News & Sicurezza

Unpatched ActiveMQ Flaw Leads to Repeat Breach and LockBit Ransomware In the world of cybersecurity, “eviction” is rarely the end of the story. A new case study from The DFIR Report reveals how a persistent threat actor exploited a critical vulnerability in Apache Activ ... Read more Published Date: Feb 25, 2026 (1 day ago) Vulnerabilities has been mentioned in this article. CVE-2026-2441 CVE-2024-36401 CVE-2023-46604

Rooting Out Risk: CISA Warns of Critical 9.1 Severity Flaws in Gardyn Smart Gardening Systems Smart gardening systems are designed to bring the serenity of nature indoors, but a series of critical security vulnerabilities in a popular “plug-and-play” hydroponic kit could be inviting digital in ... Read more Published Date: Feb 25, 2026 (1 day ago) Vulnerabilities has been mentioned in this article.

A weakness has been identified in itsourcecode News Portal Project 1.0. The impacted element is an unknown function of the file /admin/add-category.php. This manipulation of the argument Category causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

CVE ID : CVE-2026-3135 Published : Feb. 25, 2026, 1:16 a.m. | 1 hour, 51 minutes ago Description : A weakness has been identified in itsourcecode News Portal Project 1.0. The impacted element is an unknown function of the file /admin/add-category.php. This manipulation of the argument Category causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-3137 Published : Feb. 25, 2026, 1:16 a.m. | 1 hour, 51 minutes ago Description : A security vulnerability has been detected in CodeAstro Food Ordering System 1.0. This affects an unknown function of the file food_ordering.exe. Such manipulation leads to stack-based buffer overflow. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-67491 Published : Feb. 25, 2026, 1:16 a.m. | 1 hour, 51 minutes ago Description : OpenEMR is a free and open source electronic health records and medical practice management application. Versions 5.0.0.5 through 7.0.3.4 have a stored cross-site scripting vulnerability in the ub04 helper of the billing interface. The variable `$data` is passed in a click event handler enclosed in single quotes without proper sanitization. Thus, despite `json_encode` a malicious user can still inject a payload such as ` ac' > ` to trigger the bug. This vulnerability allows low privileged users to embed malicious JS payloads on the server and perform stored XSS attack. This, in turn makes it possible for malicious users to steal the session cookies and perform unauthorized actions impersonating administrators. Version 7.0.4 patches the issue. Severity: 8.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-27598 Published : Feb. 25, 2026, 1:16 a.m. | 1 hour, 51 minutes ago Description : Dagu is a workflow engine with a built-in Web user interface. In versions up to and including 1.16.7, the `CreateNewDAG` API endpoint (`POST /api/v1/dags`) does not validate the DAG name before passing it to the file store. An authenticated user with DAG write permissions can write arbitrary YAML files anywhere on the filesystem (limited by the process permissions). Since dagu executes DAG files as shell commands, writing a malicious DAG to the DAGs directory of another instance or overwriting config files can lead to remote code execution. Commit e2ed589105d79273e4e6ac8eb31525f765bb3ce4 fixes the issue. Severity: 7.1 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

A security flaw has been discovered in itsourcecode News Portal Project 1.0. The affected element is an unknown function of the file /newsportal/admin/edit-category.php. The manipulation of the argument Category results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

A vulnerability has been found in itsourcecode Document Management System 1.0. This issue affects some unknown processing of the file /loging.php of the component Login. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

CVE ID : CVE-2026-3133 Published : Feb. 25, 2026, 12:16 a.m. | 2 hours, 50 minutes ago Description : A vulnerability has been found in itsourcecode Document Management System 1.0. This issue affects some unknown processing of the file /loging.php of the component Login. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-3134 Published : Feb. 25, 2026, 12:16 a.m. | 2 hours, 50 minutes ago Description : A security flaw has been discovered in itsourcecode News Portal Project 1.0. The affected element is an unknown function of the file /newsportal/admin/edit-category.php. The manipulation of the argument Category results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Stealth & Persistence: MuddyWater’s New Rust-Based Payload Mimics Cloudflare and Reddit While financially motivated cybercrime often dominates the headlines, state-sponsored espionage operates quietly in the background, prioritizing stealth and persistence over quick payouts. A new threa ... Read more Published Date: Feb 25, 2026 (1 day, 2 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-2441 CVE-2026-21509