News & Sicurezza

CVE ID : CVE-2026-2592 Published : Feb. 17, 2026, 5:16 a.m. | 11 hours, 42 minutes ago Description : The Zarinpal Gateway for WooCommerce plugin for WordPress is vulnerable to Improper Access Control to Payment Status Update in all versions up to and including 5.0.16. This is due to the payment callback handler 'Return_from_ZarinPal_Gateway' failing to validate that the authority token provided in the callback URL belongs to the specific order being marked as paid. This makes it possible for unauthenticated attackers to potentially mark orders as paid without proper payment by reusing a valid authority token from a different transaction of the same amount. Severity: 7.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2002 Published : Feb. 17, 2026, 5:16 a.m. | 11 hours, 42 minutes ago Description : The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form_name parameter in all versions up to, and including, 1.50.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The plugin allows admins to give form management permissions to lower level users, which could make this exploitable by users such as subscribers. Severity: 4.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Apache NiFi Flaw (CVE-2026-25903) Lets Users Bypass Restrictions Apache NiFi, the powerhouse engine that automates cybersecurity, observability, event streams, and generative AI data pipelines for thousands of companies worldwide, has disclosed a significant securi ... Read more Published Date: Feb 17, 2026 (1 day, 7 hours ago) Vulnerabilities has been mentioned in this article.

Google Patches First Chrome Zero-Day of 2026 February 17, 2026CVE-2026-2441 is a high-severity use-after-free vulnerability in Google Chrome’s CSS processing component. It affects versions prior to 145.0.7632.75 and allows remote attackers to po ... Read more Published Date: Feb 17, 2026 (1 day, 8 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-2441

CVE ID : CVE-2026-26220 Published : Feb. 17, 2026, 3:16 a.m. | 13 hours, 43 minutes ago Description : LightLLM version 1.1.0 and prior contain an unauthenticated remote code execution vulnerability in PD (prefill-decode) disaggregation mode. The PD master node exposes WebSocket endpoints that receive binary frames and pass the data directly to pickle.loads() without authentication or validation. A remote attacker who can reach the PD master can send a crafted payload to achieve arbitrary code execution. Severity: 9.3 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Hiding in Plain Sight: APT28’s “Operation MacroMaze” Hits European Govs A new cyberespionage campaign attributed to the notorious Russian state-sponsored group APT28 (also known as Fancy Bear or Forest Blizzard) has been uncovered targeting government entities in Western ... Read more Published Date: Feb 17, 2026 (1 day, 10 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-2441 CVE-2026-20700 CVE-2026-21509

The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8.6 via the fc_load_template function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .html files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .html file types can be uploaded and included.

CVE ID : CVE-2025-12062 Published : Feb. 17, 2026, 12:16 a.m. | 14 hours, 42 minutes ago Description : The WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.8.6 via the fc_load_template function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .html files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .html file types can be uploaded and included. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2439 Published : Feb. 16, 2026, 10:22 p.m. | 16 hours, 36 minutes ago Description : Concierge::Sessions versions from 0.8.1 before 0.8.5 for Perl generate insecure session ids. The generate_session_id function in Concierge::Sessions::Base defaults to using the uuidgen command to generate a UUID, with a fallback to using Perl's built-in rand function. Neither of these methods are secure, and attackers are able to guess session_ids that can grant them access to systems. Specifically, * There is no warning when uuidgen fails. The software can be quietly using the fallback rand() function with no warnings if the command fails for any reason. * The uuidgen command will generate a time-based UUID if the system does not have a high-quality random number source, because the call does not explicitly specify the --random option. Note that the system time is shared in HTTP responses. * UUIDs are identifiers whose mere possession grants access, as per RFC 9562. * The output of the built-in rand() function is predictable and unsuitable for security applications. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-15578 Published : Feb. 16, 2026, 10:22 p.m. | 16 hours, 36 minutes ago Description : Maypole versions from 2.10 through 2.13 for Perl generates session ids insecurely. The session id is seeded with the system time (which is available from HTTP response headers), a call to the built-in rand() function, and the PID. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2474 Published : Feb. 16, 2026, 9:22 p.m. | 17 hours, 36 minutes ago Description : Crypt::URandom versions from 0.41 before 0.55 for Perl is vulnerable to a heap buffer overflow in the XS function crypt_urandom_getrandom(). The function does not validate that the length parameter is non-negative. If a negative value (e.g. -1) is supplied, the expression length + 1u causes an integer wraparound, resulting in a zero-byte allocation. The subsequent call to getrandom(data, length, GRND_NONBLOCK) passes the original negative value, which is implicitly converted to a large unsigned value (typically SIZE_MAX). This can result in writes beyond the allocated buffer, leading to heap memory corruption and application crash (denial of service). In common usage, the length argument is typically hardcoded by the caller, which reduces the likelihood of attacker-controlled exploitation. Applications that pass untrusted input to this parameter may be affected. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

The WowRevenue plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check in the 'Notice::install_activate_plugin' function in all versions up to, and including, 2.1.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to install arbitrary plugins on the affected site's server which may make remote code execution possible.