News & Sicurezza

A vulnerability has been identified in Simcenter Femap (All versions < V2512), Simcenter Nastran (All versions < V2512). The affected applications contains an out of bounds write vulnerability while parsing specially crafted XDB files. This could allow an attacker to execute code in the context of the current process.

A vulnerability has been identified in NX (All versions < V2512). The affected application contains a data validation vulnerability that could allow an attacker with local access to interfere with internal data during the PDF export process that could potentially lead to arbitrary code execution.

CVE ID : CVE-2026-22923 Published : Feb. 10, 2026, 10:15 a.m. | 4 hours, 6 minutes ago Description : A vulnerability has been identified in NX (All versions Severity: 7.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-23718 Published : Feb. 10, 2026, 10:15 a.m. | 4 hours, 6 minutes ago Description : A vulnerability has been identified in Simcenter Femap (All versions Severity: 7.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-23719 Published : Feb. 10, 2026, 10:15 a.m. | 4 hours, 6 minutes ago Description : A vulnerability has been identified in Simcenter Femap (All versions Severity: 7.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-23716 Published : Feb. 10, 2026, 10:15 a.m. | 4 hours, 6 minutes ago Description : A vulnerability has been identified in Simcenter Femap (All versions Severity: 7.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-23715 Published : Feb. 10, 2026, 10:15 a.m. | 4 hours, 6 minutes ago Description : A vulnerability has been identified in Simcenter Femap (All versions Severity: 7.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-23717 Published : Feb. 10, 2026, 10:15 a.m. | 4 hours, 6 minutes ago Description : A vulnerability has been identified in Simcenter Femap (All versions Severity: 7.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via double HTML-entity encoding in all versions up to, and including, 1.32.0. This is due to the plugin's sanitization function calling `html_entity_decode()` before `wp_kses()`, and then calling `html_entity_decode()` again on output. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page via the 'name_directory_name' and 'name_directory_description' parameters in the public submission form granted they can trick the site administrator into approving their submission or auto-publish is enabled.

A vulnerability has been identified in Polarion V2404 (All versions < V2404.5), Polarion V2410 (All versions < V2410.2). The affected application allows arbitrary JavaScript code be included in document titles. This could allow an authenticated remote attacker to conduct a stored cross-site scripting attack by creating specially crafted document titles that are later viewed by other users of the application.

CVE ID : CVE-2025-40587 Published : Feb. 10, 2026, 10:15 a.m. | 4 hours, 6 minutes ago Description : A vulnerability has been identified in Polarion V2404 (All versions Severity: 7.6 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-1866 Published : Feb. 10, 2026, 10:15 a.m. | 4 hours, 6 minutes ago Description : The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via double HTML-entity encoding in all versions up to, and including, 1.32.0. This is due to the plugin's sanitization function calling `html_entity_decode()` before `wp_kses()`, and then calling `html_entity_decode()` again on output. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page via the 'name_directory_name' and 'name_directory_description' parameters in the public submission form granted they can trick the site administrator into approving their submission or auto-publish is enabled. Severity: 7.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...