News & Sicurezza

CVE ID : CVE-2026-29124 Published : March 5, 2026, 2:16 a.m. | 3 hours, 28 minutes ago Description : Multiple SUID root-owned binaries are found in /home/monitor/terminal, /home/monitor/kore-terminal, /home/monitor/IDE-DPack/terminal-dpack, and /home/monitor/IDE-DPack/terminal-dpack2 in International Data Casting (IDC) SFX2100 Satellite Receiver, which may lead to local privlidge escalation from the `monitor` user to root Severity: 8.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-29125 Published : March 5, 2026, 2:16 a.m. | 3 hours, 28 minutes ago Description : IDC SFX2100 Satalite Recievers set the `/etc/resolv.conf` file to be world-writable by any local user, allowing DNS resolver tampering that can redirect network communications, facilitate man-in-the-middle attacks, and cause denial of service. Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-29126 Published : March 5, 2026, 2:16 a.m. | 3 hours, 28 minutes ago Description : Incorrect permission assignment (world-writable file) in /etc/udhcpc/default.script in International Data Casting (IDC) SFX2100 Satellite Receiver allows a local unprivileged attacker to potentially execute arbitrary commands with root privileges (local privilege escalation and persistence) via modification of a root-owned, world-writable BusyBox udhcpc DHCP event script, which is executed when a DHCP lease is obtained, renewed, or lost. Severity: 8.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-40926 Published : March 5, 2026, 2:16 a.m. | 3 hours, 29 minutes ago Description : Plack::Middleware::Session::Simple versions through 0.04 for Perl generates session ids insecurely. The default session id generator returns a SHA-1 hash seeded with the built-in rand function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems. Plack::Middleware::Session::Simple is intended to be compatible with Plack::Middleware::Session, which had a similar security issue CVE-2025-40923. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-40931 Published : March 5, 2026, 2:16 a.m. | 3 hours, 29 minutes ago Description : Apache::Session::Generate::MD5 versions through 1.94 for Perl create insecure session id. Apache::Session::Generate::MD5 generates session ids insecurely. The default session id generator returns a MD5 hash seeded with the built-in rand() function, the epoch time, and the PID. The PID will come from a small set of numbers, and the epoch time may be guessed, if it is not leaked from the HTTP Date header. The built-in rand function is unsuitable for cryptographic usage. Predicable session ids could allow an attacker to gain access to systems. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Critical 10.0 CVSS Flaw in pac4j-jwt Lets Hackers Forge Admin Tokens Cybersecurity researchers have uncovered a critical vulnerability in pac4j-jwt, a popular Java-based library used to secure thousands of applications through JSON Web Tokens (JWT). The flaw, tracked a ... Read more Published Date: Mar 05, 2026 (1 day, 5 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-29000 CVE-2026-2256 CVE-2025-41672

Update Chrome Now: Google Patches 3 Critical Flaws and 7 High-Risk Vulnerabilities Google has released an urgent update for the Chrome Stable channel, addressing 10 security vulnerabilities, including three rated as “Critical” and seven rated as “High” severity. The update is rollin ... Read more Published Date: Mar 05, 2026 (1 day, 2 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-3545 CVE-2026-3544 CVE-2026-3543 CVE-2026-3542 CVE-2026-3541 CVE-2026-3540 CVE-2026-3539 CVE-2026-3538 CVE-2026-3537 CVE-2026-3536 CVE-2026-2256 CVE-2026-3062 CVE-2026-2441 CVE-2026-1862 CVE-2026-0628 CVE-2025-11756 CVE-2025-11460 CVE-2025-10201 CVE-2025-10200 CVE-2025-9478

Critical 10.0 CVSS Flaw in Cisco Secure FMC Hands Hackers Root Access to Enterprise Firewalls Cybersecurity researchers have identified a critical vulnerability in Cisco Secure Firewall Management Center (FMC) Software, the administrative “nerve center” used to manage unified security policies ... Read more Published Date: Mar 05, 2026 (1 day, 2 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-20131 CVE-2026-2256 CVE-2026-2441 CVE-2026-20098 CVE-2025-20265 CVE-2025-20115 CVE-2024-20424 CVE-2018-0171

CVE ID : CVE-2026-29123 Published : March 5, 2026, 2:16 a.m. | 3 hours, 28 minutes ago Description : A SUID root-owned binary in /home/xd/terminal/XDTerminal in International Data Casting (IDC) SFX2100 on Linux allows a local actor to potentially preform local privilege escalation depending on conditions of the system via execution of the affected SUID binary. This can be via PATH hijacking, symlink abuse or shared object hijacking. Severity: 8.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-29121 Published : March 5, 2026, 1:15 a.m. | 4 hours, 29 minutes ago Description : International Data Casting (IDC) SFX2100 satellite receiver comes with the `/sbin/ip` utility installed with the setuid bit set. This configuration grants elevated privileges to any local user who can execute the binary. A local actor is able to use the GTFObins resource to preform privileged file reads as the root user on the local file system and may potentially lead to other avenues for preforming privileged actions. Severity: 8.4 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-29122 Published : March 5, 2026, 2:16 a.m. | 3 hours, 28 minutes ago Description : International Data Casting (IDC) SFX2100 satellite receiver comes with the `/bin/date` utility installed with the setuid bit set. This configuration grants elevated privileges to any local user who can execute the binary. A local actor is able to use the GTFObins resource to preform privileged file reads as the root user on the local file system. This allows an actor to be able to read any root read-only files, such as the /etc/shadow file or other configuration/secrets carrier files. Severity: 8.3 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVSS 10.0 Unauthenticated Remote Code Execution in FreeScout (Public Proof-of-Concept Disclosed) Security researchers have uncovered a maximum-score vulnerability in FreeScout, the popular open-source help desk and shared inbox platform. The flaw, tracked as CVE-2026-28289, carries a CVSS score o ... Read more Published Date: Mar 05, 2026 (1 day ago) Vulnerabilities has been mentioned in this article. CVE-2026-28289 CVE-2026-2256 CVE-2025-34158 CVE-2025-52562