News & Sicurezza

CVE ID : CVE-2026-29122 Published : March 5, 2026, 2:16 a.m. | 3 hours, 28 minutes ago Description : International Data Casting (IDC) SFX2100 satellite receiver comes with the `/bin/date` utility installed with the setuid bit set. This configuration grants elevated privileges to any local user who can execute the binary. A local actor is able to use the GTFObins resource to preform privileged file reads as the root user on the local file system. This allows an actor to be able to read any root read-only files, such as the /etc/shadow file or other configuration/secrets carrier files. Severity: 8.3 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVSS 10.0 Unauthenticated Remote Code Execution in FreeScout (Public Proof-of-Concept Disclosed) Security researchers have uncovered a maximum-score vulnerability in FreeScout, the popular open-source help desk and shared inbox platform. The flaw, tracked as CVE-2026-28289, carries a CVSS score o ... Read more Published Date: Mar 05, 2026 (1 day ago) Vulnerabilities has been mentioned in this article. CVE-2026-28289 CVE-2026-2256 CVE-2025-34158 CVE-2025-52562

Critical Infrastructure Alert: Unauthenticated Flaw in Labkotec Ice Detectors Could Freeze Operations Cybersecurity authorities have issued a stark warning regarding a critical vulnerability in Labkotec’s LID-3300IP, a widely deployed ice detection system integral to the safety and efficiency of wind ... Read more Published Date: Mar 05, 2026 (1 day, 1 hour ago) Vulnerabilities has been mentioned in this article. CVE-2026-1775 CVE-2026-2256 CVE-2026-3179 CVE-2024-9404

Coruna: The High-Powered iOS Exploit Kit Proliferating Across the Global Threat Landscape Coruna iOS exploit kit timeline The Google Threat Intelligence Group (GTIG) has detailed the curtain on “Coruna,” a formidable iOS exploit kit that has transitioned from the hands of commercial survei ... Read more Published Date: Mar 05, 2026 (1 day, 1 hour ago) Vulnerabilities has been mentioned in this article. CVE-2026-2256 CVE-2023-43000 CVE-2025-54309 CVE-2025-20337 CVE-2024-23296 CVE-2024-23225 CVE-2024-23222 CVE-2023-41974 CVE-2022-48503 CVE-2023-38606 CVE-2023-32434 CVE-2023-32409 CVE-2021-30952 CVE-2020-27950 CVE-2020-27932

EV Charging Grid Alert: Critical Flaws Exposed in Everon OCPP Backends Cybersecurity researchers have sounded the alarm on a series of critical vulnerabilities affecting Everon OCPP Backends, the digital infrastructure used to manage electric vehicle (EV) charging statio ... Read more Published Date: Mar 05, 2026 (17 hours, 24 minutes ago) Vulnerabilities has been mentioned in this article.

Suspected North Korean Actors Target the Cryptocurrency Supply Chain Web-app exploitation | Image: Ctrl-Alt-Intel Cybersecurity researchers at Ctrl-Alt-Intel have released a detailed investigation into a systematic campaign targeting the heart of the cryptocurrency ind ... Read more Published Date: Mar 05, 2026 (17 hours, 27 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-2256 CVE-2025-55182

CVE ID : CVE-2026-2836 Published : March 5, 2026, 12:15 a.m. | 5 hours, 29 minutes ago Description : A cache poisoning vulnerability has been found in the Pingora HTTP proxy framework’s default cache key construction. The issue occurs because the default HTTP cache key implementation generates cache keys using only the URI path, excluding critical factors such as the host header (authority). Operators relying on the default are vulnerable to cache poisoning, and cross-origin responses may be improperly served to users. Impact This vulnerability affects users of Pingora's alpha proxy caching feature who relied on the default CacheKey implementation. An attacker could exploit this for: * Cross-tenant data leakage: In multi-tenant deployments, poison the cache so that users from one tenant receive cached responses from another tenant * Cache poisoning attacks: Serve malicious content to legitimate users by poisoning shared cache entries Cloudflare's CDN infrastructure was not affected by this vulnerability, as Cloudflare's default cache key implementation uses multiple factors to prevent cache key poisoning and never made use of the previously provided default. Mitigation: We strongly recommend Pingora users to upgrade to Pingora v0.8.0 or higher, which removes the insecure default cache key implementation. Users must now explicitly implement their own callback that includes appropriate factors such as Host header, origin server HTTP scheme, and other attributes their cache should vary on. Pingora users on previous versions may also remove any of their default CacheKey usage and implement their own that should at minimum include the host header / authority and upstream peer’s HTTP scheme. Severity: 8.4 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

