News & Sicurezza

Improper input validation in Power BI allows an authorized attacker to execute code over a network.

Improper certificate validation in Azure Local allows an unauthorized attacker to execute code over a network.

Improper handling of missing special element in .NET allows an unauthorized attacker to perform spoofing over a network.

Buffer over-read in Windows GDI+ allows an unauthorized attacker to deny service over a network.

Improper neutralization of special elements used in a command ('command injection') in Windows Notepad App allows an unauthorized attacker to execute code over a network.

Microsoft Patch Tuesday February 2026 – 54 Vulnerabilities Fixed, Including 6 Zero-days Microsoft Patch Tuesday February 2026 Microsoft released its February 2026 Patch Tuesday updates on February 10, addressing 54 vulnerabilities, including six zero-days across Windows, Office, Azure, a ... Read more Published Date: Feb 10, 2026 (14 hours, 47 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-23655 CVE-2026-21537 CVE-2026-21533 CVE-2026-21531 CVE-2026-21529 CVE-2026-21528 CVE-2026-21527 CVE-2026-21525 CVE-2026-21523 CVE-2026-21522 CVE-2026-21519 CVE-2026-21518 CVE-2026-21517 CVE-2026-21516 CVE-2026-21514 CVE-2026-21513 CVE-2026-21512 CVE-2026-21511 CVE-2026-21510 CVE-2026-21508 CVE-2026-21261 CVE-2026-21260 CVE-2026-21259 CVE-2026-21258 CVE-2026-21257 CVE-2026-21256 CVE-2026-21255 CVE-2026-21253 CVE-2026-21251 CVE-2026-21250

CVE ID : CVE-2026-1996 Published : Feb. 10, 2026, 5:34 p.m. | 47 minutes ago Description : Certain HP OfficeJet Pro printers may be vulnerable to potential denial of service when the IPP requests are mishandled, failing to establish a TCP connection. Severity: 6.9 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-25947 Published : Feb. 10, 2026, 5:32 p.m. | 49 minutes ago Description : Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The vulnerability has been patched in version v2.1.7. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-0651 Published : Feb. 10, 2026, 5:27 p.m. | 54 minutes ago Description : On TP-Link Tapo C260 v1, path traversal is possible due to improper handling of specific GET request paths via https, allowing local unauthenticated probing of filesystem paths. An attacker on the local network can determine whether certain files exists on the device, with no read, write or code execution possibilities. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-25805 Published : Feb. 10, 2026, 5:27 p.m. | 54 minutes ago Description : Zed is a multiplayer code editor. Prior to 0.219.4, Zed does not show with which parameters a tool is being invoked, when asking for allowance. Further it does not show after the tool was being invoked, which parameters were used. Thus, maybe unwanted or even malicious values could be used without the user having a chance to notice it. Patched in Zed Editor 0.219.4 which includes expandable tool call details. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-0652 Published : Feb. 10, 2026, 5:27 p.m. | 54 minutes ago Description : On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands with high impact on confidentiality, integrity and availability. It may cause full device compromise. Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-0653 Published : Feb. 10, 2026, 5:27 p.m. | 54 minutes ago Description : On TP-Link Tapo C260 v1, a guest‑level authenticated user can bypass intended access restrictions by sending crafted requests to a synchronization endpoint. This allows modification of protected device settings despite limited privileges. An attacker may change sensitive configuration parameters without authorization, resulting in unauthorized device state manipulation but not full code execution. Severity: 7.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...