News & Sicurezza

Critical Vulnerabilities in AVideo: From SQL Injection to Remote Code Execution Security researchers have identified two severe vulnerabilities in AVideo, a popular open-source video streaming platform used by content creators and businesses to host and monetize media. These flaw ... Read more Published Date: Mar 04, 2026 (1 day, 1 hour ago) Vulnerabilities has been mentioned in this article.

WordPress Security Alert: Critical Privilege Escalation Flaw in Popular Membership Plugin A massive security hole has been discovered in the User Registration & Membership plugin for WordPress, a popular tool used by over 60,000 websites to manage tiered subscription plans and custom login ... Read more Published Date: Mar 04, 2026 (1 day, 1 hour ago) Vulnerabilities has been mentioned in this article. CVE-2026-1492 CVE-2026-2256 CVE-2026-2441 CVE-2025-4601 CVE-2024-43234 CVE-2024-43153

Critical RCE Flaw in Qwik Framework Allows Server Takeover via Single Request Security researchers have identified a critical vulnerability in Qwik, the popular web framework known for its “instant-on” performance and resumability. The flaw, tracked as CVE-2026-27971, carries a ... Read more Published Date: Mar 04, 2026 (1 day, 1 hour ago) Vulnerabilities has been mentioned in this article. CVE-2026-27971 CVE-2026-2256 CVE-2026-2441

CVE ID : CVE-2026-3076 Published : March 3, 2026, 11:15 p.m. | 8 hours, 29 minutes ago Description : Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-2363. Reason: This candidate is a reservation duplicate of CVE-2026-2363. Notes: All CVE users should reference CVE-2026-2363 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-27971 Published : March 3, 2026, 11:15 p.m. | 6 hours, 29 minutes ago Description : Qwik is a performance focused javascript framework. qwik Severity: 9.2 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-28289 Published : March 3, 2026, 11:15 p.m. | 8 hours, 29 minutes ago Description : FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A patch bypass vulnerability for CVE-2026-27636 in FreeScout 1.8.206 and earlier allows any authenticated user with file upload permissions to achieve Remote Code Execution (RCE) on the server by uploading a malicious .htaccess file using a zero-width space character prefix to bypass the security check. The vulnerability exists in the sanitizeUploadedFileName() function in app/Http/Helper.php. The function contains a Time-of-Check to Time-of-Use (TOCTOU) flaw where the dot-prefix check occurs before sanitization removes invisible characters. This vulnerability is fixed in 1.8.207. Severity: 10.0 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-27932 Published : March 3, 2026, 11:15 p.m. | 6 hours, 29 minutes ago Description : joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In 1.6.2 and earlier, a resource exhaustion vulnerability in joserfc allows an unauthenticated attacker to cause a Denial of Service (DoS) via CPU exhaustion. When the library decrypts a JSON Web Encryption (JWE) token using Password-Based Encryption (PBES2) algorithms, it reads the p2c (PBES2 Count) parameter directly from the token's protected header. This parameter defines the number of iterations for the PBKDF2 key derivation function. Because joserfc does not validate or bound this value, an attacker can specify an extremely large iteration count (e.g., 2^31 - 1), forcing the server to expend massive CPU resources processing a single token. This vulnerability exists at the JWA layer and impacts all high-level JWE and JWT decryption interfaces if PBES2 algorithms are allowed by the application's policy. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-3266 Published : March 3, 2026, 11:15 p.m. | 8 hours, 29 minutes ago Description : Missing Authorization vulnerability in OpenText™ Filr allows Authentication Bypass. The vulnerability could allow unauthenticated users to get XSRF token and do RPC with carefully crafted programs. This issue affects Filr: through 25.1.2. Severity: 8.3 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-27981 Published : March 3, 2026, 11:15 p.m. | 6 hours, 29 minutes ago Description : HomeBox is a home inventory and organization system. Prior to 0.24.0, the authentication rate limiter (authRateLimiter) tracks failed attempts per client IP. It determines the client IP by reading, 1. X-Real-IP header, 2. First entry of X-Forwarded-For header, and 3. r.RemoteAddr (TCP connection address). These headers were read unconditionally. An attacker connecting directly to Homebox could forge any value in X-Real-IP, effectively getting a fresh rate limit identity per request. There is a TrustProxy option in the configuration (Options.TrustProxy, default false), but this option was never read by any middleware or rate limiter code. Additionally, chi's middleware.RealIP was applied unconditionally in main.go, overwriting r.RemoteAddr with the forged header value before it reaches any handler. This vulnerability is fixed in 0.24.0. Severity: 7.4 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-26279 Published : March 3, 2026, 11:15 p.m. | 6 hours, 29 minutes ago Description : Froxlor is open source server administration software. Prior to 2.3.4, a typo in Froxlor's input validation code (== instead of =) completely disables email format checking for all settings fields declared as email type. This allows an authenticated admin to store arbitrary strings in the panel.adminmail setting. This value is later concatenated into a shell command executed as root by a cron job, where the pipe character | is explicitly whitelisted. The result is full root-level Remote Code Execution. This vulnerability is fixed in 2.3.4. Severity: 9.1 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-26272 Published : March 3, 2026, 11:15 p.m. | 6 hours, 29 minutes ago Description : HomeBox is a home inventory and organization system. Prior to 0.24.0-rc.1, a stored cross-site scripting (XSS) vulnerability exists in the item attachment upload functionality. The application does not properly validate or restrict uploaded file types, allowing an authenticated user to upload malicious HTML or SVG files containing executable JavaScript (also, potentially other formats that render scripts). Uploaded attachments are accessible via direct links. When a user accesses such a file in their browser, the embedded JavaScript executes in the context of the application's origin. This vulnerability is fixed in 0.24.0-rc.1. Severity: 4.6 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-27905 Published : March 3, 2026, 11:15 p.m. | 6 hours, 29 minutes ago Description : BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.36, the safe_extract_tarfile() function validates that each tar member's path is within the destination directory, but for symlink members it only validates the symlink's own path, not the symlink's target. An attacker can create a malicious bento/model tar file containing a symlink pointing outside the extraction directory, followed by a regular file that writes through the symlink, achieving arbitrary file write on the host filesystem. This vulnerability is fixed in 1.4.36. Severity: 8.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...