News & Sicurezza

CVE ID : CVE-2026-25869 Published : Feb. 11, 2026, 4:16 p.m. | 2 hours, 8 minutes ago Description : MiniGal Nano versions 0.3.5 and prior contain a path traversal vulnerability in index.php via the dir parameter. The application appends user-controlled input to the photos directory and attempts to prevent traversal by removing dot-dot sequences, but this protection can be bypassed using crafted directory patterns. An attacker can exploit this behavior to cause the application to enumerate and display image files from unintended filesystem locations that are readable by the web server, resulting in unintended information disclosure. Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-25868 Published : Feb. 11, 2026, 4:16 p.m. | 2 hours, 8 minutes ago Description : MiniGal Nano version 0.3.5 and prior contain a reflected cross-site scripting (XSS) vulnerability in index.php via the dir parameter. The application constructs $currentdir from user-controlled input and embeds it into an error message without output encoding, allowing an attacker to supply HTML/JavaScript that is reflected in the response. Successful exploitation can lead to execution of arbitrary script in a victim's browser in the context of the vulnerable application. Severity: 5.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-12474 Published : Feb. 11, 2026, 4:15 p.m. | 2 hours, 8 minutes ago Description : A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory. This can be done by causing the decoder to reference an outside-image-bound area in a subsequent patches. An incorrect optimization causes the decoder to omit populating those areas. Severity: 2.3 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Micropatches released for Windows Telephony Service Elevation of Privilege Vulnerability (CVE-2024-43626) Our new CVE tracking app has been working hard these days, finding things our poor human eyes were unable or too tired to see. In this case, it alerted us about a vulnerability that was described in a ... Read more Published Date: Feb 11, 2026 (21 hours, 39 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2024-43626 CVE-2024-26230

CVE ID : CVE-2026-1837 Published : Feb. 11, 2026, 4:16 p.m. | 2 hours, 8 minutes ago Description : A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data. This can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags). Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2345 Published : Feb. 11, 2026, 3:16 p.m. | 3 hours, 8 minutes ago Description : Proctorio Chrome Extension is a browser extension used for online proctoring. The extension contains multiple window.addEventListener('message', ...) handlers that do not properly validate the origin of incoming messages. Specifically, an internal messaging bridge processes messages based solely on the presence of a fromWebsite property without verifying the event.origin attribute. Severity: 3.6 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2248 Published : Feb. 11, 2026, 3:16 p.m. | 3 hours, 8 minutes ago Description : METIS WIC devices (versions Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2250 Published : Feb. 11, 2026, 3:16 p.m. | 3 hours, 8 minutes ago Description : The /dbviewer/ web endpoint in METIS WIC devices is exposed without authentication. A remote attacker can access and export the internal telemetry SQLite database containing sensitive operational data. Additionally, the application is configured with debug mode enabled, causing malformed requests to return verbose Django tracebacks that disclose backend source code, local file paths, and system configuration. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2344 Published : Feb. 11, 2026, 3:16 p.m. | 3 hours, 8 minutes ago Description : A vulnerability in Plunet Plunet BusinessManager allows unauthorized actions being performed on behalf of privileged users.This issue affects Plunet BusinessManager: 10.15.1 Severity: 8.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2249 Published : Feb. 11, 2026, 3:16 p.m. | 3 hours, 8 minutes ago Description : METIS DFS devices (versions Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-48518 Published : Feb. 11, 2026, 3:16 p.m. | 3 hours, 8 minutes ago Description : Improper input validation in AMD Graphics Driver could allow a local attacker to write out of bounds, potentially resulting in loss of integrity or denial of service. Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-52541 Published : Feb. 11, 2026, 3:16 p.m. | 3 hours, 8 minutes ago Description : A DLL hijacking vulnerability in Vivado could allow a local attacker to achieve privilege escalation, potentially resulting in arbitrary code execution. Severity: 7.3 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...