News & Sicurezza

CVE ID : CVE-2026-28772 Published : March 4, 2026, 8:16 a.m. | 1 hour, 28 minutes ago Description : A Reflected Cross-Site Scripting (XSS) vulnerability in the /IDC_Logging/index.cgi endpoint of International Datacasting Corporation (IDC) SFX Series SuperFlex SatelliteReceiver Web Management Interface version 101 allows a remote attacker to execute arbitrary web scripts or HTML. The vulnerability is triggered by sending a crafted payload through the `submitType` parameter, which is reflected directly into the DOM without proper escaping. Severity: 5.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-28771 Published : March 4, 2026, 8:16 a.m. | 1 hour, 28 minutes ago Description : A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /index.cgi endpoint of International Datacasting Corporation (IDC) SFX Series SuperFlex Satellite Receiver Web Management Interface version 101. The application fails to adequately sanitize user-supplied input provided via the `cat` parameter before reflecting it in the HTTP response, allowing a remote attacker to execute arbitrary HTML or JavaScript in the victim's browser context. Severity: 5.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2025 Published : March 4, 2026, 6:16 a.m. | 1 hour, 28 minutes ago Description : The Mail Mint WordPress plugin before 1.19.5 does not have authorization in one of its REST API endpoint, allowing unauthenticated users to call it and retrieve the email addresses of users on the blog Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CISA Warns of VMware Aria Operations Vulnerability Exploited in Attacks VMware Aria Operations Vulnerability A critical vulnerability affecting VMware Aria Operations has been added to the Known Exploited Vulnerabilities (KEV) catalog. Broadcom recently issued a security ... Read more Published Date: Mar 04, 2026 (1 day, 4 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-22719

CISA Adds Actively Exploited VMware Aria Operations Flaw CVE-2026-22719 to KEV Catalog The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a recently disclosed security flaw impacting Broadcom VMware Aria Operations to its Known Exploited Vulnerabilities (K ... Read more Published Date: Mar 04, 2026 (1 day, 3 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-22721 CVE-2026-22720 CVE-2026-22719 CVE-2026-20127 CVE-2026-22769

Critical RCE Vulnerability Discovered in OpenStack Vitrage Root Cause Analysis Service Security researcher Khalil Lemtaffah from Nokia has identified a critical remote code execution (RCE) vulnerability in OpenStack Vitrage, the platform’s dedicated Root Cause Analysis (RCA) service. Th ... Read more Published Date: Mar 04, 2026 (1 day, 4 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-2256 CVE-2026-28370

Coruna Exploit Kit With 23 Exploits Hacked Thousands of iPhones Coruna iOS Exploit Kit Google’s Threat Intelligence Group (GTIG) has uncovered Coruna, a sophisticated iOS exploit kit containing 23 exploits across five full exploit chains that compromised thousands ... Read more Published Date: Mar 04, 2026 (1 day, 4 hours ago) Vulnerabilities has been mentioned in this article. CVE-2023-43000 CVE-2024-23296 CVE-2024-23225 CVE-2024-23222 CVE-2022-48503 CVE-2023-38606 CVE-2023-32434 CVE-2023-32409 CVE-2021-30952

CVE ID : CVE-2026-3242 Published : March 4, 2026, 3:16 a.m. | 4 hours, 28 minutes ago Description : In Concrete CMS below version 9.4.8, a rogue administrator can add stored XSS via the Switch Language block. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks M3dium for reporting. Severity: 4.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-3241 Published : March 4, 2026, 3:16 a.m. | 4 hours, 28 minutes ago Description : In Concrete CMS below version 9.4.8, a stored cross-site scripting (XSS) vulnerability exists in the "Legacy Form" block. An authenticated user with permissions to create or edit forms (e.g., a rogue administrator) can inject a persistent JavaScript payload into the options of a multiple-choice question (Checkbox List, Radio Buttons, or Select Box). This payload is then executed in the browser of any user who views the page containing the form. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks M3dium for reporting. Severity: 4.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2994 Published : March 4, 2026, 3:16 a.m. | 4 hours, 28 minutes ago Description : Concrete CMS below version 9.4.8 is subject to CSRF by a Rogue Administrator using the Anti-Spam Allowlist Group Configuration via group_id parameter which can leads to a security bypass since changes are saved prior to checking the CSRF token. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 2.3 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N. Thanks z3rco for reporting Severity: 2.3 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-3240 Published : March 4, 2026, 3:16 a.m. | 4 hours, 28 minutes ago Description : In Concrete CMS below version 9.4.8, a user with permission to edit a page with element Legacy form can perform a stored XSS attack towards high-privilege accounts via the Question field. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 4.8 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Thanks minhnn42, namdi and quanlna2 from VCSLab-Viettel Cyber Security for reporting. Severity: 4.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CISA adds Qualcomm and VMware Aria to KEV Catalog March 4, 2026The Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog — one affecting multiple Qualcomm chipse ... Read more Published Date: Mar 04, 2026 (1 day, 1 hour ago) Vulnerabilities has been mentioned in this article. CVE-2026-21385 CVE-2026-22719