News & Sicurezza

CVE ID : CVE-2025-32061 Published : Feb. 15, 2026, 11:15 a.m. | 13 hours, 18 minutes ago Description : The specific flaw exists within the Bluetooth stack developed by Alps Alpine of the Infotainment ECU manufactured by Bosch. The issue results from the lack of proper boundary validation of user-supplied data, which can result in a stack-based buffer overflow when receiving a specific packet on the established upper layer L2CAP channel. An attacker can leverage this vulnerability to obtain remote code execution on the Infotainment ECU with root privileges. First identified on Nissan Leaf ZE1 manufactured in 2020. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-32060 Published : Feb. 15, 2026, 11:15 a.m. | 11 hours, 18 minutes ago Description : The system suffers from the absence of a kernel module signature verification. If an attacker can execute commands on behalf of root user (due to additional vulnerabilities), then he/she is also able to load custom kernel modules to the kernel space and execute code in the kernel context. Such a flaw can lead to taking control over the entire system. First identified on Nissan Leaf ZE1 manufactured in 2020. Severity: 6.7 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-32059 Published : Feb. 15, 2026, 11:15 a.m. | 11 hours, 18 minutes ago Description : The specific flaw exists within the Bluetooth stack developed by Alps Alpine of the Infotainment ECU manufactured by Bosch. The issue results from the lack of proper boundary validation of user-supplied data, which can result in a stack-based buffer overflow when receiving a specific packet on the established upper layer L2CAP channel. An attacker can leverage this vulnerability to obtain remote code execution on the Infotainment ECU with root privileges. First identified on Nissan Leaf ZE1 manufactured in 2020. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-32058 Published : Feb. 15, 2026, 11:15 a.m. | 3 hours, 16 minutes ago Description : The Infotainment ECU manufactured by Bosch uses a RH850 module for CAN communication. RH850 is connected to infotainment over the INC interface through a custom protocol. There is a vulnerability during processing requests of this protocol on the V850 side which allows an attacker with code execution on the infotainment main SoC to perform code execution on the RH850 module and subsequently send arbitrary CAN messages over the connected CAN bus. First identified on Nissan Leaf ZE1 manufactured in 2020. Severity: 9.3 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Week in review: Exploited newly patched BeyondTrust RCE, United Airlines CISO on building resilience Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: United Airlines CISO on building resilience when disruption is inevitable In this Help Net Security in ... Read more Published Date: Feb 15, 2026 (1 day, 22 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-20700 CVE-2026-20841 CVE-2026-1731 CVE-2026-1281 CVE-2024-12356

The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.0.7. This is due to a missing capability check in the 'save_custom_user_profile_fields' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to supply the 'ec_store_admin_access' parameter during a profile update and gain store manager access to the site.

CVE ID : CVE-2026-1793 Published : Feb. 15, 2026, 4:15 a.m. | 10 hours, 16 minutes ago Description : The Element Pack Addons for Elementor plugin for WordPress is vulnerable to arbitrary file reads in all versions up to, and including, 8.3.17 via the SVG widget and a lack of sufficient file validation in the 'render_svg' function. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-1750 Published : Feb. 15, 2026, 4:15 a.m. | 10 hours, 16 minutes ago Description : The Ecwid by Lightspeed Ecommerce Shopping Cart plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.0.7. This is due to a missing capability check in the 'save_custom_user_profile_fields' function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to supply the 'ec_store_admin_access' parameter during a profile update and gain store manager access to the site. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS (PTR record) spoofing on the 'checkWithoutToken' function in all versions up to, and including, 6.71. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated. Note: This is only exploitable on sites with an invalid API key.

CVE ID : CVE-2026-1490 Published : Feb. 15, 2026, 4:15 a.m. | 10 hours, 16 minutes ago Description : The Spam protection, Anti-Spam, FireWall by CleanTalk plugin for WordPress is vulnerable to unauthorized Arbitrary Plugin Installation due to an authorization bypass via reverse DNS (PTR record) spoofing on the 'checkWithoutToken' function in all versions up to, and including, 6.71. This makes it possible for unauthenticated attackers to install and activate arbitrary plugins which can be leveraged to achieve remote code execution if another vulnerable plugin is installed and activated. Note: This is only exploitable on sites with an invalid API key. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Exploited in the Wild: Critical BeyondTrust Flaw (CVSS 9.9) Opens Door to Network Takeover Image: win3zz A critical vulnerability in widely used remote access software is currently under active attack, with threat actors using the flaw to plant backdoors and scout corporate networks. Arctic ... Read more Published Date: Feb 15, 2026 (1 day, 23 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-2441 CVE-2026-20700 CVE-2026-1731 CVE-2026-24858

Critical Alert: Chrome Zero-Day (CVE-2026-2441) Exploited in the Wild Google has pushed an urgent security update for its Chrome browser, racing to patch a high-severity zero-day vulnerability that is currently being exploited by attackers in the wild. The flaw, tracked ... Read more Published Date: Feb 15, 2026 (2 days, 1 hour ago) Vulnerabilities has been mentioned in this article. CVE-2026-2441 CVE-2026-20700 CVE-2026-24858 CVE-2025-10585 CVE-2025-6558