News & Sicurezza

CVE ID : CVE-2026-2746 Published : March 4, 2026, 9:15 a.m. | 4 hours, 29 minutes ago Description : SEPPmail Secure Email Gateway before version 15.0.1 does not properly communicate PGP signature verification results, leaving users unable to detect forged emails. Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-27446 Published : March 4, 2026, 9:15 a.m. | 4 hours, 29 minutes ago Description : Missing Authentication for Critical Function (CWE-306) vulnerability in Apache Artemis, Apache ActiveMQ Artemis. An unauthenticated remote attacker can use the Core protocol to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. This could potentially result in message injection into any queue and/or message exfiltration from any queue via the rogue broker. This impacts environments that allow both: - incoming Core protocol connections from untrusted sources to the broker - outgoing Core protocol connections from the broker to untrusted targets This issue affects: - Apache Artemis from 2.50.0 through 2.51.0 - Apache ActiveMQ Artemis from 2.11.0 through 2.44.0. Users are recommended to upgrade to Apache Artemis version 2.52.0, which fixes the issue. The issue can be mitigated by either of the following: - Remove Core protocol support from any acceptor receiving connections from untrusted sources. Incoming Core protocol connections are supported by default via the "artemis" acceptor listening on port 61616. See the "protocols" URL parameter configured for the acceptor. An acceptor URL without this parameter supports all protocols by default, including Core. - Use two-way SSL (i.e. certificate-based authentication) in order to force every client to present the proper SSL certificate when establishing a connection before any message protocol handshake is attempted. This will prevent unauthenticated exploitation of this vulnerability. Severity: 9.3 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-27443 Published : March 4, 2026, 9:15 a.m. | 2 hours, 29 minutes ago Description : SEPPmail Secure Email Gateway before version 15.0.1 does not properly sanitize the headers from S/MIME protected MIME entities, allowing an attacker to control trusted headers. Severity: 8.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-27444 Published : March 4, 2026, 9:15 a.m. | 4 hours, 29 minutes ago Description : SEPPmail Secure Email Gateway before version 15.0.1 incorrectly interprets email addresses in the email headers, causing an interpretation conflict with other mail infrastructure that allows an attacker to fake the source of the email or decrypt it. Severity: 7.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-27445 Published : March 4, 2026, 9:15 a.m. | 4 hours, 29 minutes ago Description : SEPPmail Secure Email Gateway before version 15.0.1 does not properly verify that a PGP signature was generated by the expected key, allowing signature spoofing. Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-27442 Published : March 4, 2026, 9:15 a.m. | 2 hours, 29 minutes ago Description : The GINA web interface in SEPPmail Secure Email Gateway before version 15.0.1 does not properly check attachment filenames in GINA-encrypted emails, allowing an attacker to access files on the gateway. Severity: 9.3 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-1236 Published : March 4, 2026, 9:15 a.m. | 2 hours, 29 minutes ago Description : The Envira Gallery for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'justified_gallery_theme' parameter in all versions up to, and including, 1.12.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Severity: 6.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-27441 Published : March 4, 2026, 9:15 a.m. | 2 hours, 29 minutes ago Description : SEPPmail Secure Email Gateway before version 15.0.1 insufficiently neutralizes the PDF encryption password, allowing OS command execution. Severity: 9.5 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-66168 Published : March 4, 2026, 9:15 a.m. | 2 hours, 29 minutes ago Description : Apache ActiveMQ does not properly validate the remaining length field which may lead to an overflow during the decoding of malformed packets. When this integer overflow occurs, ActiveMQ may incorrectly compute the total Remaining Length and subsequently misinterpret the payload as multiple MQTT control packets which makes the broker susceptible to unexpected behavior when interacting with non-compliant clients. This behavior violates the MQTT v3.1.1 specification, which restricts Remaining Length to a maximum of 4 bytes. The scenario occurs on established connections after the authentication process. Brokers that are not enabling mqtt transport connectors are not impacted. This issue affects Apache ActiveMQ: before 5.19.2, 6.0.0 to 6.1.8, and 6.2.0 Users are recommended to upgrade to version 5.19.2, 6.1.9, or 6.2.1, which fixes the issue. Severity: 5.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

MS-Agent Vulnerability Let Attackers Hijack AI Agent to Gain Full System Control MS-Agent Vulnerability A critical security vulnerability has been discovered in a lightweight framework designed to enable AI agents to perform autonomous tasks.According to a vulnerability note publi ... Read more Published Date: Mar 04, 2026 (1 day ago) Vulnerabilities has been mentioned in this article. CVE-2026-2256 CVE-2026-27970

HPE AutoPass Vulnerability Let Attackers Bypass Authentication Remotely HPE AutoPass Vulnerability A security bulletin has been issued regarding a vulnerability in the AutoPass License Server (APLS) that could allow attackers to remotely bypass authentication controls. Th ... Read more Published Date: Mar 04, 2026 (1 day, 1 hour ago) Vulnerabilities has been mentioned in this article. CVE-2026-23600 CVE-2026-27970

Beveiligingslek in VMware Aria Operations actief gebruikt bij aanvallen Aanvallers maken actief misbruik van een kwetsbaarheid in VMware Aria Operations die remote code execution door ongeauthenticeerde aanvallers mogelijk maakt, zo laat het Amerikaanse cyberagentschap CI ... Read more Published Date: Mar 04, 2026 (1 day, 1 hour ago) Vulnerabilities has been mentioned in this article. CVE-2026-22719 CVE-2025-41244 CVE-2023-20887