News & Sicurezza

CVE ID : CVE-2026-2546 Published : Feb. 16, 2026, 9:16 a.m. | 3 hours, 19 minutes ago Description : A security vulnerability has been detected in LigeroSmart up to 6.1.26. The affected element is an unknown function of the file /otrs/index.pl. Such manipulation of the argument SortBy leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet. Severity: 5.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Critical BeyondTrust Vulnerability Exploited in the Wild to Gain Full Domain Control BeyondTrust Vulnerability Exploit A critical vulnerability tracked as CVE-2026-1731 is being actively exploited in the wild, enabling attackers to gain full domain control over affected systems. Threa ... Read more Published Date: Feb 16, 2026 (1 day, 17 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-1731

Google Chrome Fixes Actively Exploited CVE-2026-2441 Bug A critical security vulnerability, CVE-2026-2441, has prompted an urgent out-of-band update for Google Chrome after confirmation that the flaw is being actively exploited. The Hong Kong Computer Emerg ... Read more Published Date: Feb 16, 2026 (1 day, 17 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-2441 CVE-2026-22778 CVE-2023-28461

CVE ID : CVE-2026-2543 Published : Feb. 16, 2026, 7:17 a.m. | 3 hours, 18 minutes ago Description : A vulnerability was identified in vichan-devel vichan up to 5.1.5. This vulnerability affects unknown code of the file inc/mod/pages.php of the component Password Change Handler. The manipulation of the argument Password leads to unverified password change. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 5.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

A weakness has been identified in Total VPN 0.5.29.0 on Windows. Affected by this vulnerability is an unknown functionality of the file C:\Program Files\Total VPN\win-service.exe. Executing a manipulation can lead to unquoted search path. It is possible to launch the attack on the local host. This attack is characterized by high complexity. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.

A security flaw has been discovered in Flos Freeware Notepad2 4.2.22/4.2.23/4.2.24/4.2.25. Affected is an unknown function in the library Msimg32.dll. Performing a manipulation results in uncontrolled search path. Attacking locally is a requirement. The attack's complexity is rated as high. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.

CVE ID : CVE-2026-2542 Published : Feb. 16, 2026, 7:17 a.m. | 3 hours, 18 minutes ago Description : A weakness has been identified in Total VPN 0.5.29.0 on Windows. Affected by this vulnerability is an unknown functionality of the file C:\Program Files\Total VPN\win-service.exe. Executing a manipulation can lead to unquoted search path. It is possible to launch the attack on the local host. This attack is characterized by high complexity. The exploitation appears to be difficult. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 7.3 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2538 Published : Feb. 16, 2026, 7:17 a.m. | 3 hours, 18 minutes ago Description : A security flaw has been discovered in Flos Freeware Notepad2 4.2.22/4.2.23/4.2.24/4.2.25. Affected is an unknown function in the library Msimg32.dll. Performing a manipulation results in uncontrolled search path. Attacking locally is a requirement. The attack's complexity is rated as high. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 7.3 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

New Chrome Zero-Day (CVE-2026-2441) Under Active Attack — Patch Released Google on Friday released security updates for its Chrome browser to address a security flaw that it said has been exploited in the wild. The high-severity vulnerability, tracked as CVE-2026-2441 (CVS ... Read more Published Date: Feb 16, 2026 (1 day, 18 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-2441 CVE-2026-20700 CVE-2026-25049

CVE ID : CVE-2026-2537 Published : Feb. 16, 2026, 6:16 a.m. | 4 hours, 18 minutes ago Description : A vulnerability was identified in Comfast CF-E4 2.6.0.1. This impacts an unknown function of the file /cgi-bin/mbox-config?method=SET&section=ntp_timezone of the component HTTP POST Request Handler. Such manipulation of the argument timestr leads to command injection. The attack may be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 5.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2536 Published : Feb. 16, 2026, 6:16 a.m. | 4 hours, 18 minutes ago Description : A vulnerability was determined in opencc JFlow up to 20260129. This affects the function Imp_Done of the file src/main/java/bp/wf/httphandler/WF_Admin_AttrFlow.java of the component Workflow Engine. This manipulation of the argument File causes xml external entity reference. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-0929 Published : Feb. 16, 2026, 7:17 a.m. | 3 hours, 18 minutes ago Description : The RegistrationMagic WordPress plugin before 6.0.7.2 does not have proper capability checks, allowing subscribers and above to create forms on the site. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...