News & Sicurezza

CVE ID : CVE-2026-2359 Published : Feb. 27, 2026, 4:16 p.m. | 55 minutes ago Description : Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by dropping connection during file upload, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to receive a patch. No known workarounds are available. Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2750 Published : Feb. 27, 2026, 4:16 p.m. | 55 minutes ago Description : Improper Input Validation vulnerability in Centreon Centreon Open Tickets on Central Server on Linux (Centreon Open Tickets modules).This issue affects Centreon Open Tickets on Central Server: from all before 25.10; 24.10;24.04. Severity: 9.1 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2293 Published : Feb. 27, 2026, 5:16 p.m. | 1 hour, 56 minutes ago Description : A NestJS application using @nestjs/platform-fastify can allow bypass of authentication/authorization middleware when Fastify path-normalization options are enabled. This issue affects nest.Js: 11.1.13. Severity: 8.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2751 Published : Feb. 27, 2026, 2:16 p.m. | 2 hours, 55 minutes ago Description : Blind SQL Injection via unsanitized array keys in Service Dependencies deletion. Vulnerability in Centreon Centreon Web on Central Server on Linux (Service Dependencies modules) allows Blind SQL Injection.This issue affects Centreon Web on Central Server before 25.10.8, 24.10.20, 24.04.24. Severity: 8.3 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-3223 Published : Feb. 27, 2026, 2:16 p.m. | 2 hours, 55 minutes ago Description : Arbitrary file write & potential privilege escalation exploiting zip slip vulnerability in Google Web Designer. Severity: 8.4 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761.

CVE ID : CVE-2025-15498 Published : Feb. 27, 2026, 2:16 p.m. | 2 hours, 55 minutes ago Description : Pro3W CMS if vulnerable to SQL injection attacks. Improper neutralization of input provided into a login form allows an unauthenticated attacker to bypass authentication and gain administrative privileges. This issue was identified in version 1.2.0 of this software. Due to lack of response from the vendor exact version range could not be determined, but the vulnerability should be eliminated in versions released in January 2026 and later. Severity: 9.3 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-10990 Published : Feb. 27, 2026, 2:16 p.m. | 2 hours, 55 minutes ago Description : A flaw was found in REXML. A remote attacker could exploit inefficient regular expression (regex) parsing when processing hex numeric character references (&#x...;) in XML documents. This could lead to a Regular Expression Denial of Service (ReDoS), impacting the availability of the affected component. This issue is the result of an incomplete fix for CVE-2024-49761. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-3327 Published : Feb. 27, 2026, 3:16 p.m. | 1 hour, 55 minutes ago Description : Authenticated Iframe Injection in Dato CMS Web Previews plugin. This vulnerability permits a malicious authenticated user to circumvent the restriction enforced on the configured frontend URL, enabling the loading of arbitrary external resources or origins. This issue affects Web Previews Severity: 4.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

The Good, the Bad and the Ugly in Cybersecurity – Week 9 The Good | Authorities Arrest Hacktivist & Convict L3Harris Insider for Selling Secrets to Russia Spanish authorities have arrested four suspected members of “Anonymous Fénix”, a hacktivist group accu ... Read more Published Date: Feb 27, 2026 (2 days, 23 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-20127 CVE-2022-20775

Critical Trend Micro Apex One Vulnerabilities Allows Malicious Code Execution Trend Micro Apex One Vulnerabilities Trend Micro has released fixes for multiple Apex One vulnerabilities, ranging from High to Critical severity, including management console issues that can lead to ... Read more Published Date: Feb 27, 2026 (3 days ago) Vulnerabilities has been mentioned in this article.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Signum Technology Promotion and Training Inc. Windesk.Fm allows SQL Injection.This issue affects windesk.Fm: through 27022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.