'Hundreds' of Iranian hacking attempts have hit surveillance cameras since the missile strikes Multiple Iranian hacking crews have been targeting internet-connected surveillance cameras across Israel and other Middle Eastern countries since the war started on February 28, according to Check Poi ... Read more Published Date: Mar 04, 2026 (15 hours, 46 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2025-34067 CVE-2023-6895 CVE-2021-36260 CVE-2021-33044 CVE-2017-7921

CVE ID : CVE-2026-2835 Published : March 5, 2026, 12:15 a.m. | 5 hours, 29 minutes ago Description : An HTTP Request Smuggling vulnerability (CWE-444) has been found in Pingora's parsing of HTTP/1.0 and Transfer-Encoding requests. The issue occurs due to improperly allowing HTTP/1.0 request bodies to be close-delimited and incorrect handling of multiple Transfer-Encoding values, allowing attackers to send HTTP/1.0 requests in a way that would desync Pingora’s request framing from backend servers’. Impact This vulnerability primarily affects standalone Pingora deployments in front of certain backends that accept HTTP/1.0 requests. An attacker could craft a malicious payload following this request that Pingora forwards to the backend in order to: * Bypass proxy-level ACL controls and WAF logic * Poison caches and upstream connections, causing subsequent requests from legitimate users to receive responses intended for smuggled requests * Perform cross-user attacks by hijacking sessions or smuggling requests that appear to originate from the trusted proxy IP Cloudflare's CDN infrastructure was not affected by this vulnerability, as its ingress proxy layers forwarded HTTP/1.1 requests only, rejected ambiguous framing such as invalid Content-Length values, and forwarded a single Transfer-Encoding: chunked header for chunked requests. Mitigation: Pingora users should upgrade to Pingora v0.8.0 or higher that fixes this issue by correctly parsing message length headers per RFC 9112 and strictly adhering to more RFC guidelines, including that HTTP request bodies are never close-delimited. As a workaround, users can reject certain requests with an error in the request filter logic in order to stop processing bytes on the connection and disable downstream connection reuse. The user should reject any non-HTTP/1.1 request, or a request that has invalid Content-Length, multiple Transfer-Encoding headers, or Transfer-Encoding header that is not an exact “chunked” string match. S...

CVE ID : CVE-2026-22052 Published : March 5, 2026, 12:15 a.m. | 3 hours, 29 minutes ago Description : ONTAP versions 9.12.1 and higher with S3 NAS buckets are susceptible to an information disclosure vulnerability. Successful exploit could allow an authenticated attacker to view a listing of the contents in a directory for which they lack permission. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2833 Published : March 5, 2026, 12:15 a.m. | 5 hours, 29 minutes ago Description : An HTTP request smuggling vulnerability (CWE-444) was found in Pingora's handling of HTTP/1.1 connection upgrades. The issue occurs when a Pingora proxy reads a request containing an Upgrade header, causing the proxy to pass through the rest of the bytes on the connection to a backend before the backend has accepted the upgrade. An attacker can thus directly forward a malicious payload after a request with an Upgrade header to that backend in a way that may be interpreted as a subsequent request header, bypassing proxy-level security controls and enabling cross-user session hijacking. Impact This vulnerability primarily affects standalone Pingora deployments where a Pingora proxy is exposed to external traffic. An attacker could exploit this to: * Bypass proxy-level ACL controls and WAF logic * Poison caches and upstream connections, causing subsequent requests from legitimate users to receive responses intended for smuggled requests * Perform cross-user attacks by hijacking sessions or smuggling requests that appear to originate from the trusted proxy IP Cloudflare's CDN infrastructure was not affected by this vulnerability, as ingress proxies in the CDN stack maintain proper HTTP parsing boundaries and do not prematurely switch to upgraded connection forwarding mode. Mitigation: Pingora users should upgrade to Pingora v0.8.0 or higher As a workaround, users may return an error on requests with the Upgrade header present in their request filter logic in order to stop processing bytes beyond the request header and disable downstream connection reuse. Severity: 9.3 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-29086 Published : March 4, 2026, 11:16 p.m. | 4 hours, 29 minutes ago Description : Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.12.4, the setCookie() utility did not validate semicolons (;), carriage returns (\r), or newline characters (\n) in the domain and path options when constructing the Set-Cookie header. Because cookie attributes are delimited by semicolons, this could allow injection of additional cookie attributes if untrusted input was passed into these fields. This issue has been patched in version 4.12.4. Severity: 5.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...