News & Sicurezza

CVE ID : CVE-2026-28557 Published : Feb. 28, 2026, 10:16 p.m. | 23 hours, 26 minutes ago Description : wpForo Forum 2.4.14 contains a missing capability check vulnerability that allows authenticated users to trigger bulk wpForo usergroup reassignment via the wpforo_synch_roles AJAX handler. Attackers access the usergroups admin page, accessible to any authenticated user, to obtain a nonce, then remap all wpForo usergroups to arbitrary WordPress roles. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-28558 Published : Feb. 28, 2026, 10:16 p.m. | 23 hours, 26 minutes ago Description : wpForo Forum 2.4.14 contains a stored cross-site scripting vulnerability that allows authenticated subscribers to upload SVG files as profile avatars through the avatar upload functionality. Attackers upload a crafted SVG containing CSS injection or JavaScript event handlers that execute in the browsers of any user who views the attacker's profile page. Severity: 6.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-28555 Published : Feb. 28, 2026, 10:16 p.m. | 13 hours, 25 minutes ago Description : wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to close or reopen any forum topic via the wpforo_close_ajax handler. Attackers submit a valid nonce with an arbitrary topic ID to bypass the moderator permission requirement and disrupt forum discussions. Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-28559 Published : Feb. 28, 2026, 10:16 p.m. | 1 day, 1 hour ago Description : wpForo Forum 2.4.14 contains an information disclosure vulnerability that allows unauthenticated users to retrieve private and unapproved forum topics via the global RSS feed endpoint. Attackers request the RSS feed without a forum ID parameter, bypassing the privacy and status WHERE clauses that are only applied when a specific forum ID is present in the query. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-28554 Published : Feb. 28, 2026, 10:16 p.m. | 13 hours, 25 minutes ago Description : wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to approve or unapprove any forum post via the wpforo_approve_ajax AJAX handler. Attackers exploit the nonce-only check by submitting a valid nonce with an arbitrary post ID to bypass moderation controls entirely. Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

ClawJacked Flaw Lets Malicious Sites Hijack Local OpenClaw AI Agents via WebSocket OpenClaw has fixed a high-severity security issue that, if successfully exploited, could have allowed a malicious website to connect to a locally running artificial intelligence (AI) agent and take ov ... Read more Published Date: Feb 28, 2026 (2 days ago) Vulnerabilities has been mentioned in this article. CVE-2026-20127 CVE-2026-26329 CVE-2026-26322 CVE-2026-26319 CVE-2026-22769 CVE-2026-25593 CVE-2026-25475 CVE-2026-25157 CVE-2026-24763

5 IoT Vulnerabilities That Stop Projects and How to Avoid Them A single compromised camera or outdated VPN credential can stall your IoT application development process indefinitely. 75% of IoT initiatives never perform well enough to proceed to the production st ... Read more Published Date: Feb 28, 2026 (2 days, 5 hours ago) Vulnerabilities has been mentioned in this article. CVE-2024-7029

CVE ID : CVE-2026-3010 Published : Feb. 28, 2026, 12:16 p.m. | 23 hours, 25 minutes ago Description : Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimePictra allows Query System for Information.This issue affects TimePictra: from 11.0 through 11.3 SP2. Severity: 9.3 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2844 Published : Feb. 28, 2026, 12:16 p.m. | 23 hours, 25 minutes ago Description : Missing Authentication for Critical Function vulnerability in Microchip TimePictra allows Configuration/Environment Manipulation.This issue affects TimePictra: from 11.0 through 11.3 SP2. Severity: 9.3 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 3.9.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. NOTE: This vulnerability was partially mitigated in versions 3.9.4 and 3.9.6.

CVE ID : CVE-2025-13673 Published : Feb. 28, 2026, 8:15 a.m. | 1 day, 1 hour ago Description : The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to SQL Injection via the 'coupon_code' parameter in all versions up to, and including, 3.9.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. NOTE: This vulnerability was partially mitigated in versions 3.9.4 and 3.9.6. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Metasploit Adds New Modules Targeting Linux RC4, BeyondTrust, and Registry Persistence Metasploit Adds New Modules Targeting Linux RC4 The latest Metasploit update, released on February 27, 2026, brings significant firepower to security professionals and penetration testers. The release ... Read more Published Date: Feb 28, 2026 (2 days, 9 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-2329 CVE-2026-1731 CVE-2024-37032