News & Sicurezza

CVE ID : CVE-2026-2360 Published : Feb. 11, 2026, 6:16 p.m. | 2 hours, 8 minutes ago Description : PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a custom operator in the public schema and place malicious code in that operator. This operator will later be executed with superuser privileges when the extension is created. The risk is higher with PostgreSQL 14 or with instances upgraded from PostgreSQL 14 or a prior version. With PostgreSQL 15 and later, the creation permission on the public schema is revoked by default and this exploit can only be achieved if a superuser adds a new schema in her/his own search_path and grants the CREATE privilege on that schema to untrusted users, both actions being clearly discouraged by the PostgreSQL documentation. The problem is resolved in PostgreSQL Anonymizer 3.0.1 and further versions Severity: 8.0 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Massive Spike in Attacks Exploiting Ivanti EPMM Systems 0-day Vulnerability Ivanti EPMM 0-day Vulnerability Exploited An unprecedented surge in exploitation attempts targeting CVE-2026-1281, a critical vulnerability in Ivanti Endpoint Manager Mobile (EPMM). On February 9, 202 ... Read more Published Date: Feb 11, 2026 (21 hours, 17 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-1340 CVE-2026-1281

CVE ID : CVE-2026-25084 Published : Feb. 11, 2026, 5:16 p.m. | 1 hour, 8 minutes ago Description : Authentication for ZLAN5143D can be bypassed by directly accessing internal URLs. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-24789 Published : Feb. 11, 2026, 5:16 p.m. | 1 hour, 8 minutes ago Description : An unprotected API endpoint allows an attacker to remotely change the device password without providing authentication. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-65127 Published : Feb. 11, 2026, 5:16 p.m. | 1 hour, 8 minutes ago Description : A lack of session validation in the web API component of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote unauthenticated attackers to access administrative information-retrieval functions intended for authenticated users. By invoking "get_*" operations, attackers can obtain device configuration data, including plaintext credentials, without authentication or an existing session. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-13391 Published : Feb. 11, 2026, 5:16 p.m. | 1 hour, 8 minutes ago Description : The Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'uni_cpo_remove_file' function in all versions up to, and including, 4.9.60. This makes it possible for unauthenticated attackers to delete arbitrary attachments or files stored in Dropbox if the file path is known. The vulnerability was partially patched in version 4.9.60. Severity: 5.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Critical SandboxJS Vulnerability Allows Remote Host Takeover – PoC Released SandboxJS Vulnerability PoC Released A severe sandbox escape vulnerability has been discovered in the JavaScript library, enabling attackers to execute arbitrary code on host systems. The flaw, tracke ... Read more Published Date: Feb 11, 2026 (22 hours, 21 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-25881

Critical UUID Flaw in Fiber v2 on Go 1.24+ Enables Session Hijacking, CSRF Bypass, and Zero-ID DoS Risk UUID Flaw in Fiber v2 on Go A severe vulnerability has been discovered in Fiber v2, a popular Go web framework, that could allow attackers to hijack user sessions, bypass security protections, and cau ... Read more Published Date: Feb 11, 2026 (20 hours, 39 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2025-66630

CVE ID : CVE-2025-64075 Published : Feb. 11, 2026, 4:15 p.m. | 2 hours, 8 minutes ago Description : A path traversal vulnerability in the check_token function of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote attackers to bypass authentication and perform administrative actions by supplying a crafted session cookie value. Severity: 10.0 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Were telcos tipped off to *that* ancient Telnet bug? Cyber pros say the signs stack up Telcos likely received advance warning about January's critical Telnet vulnerability before its public disclosure, according to threat intelligence biz GreyNoise. Global Telnet traffic "fell off a cli ... Read more Published Date: Feb 11, 2026 (21 hours, 19 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-24061

CVE ID : CVE-2026-25869 Published : Feb. 11, 2026, 4:16 p.m. | 2 hours, 8 minutes ago Description : MiniGal Nano versions 0.3.5 and prior contain a path traversal vulnerability in index.php via the dir parameter. The application appends user-controlled input to the photos directory and attempts to prevent traversal by removing dot-dot sequences, but this protection can be bypassed using crafted directory patterns. An attacker can exploit this behavior to cause the application to enumerate and display image files from unintended filesystem locations that are readable by the web server, resulting in unintended information disclosure. Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-25868 Published : Feb. 11, 2026, 4:16 p.m. | 2 hours, 8 minutes ago Description : MiniGal Nano version 0.3.5 and prior contain a reflected cross-site scripting (XSS) vulnerability in index.php via the dir parameter. The application constructs $currentdir from user-controlled input and embeds it into an error message without output encoding, allowing an attacker to supply HTML/JavaScript that is reflected in the response. Successful exploitation can lead to execution of arbitrary script in a victim's browser in the context of the vulnerable application. Severity: 5.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...