News & Sicurezza

CVE ID : CVE-2026-3404 Published : March 2, 2026, 2:16 a.m. | 5 hours, 28 minutes ago Description : A flaw has been found in thinkgem JeeSite up to 5.15.1. Impacted is an unknown function of the file /com/jeesite/common/shiro/cas/CasOutHandler.java of the component Endpoint. Executing a manipulation can lead to xml external entity reference. The attack may be performed from remote. Attacks of this nature are highly complex. The exploitability is considered difficult. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 5.0 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-3402 Published : March 2, 2026, 1:16 a.m. | 6 hours, 28 minutes ago Description : A security vulnerability has been detected in PHPGurukul Student Record Management System up to 1.0. This vulnerability affects unknown code of the file /edit-course.php. Such manipulation of the argument Course Short Name leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Severity: 4.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-3401 Published : March 2, 2026, 1:16 a.m. | 6 hours, 28 minutes ago Description : A weakness has been identified in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown part. This manipulation causes session expiration. Remote exploitation of the attack is possible. The complexity of an attack is rather high. It is indicated that the exploitability is difficult. The exploit has been made available to the public and could be used for attacks. Severity: 3.1 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-3403 Published : March 2, 2026, 2:16 a.m. | 5 hours, 28 minutes ago Description : A vulnerability was detected in PHPGurukul Student Record Management System 1.0. This issue affects some unknown processing of the file /edit-subject.php. Performing a manipulation of the argument Subject 1 results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used. Severity: 4.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Critical Backup Flaws Expose Vitess Environments to Complete Takeover Vitess is a cloud-native horizontally-scalable distributed database system that is built around MySQL. It allows organizations to achieve unlimited scaling through generalized sharding, and operators ... Read more Published Date: Mar 02, 2026 (1 day, 2 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-27969 CVE-2026-27965 CVE-2026-2441

Critical 9.8 Flaw in Langflow’s AI CSV Agent Opens a Direct Path to Root Shell Artificial intelligence is making it easier than ever to build complex applications, but a newly discovered vulnerability shows that these same tools can inadvertently leave the front door wide open f ... Read more Published Date: Mar 02, 2026 (1 day, 2 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-27966 CVE-2026-2441 CVE-2025-54135 CVE-2025-54136

Critical Flaws in Vikunja Expose Users to Persistent Account Takeovers Vikunja is a popular open-source, self-hostable to-do application designed to help users organize their tasks using list, Kanban, Gantt, and table views while keeping their data entirely under their o ... Read more Published Date: Mar 02, 2026 (1 day, 2 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-28268 CVE-2026-27575 CVE-2026-2441 CVE-2026-23478

CVE-2026-27728 (CVSS 10): Critical Command Injection Flaw in OneUptime Probe Enables Full Server Takeover If your organization relies on OneUptime to keep a watchful eye on website availability, APIs, and online dashboards, a newly disclosed vulnerability requires your immediate attention. Tracked as CVE- ... Read more Published Date: Mar 02, 2026 (1 day, 1 hour ago) Vulnerabilities has been mentioned in this article. CVE-2026-27728 CVE-2026-2441

Critical Path Traversal Flaw in basic-ftp Exposes Node.js Apps to Arbitrary File Writes With over 18 million downloads, basic-ftp is a cornerstone utility for Node.js developers, offering a robust, Promise-based API for handling FTP, FTPS over TLS, and bulk directory operations. However, ... Read more Published Date: Mar 02, 2026 (1 day, 1 hour ago) Vulnerabilities has been mentioned in this article. CVE-2026-27728 CVE-2026-27699 CVE-2025-62878 CVE-2025-30411 CVE-2026-2441 CVE-2026-1358 CVE-2025-26385 CVE-2026-1453 CVE-2026-23830 CVE-2025-14988 CVE-2026-0994 CVE-2026-0695 CVE-2025-61937 CVE-2025-37186 CVE-2026-21440 CVE-2025-52691 CVE-2025-37164 CVE-2025-59396 CVE-2025-58384 CVE-2025-1316 CVE-1999-0073

A security flaw has been discovered in Tenda AC15 up to 15.13.07.13. Affected by this issue is some unknown functionality of the file /goform/TextEditingConversion. The manipulation of the argument wpapsk_crypto2_4g results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

CVE ID : CVE-2026-3400 Published : March 2, 2026, 12:16 a.m. | 7 hours, 28 minutes ago Description : A security flaw has been discovered in Tenda AC15 up to 15.13.07.13. Affected by this issue is some unknown functionality of the file /goform/TextEditingConversion. The manipulation of the argument wpapsk_crypto2_4g results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. Severity: 9.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Steering the Server: Critical 9.2 Severity SSRF Flaw in Angular SSR Allows Internal Network Probing Developers relying on Angular’s Server-Side Rendering (SSR) capabilities need to double-check their security configurations. A highly critical vulnerability has been disclosed in the Angular SSR reque ... Read more Published Date: Mar 02, 2026 (1 day, 1 hour ago) Vulnerabilities has been mentioned in this article. CVE-2026-27739 CVE-2026-2441 CVE-2026-22610 CVE-2025-59052 CVE-2025-58179 CVE-2025-54370 CVE-2025-6087