News & Sicurezza

Security Alert: Android March 2026 Update Targets Actively Exploited Zero-Day Google has released its most substantial security update in years, addressing a total of 129 vulnerabilities in the March 2026 Android Security Bulletin. The massive patch arrives amid warnings that a ... Read more Published Date: Mar 03, 2026 (1 day, 3 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-2256 CVE-2026-0047 CVE-2026-0038 CVE-2026-0027 CVE-2026-0006 CVE-2026-21385 CVE-2026-2441 CVE-2025-48543 CVE-2025-38352

CVE-2026-2256: Unpatched Flaw in MS-Agent Lets Hackers Hijack AI Assistants We are officially entering the era of the “autonomous agent”—smart AI programs that don’t just chat with you, but actually do things on your computer, like organizing files, searching the web, or runn ... Read more Published Date: Mar 03, 2026 (1 day, 1 hour ago) Vulnerabilities has been mentioned in this article. CVE-2026-2256 CVE-2026-27728 CVE-2026-27699 CVE-2025-62878 CVE-2025-30411 CVE-2026-2441 CVE-2026-1358 CVE-2025-26385 CVE-2026-1453 CVE-2026-23830 CVE-2025-14988 CVE-2026-0994 CVE-2026-0695 CVE-2025-61937 CVE-2025-37186 CVE-2025-52691 CVE-2025-37164 CVE-2025-59396 CVE-2025-58384 CVE-2025-54135 CVE-2025-54136 CVE-2025-1316 CVE-1999-0073

CVE ID : CVE-2026-0754 Published : March 3, 2026, 2:16 a.m. | 11 hours, 28 minutes ago Description : An embedded test key and certificate could be extracted from a Poly Voice device using specialized reverse engineering tools. This extracted certificate could be accepted by a SIP service provider if the service provider does not perform proper validation of the device certificate. Severity: 8.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Beyond the Router: How the Zerobotv9 Botnet is Hijacking Enterprise Automation According to a recent investigation by the Akamai Security Intelligence and Response Team (SIRT), a notorious malware family known as Zerobot has re-emerged with new tricks. This latest iteration, dub ... Read more Published Date: Mar 03, 2026 (1 day, 3 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-2256 CVE-2026-2441 CVE-2025-68613 CVE-2025-7544

High-Severity XSS Flaw in Angular i18n Turns Language Files into Backdoors A newly security flaw was found in the widely used Angular web building platform. Identified as CVE-2026-27970 (and rated as a high-severity 7.6), this vulnerability shows how hackers could easily hid ... Read more Published Date: Mar 03, 2026 (1 day, 3 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-2256 CVE-2026-27970 CVE-2026-27739 CVE-2026-2441 CVE-2026-22610 CVE-2025-59052

From Chat App to Dark Web: How Telegram Became the New Hub for Cybercrime For millions of people around the world, Telegram is a secure and convenient way to chat with friends, follow news channels, or join community groups. However, beneath the surface of everyday messagin ... Read more Published Date: Mar 03, 2026 (1 day, 3 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-2256 CVE-2026-2441 CVE-2024-22394

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 5.2.7. This is due to the plugin allowing users with a LatePoint Agent role, who are creating new customers to set the 'wordpress_user_id' field. This makes it possible for authenticated attackers, with Agent-level access and above, to gain elevated privileges by linking a customer to the arbitrary user ID, including administrators, and then resetting the password.

Bridging the Gap: North Korean APT37 Deploys ‘Ruby Jumper’ to Infiltrate Isolated Air-Gapped Networks In a sophisticated escalation of cyber espionage, the North Korean-linked threat group APT37 (also known as ScarCruft or Ruby Sleet) has been caught deploying a novel toolkit designed to leap over the ... Read more Published Date: Mar 03, 2026 (1 day, 3 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-2256 CVE-2026-2441 CVE-2024-3393

CVE ID : CVE-2026-1566 Published : March 3, 2026, 12:15 a.m. | 13 hours, 28 minutes ago Description : The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 5.2.7. This is due to the plugin allowing users with a LatePoint Agent role, who are creating new customers to set the 'wordpress_user_id' field. This makes it possible for authenticated attackers, with Agent-level access and above, to gain elevated privileges by linking a customer to the arbitrary user ID, including administrators, and then resetting the password. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-1336 Published : March 3, 2026, 12:15 a.m. | 13 hours, 28 minutes ago Description : The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the store_data() and get_chatgpt_api_key() functions in all versions up to, and including, 2.7.5. This makes it possible for unauthenticated attackers to view, modify or delete the plugin's ChatGPT API key. The vulnerability was partially fixed in version 2.7.5 and fully fixed in version 2.7.6 Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2583 Published : March 2, 2026, 11:16 p.m. | 12 hours, 27 minutes ago Description : The Blocksy theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `blocksy_meta` metadata fields in all versions up to, and including, 2.1.30 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Severity: 6.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-3337 Published : March 2, 2026, 10:16 p.m. | 11 hours, 27 minutes ago Description : Observable timing discrepancy in AES-CCM decryption in AWS-LC allows an unauthenticated user to potentially determine authentication tag validity via timing analysis. The impacted implementations are through the EVP CIPHER API: EVP_aes_128_ccm, EVP_aes_192_ccm, and EVP_aes_256_ccm. Customers of AWS services do not need to take action. Applications using AWS-LC should upgrade to AWS-LC version 1.69.0. Severity: 8.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...