News & Sicurezza

Chrome Gemini panel became privilege escalator for rogue extensions Security boffins have discovered a high-severity bug in Google Chrome that allowed malicious extensions to hijack its Gemini Live AI panel and inherit privileges they were never meant to have. The fla ... Read more Published Date: Mar 03, 2026 (1 day, 4 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-0628

CVE ID : CVE-2025-59060 Published : March 3, 2026, 11:16 a.m. | 4 hours, 28 minutes ago Description : Hostname verification bypass issue in Apache Ranger NiFiRegistryClient/NiFiClient is reported in Apache Ranger versions Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-59059 Published : March 3, 2026, 11:16 a.m. | 4 hours, 28 minutes ago Description : Remote Code Execution Vulnerability in NashornScriptEngineCreator is reported in Apache Ranger versions Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

'1300 IceWarp-servers via kritieke kwetsbaarheid op afstand over te nemen' Zo'n dertienhonderd IceWarp-servers die vanaf het internet toegankelijk zijn, waaronder 23 in Nederland, bevatten een kritieke kwetsbaarheid waardoor ze op afstand door ongeauthenticeerde aanvallers v ... Read more Published Date: Mar 03, 2026 (1 day, 2 hours ago) Vulnerabilities has been mentioned in this article. CVE-2025-14500

The WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission data in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE ID : CVE-2026-2568 Published : March 3, 2026, 10:16 a.m. | 5 hours, 28 minutes ago Description : The WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission data in all versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Severity: 7.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-15598 Published : March 3, 2026, 10:16 a.m. | 5 hours, 28 minutes ago Description : A vulnerability was found in Dataease SQLBot up to 1.5.1. This impacts the function validateEmbedded of the file backend/apps/system/middleware/auth.py of the component JWT Token Handler. Performing a manipulation results in improper verification of cryptographic signature. The attack can be initiated remotely. The attack is considered to have high complexity. The exploitability is said to be difficult. The exploit has been made public and could be used. A comment in the source code warns users about using this feature. The vendor was contacted early about this disclosure. Severity: 6.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Android’s March 2026 security patch fixes over 100 flaws, one under targeted exploitation The Android March 2026 security patch addresses vulnerabilities across dozens of components and includes one CVE confirmed under active exploitation. Devices running a patch level of 2026-03-05 or lat ... Read more Published Date: Mar 03, 2026 (1 day, 4 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-0047 CVE-2026-0038 CVE-2026-0037 CVE-2026-0031 CVE-2026-0030 CVE-2026-0028 CVE-2026-0027 CVE-2026-0006 CVE-2026-21385 CVE-2025-48631 CVE-2024-43859

CVE ID : CVE-2026-22886 Published : March 3, 2026, 10:16 a.m. | 5 hours, 28 minutes ago Description : OpenMQ exposes a TCP-based management service (imqbrokerd) that by default requires authentication. However, the product ships with a default administrative account (admin/ admin) and does not enforce a mandatory password change on first use. After the first successful login, the server continues to accept the default password indefinitely without warning or enforcement. In real-world deployments, this service is often left enabled without changing the default credentials. As a result, a remote attacker with access to the service port could authenticate as an administrator and gain full control of the protocol’s administrative features. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Google waarschuwt voor actief aangevallen beveiligingslek in Androidtelefoons Google waarschuwt voor een actief aangevallen kwetsbaarheid in Androidtelefoons, alsmede een kritiek beveiligingslek waardoor toestellen op afstand zonder interactie van gebruikers zijn over te nemen. ... Read more Published Date: Mar 03, 2026 (1 day, 4 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-0006 CVE-2026-21385

Cyber Escalation: Multi-Vector Attacks Surge Following “Operation Epic Fury” In the wake of the massive joint offensive launched by the United States and Israel on February 28, the digital battlefield has seen a sharp escalation in activity. A new report from Unit 42 reveals t ... Read more Published Date: Mar 03, 2026 (1 day, 3 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-2256 CVE-2026-2441 CVE-2026-21509

CVE ID : CVE-2026-1874 Published : March 3, 2026, 7:16 a.m. | 8 hours, 28 minutes ago Description : Always-Incorrect Control Flow Implementation vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP versions 1.106 and prior and Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP all versions allows a remote attacker to cause a denial-of-service (DoS) condition on the products by continuously sending UDP packets to the products. A system reset of the product is required for recovery. Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...