News & Sicurezza

CVE ID : CVE-2026-27584 Published : Feb. 24, 2026, 3:21 p.m. | 1 hour, 44 minutes ago Description : Actual is a local-first personal finance tool. Prior to version 26.2.1, missing authentication middleware in the ActualBudget server component allows any unauthenticated user to query the SimpleFIN and Pluggy.ai integration endpoints and read sensitive bank account balance and transaction information. This vulnerability allows an unauthenticated attacker to read the bank account balance and transaction history of ActualBudget users. This vulnerability impacts all ActualBudget Server users with the SimpleFIN or Pluggy.ai integrations configured. The ActualBudget Server instance must be reachable over the network. Version 26.2.1 patches the issue. Severity: 9.2 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-27732 Published : Feb. 24, 2026, 3:21 p.m. | 1 hour, 44 minutes ago Description : WWBN AVideo is an open source video platform. Prior to version 22.0, the `aVideoEncoder.json.php` API endpoint accepts a `downloadURL` parameter and fetches the referenced resource server-side without proper validation or an allow-list. This allows authenticated users to trigger server-side requests to arbitrary URLs (including internal network endpoints). An authenticated attacker can leverage SSRF to interact with internal services and retrieve sensitive data (e.g., internal APIs, metadata services), potentially leading to further compromise depending on the deployment environment. This issue has been fixed in AVideo version 22.0. Severity: 8.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Vulnerability in multiple Finka applications Vulnerability in multiple Finka applications CVE ID CVE-2025-13776 Publication date 24 February 2026 Vendor TIK-SOFT Product Finka-FK, Finka-KPR, Finka-Płace, Finka-Faktura, Finka-Magazyn, Finka-STW V ... Read more Published Date: Feb 24, 2026 (1 day, 1 hour ago) Vulnerabilities has been mentioned in this article. CVE-2025-13776

CVE ID : CVE-2026-3102 Published : Feb. 24, 2026, 3:21 p.m. | 1 hour, 44 minutes ago Description : A vulnerability was determined in exiftool up to 13.49 on macOS. This issue affects the function SetMacOSTags of the file lib/Image/ExifTool/MacOS.pm of the component PNG File Parser. This manipulation of the argument DateTimeOriginal causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 13.50 is capable of addressing this issue. Patch name: e9609a9bcc0d32bd252a709a562fb822d6dd86f7. Upgrading the affected component is recommended. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-3101 Published : Feb. 24, 2026, 3:21 p.m. | 1 hour, 44 minutes ago Description : A vulnerability was found in Intelbras TIP 635G 1.12.3.5. This vulnerability affects unknown code of the component Ping Handler. The manipulation results in os command injection. The attack can be executed remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-27567 Published : Feb. 24, 2026, 2:22 p.m. | 43 minutes ago Description : Payload is a free and open source headless content management system. Prior to 3.75.0, a Server-Side Request Forgery (SSRF) vulnerability exists in Payload's external file upload functionality. When processing external URLs for file uploads, insufficient validation of HTTP redirects could allow an authenticated attacker to access internal network resources. The Payload environment must have at least one collection with `upload` enabled and a user who has `create` access to that upload-enabled collection in order to be vulnerable. An authenticated user with upload collection write permissions could potentially access internal services. Response content from internal services could be retrieved through the application. This vulnerability has been patched in v3.75.0. As a workaround, one may mitigate this vulnerability by disabling external file uploads via the `disableExternalFile` upload collection option, or by restricting `create` access on upload-enabled collections to trusted users only. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2806 Published : Feb. 24, 2026, 2:16 p.m. | 49 minutes ago Description : Uninitialized memory in the Graphics: Text component. This vulnerability affects Firefox Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2805 Published : Feb. 24, 2026, 2:16 p.m. | 49 minutes ago Description : Invalid pointer in the DOM: Core & HTML component. This vulnerability affects Firefox Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2807 Published : Feb. 24, 2026, 2:16 p.m. | 49 minutes ago Description : Memory safety bugs present in Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2795 Published : Feb. 24, 2026, 2:16 p.m. | 49 minutes ago Description : Use-after-free in the JavaScript: GC component. This vulnerability affects Firefox Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2804 Published : Feb. 24, 2026, 2:16 p.m. | 49 minutes ago Description : Use-after-free in the JavaScript: WebAssembly component. This vulnerability affects Firefox Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2803 Published : Feb. 24, 2026, 2:16 p.m. | 49 minutes ago Description : Information disclosure, mitigation bypass in the Settings UI component. This vulnerability affects Firefox Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...