teleporter_link URL parameters in all versions up to, and including, 2.1.24. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user clicks on the injected element. Severity: 6.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

The Fluent Forms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `fluentform_step_form_save_data` AJAX action in all versions up to, and including, 6.1.17. This is due to the draft form submission endpoint being publicly accessible without authentication or nonce verification, combined with insufficient input sanitization and output escaping of form field data. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator views a partial form entry.

CVE ID : CVE-2026-26033 Published : March 5, 2026, 3:15 a.m. | 2 hours, 29 minutes ago Description : UPS Multi-UPS Management Console (MUMC) version 01.06.0001 (A03) contains an Unquoted Search Path or Element (CWE-428) vulnerability, which allows a user with write access to a directory on the system drive to execute arbitrary code with SYSTEM privileges. Severity: 8.4 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-29127 Published : March 5, 2026, 3:15 a.m. | 2 hours, 29 minutes ago Description : The IDC SFX2100 Satellite Receiver sets overly permissive file system permissions on the monitor user's home directory. The directory is configured with permissions 0777, granting read, write, and execute access to all local users on the system, which may cause local privilege escalation depending on conditions of the system due to the presence of highly privileged processes and binaries residing within the affected directory. Severity: 9.2 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-26034 Published : March 5, 2026, 3:15 a.m. | 2 hours, 29 minutes ago Description : UPS Multi-UPS Management Console (MUMC) version 01.06.0001 (A03) contains an Incorrect Default Permissions (CWE-276) vulnerability that allows an attacker to execute arbitrary code with SYSTEM privileges by causing the application to load a specially crafted DLL. Severity: 8.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2024-57854 Published : March 5, 2026, 3:15 a.m. | 2 hours, 29 minutes ago Description : Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator. Version v0.003 switched to use Data::Rand::Obscure instead of Crypt::Random for generation of a random initialisation vectors. Data::Rand::Obscure uses Perl's built-in rand() function, which is not suitable for cryptographic functions. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Under Attack: Cisco Urges Immediate Action as Hackers Actively Exploit SD-WAN Manager Flaws Cisco has issued an urgent update to its security advisory, warning that two vulnerabilities in the Cisco Catalyst SD-WAN Manager are now being actively exploited by hackers in the wild. The vulnerabi ... Read more Published Date: Mar 05, 2026 (1 day, 9 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-2256 CVE-2026-20128 CVE-2026-20122 CVE-2026-20045

Two Perfect 10s: Cisco FMC Under Siege Two unauthenticated remote code execution vulnerabilities — both scoring a perfect 10.0 on the CVSS scale — were disclosed on March 4, 2026 affecting Cisco Secure Firewall Management Center. Either fl ... Read more Published Date: Mar 05, 2026 (1 day, 9 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-20131 CVE-2026-20079

Root Access for All: Critical Auth Bypass Hits Cisco Firewall Management Center Cybersecurity authorities are sounding the alarm on a critical vulnerability in the Cisco Secure Firewall Management Center (FMC). The flaw, tracked as CVE-2026-20079, has been assigned a maximum CVSS ... Read more Published Date: Mar 05, 2026 (1 day, 7 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-20079 CVE-2026-2256 CVE-2025-41672 CVE-2025-20309 CVE-2024-20412

CVE ID : CVE-2026-3381 Published : March 5, 2026, 2:16 a.m. | 3 hours, 28 minutes ago Description : Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib. Compress::Raw::Zlib includes a copy of the zlib library. Compress::Raw::Zlib version 2.220 includes zlib 1.3.2, which addresses findings fron the 7ASecurity audit of zlib. The includes fixs for CVE-2026-27171. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-3257 Published : March 5, 2026, 2:16 a.m. | 3 hours, 28 minutes ago Description : UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite library. UnQLite for Perl embeds the UnQLite library. Version 0.06 and earlier of the Perl module uses a version of the library from 2014 that may be vulnerable to a heap-based overflow. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...