News & Sicurezza

Axios Vulnerability Let Attackers Triggers DoS Condition and Crash Node.js Servers Axios Vulnerability A high-severity security flaw has been discovered in Axios, one of the most popular HTTP client libraries used in the JavaScript ecosystem. The vulnerability, tracked as CVE-2026-2 ... Read more Published Date: Feb 10, 2026 (14 hours, 52 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-25639

30-Year-Old Libpng Vulnerability Exposes Millions of Systems to Code Execution Attacks libpng Vulnerability Exposes Millions Apps A critical vulnerability has been uncovered in libpng, the official PNG reference library used by practically every operating system and web browser in exist ... Read more Published Date: Feb 10, 2026 (15 hours, 2 minutes ago) Vulnerabilities has been mentioned in this article.

CVE ID : CVE-2024-52334 Published : Feb. 10, 2026, 10:15 a.m. | 4 hours, 6 minutes ago Description : A vulnerability has been identified in syngo.plaza VB30E (All versions Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-24343 Published : Feb. 10, 2026, 10:15 a.m. | 6 hours, 5 minutes ago Description : Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: from 1.7.1 before 1.8.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-23906 Published : Feb. 10, 2026, 10:15 a.m. | 6 hours, 5 minutes ago Description : Affected Products and Versions * Apache Druid * Affected Versions: 0.17.0 through 35.x (all versions prior to 36.0.0) * Prerequisites: * druid-basic-security extension enabled * LDAP authenticator configured * Underlying LDAP server permits anonymous bind Vulnerability Description An authentication bypass vulnerability exists in Apache Druid when using the druid-basic-security extension with LDAP authentication. If the underlying LDAP server is configured to allow anonymous binds, an attacker can bypass authentication by providing an existing username with an empty password. This allows unauthorized access to otherwise restricted Druid resources without valid credentials. The vulnerability stems from improper validation of LDAP authentication responses when anonymous binds are permitted, effectively treating anonymous bind success as valid user authentication. Impact A remote, unauthenticated attacker can: * Gain unauthorized access to the Apache Druid cluster * Access sensitive data stored in Druid datasources * Execute queries and potentially manipulate data * Access administrative interfaces if the bypassed account has elevated privileges * Completely compromise the confidentiality, integrity, and availability of the Druid deployment Mitigation Immediate Mitigation (No Druid Upgrade Required): * Disable anonymous bind on your LDAP server. This prevents the vulnerability from being exploitable and is the recommended immediate action. Resolution * Upgrade Apache Druid to version 36.0.0 or later, which includes fixes to properly reject anonymous LDAP bind attempts. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-14895 Published : Feb. 10, 2026, 10:15 a.m. | 4 hours, 6 minutes ago Description : The PopupKit plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.0. This is due to the plugin not properly verifying that a user is authorized to access the /popup/logs REST API endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read and delete analytics data including device types, browser information, countries, referrer URLs, and campaign metrics. Severity: 5.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-1922 Published : Feb. 10, 2026, 10:15 a.m. | 4 hours, 6 minutes ago Description : The The Events Calendar Shortcode & Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `ecs-list-events` shortcode `message` attribute in all versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Severity: 6.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-23901 Published : Feb. 10, 2026, 10:15 a.m. | 4 hours, 5 minutes ago Description : Observable Timing Discrepancy vulnerability in Apache Shiro. This issue affects Apache Shiro: from 1.*, 2.* before 2.0.7. Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue. Prior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough, that a brute-force attack may be able to tell, by timing the requests only, determine if the request failed because of a non-existent user vs. wrong password. The most likely attack vector is a local attack only. Shiro security model https://shiro.apache.org/security-model.html#username_enumeration discusses this as well. Typically, brute force attack can be mitigated at the infrastructure level. Severity: 1.0 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Server-Side Request Forgery (SSRF) vulnerability in Teknolist Computer Systems Software Publishing Industry and Trade Inc. Okulistik allows Server Side Request Forgery.This issue affects Okulistik: through 21102025.

CVE ID : CVE-2025-11242 Published : Feb. 10, 2026, 9:16 a.m. | 5 hours, 5 minutes ago Description : Server-Side Request Forgery (SSRF) vulnerability in Teknolist Computer Systems Software Publishing Industry and Trade Inc. Okulistik allows Server Side Request Forgery.This issue affects Okulistik: through 21102025. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Dutch Authorities Confirm Ivanti Zero-Day Exploit Exposed Employee Contact Data The Netherlands' Dutch Data Protection Authority (AP) and the Council for the Judiciary confirmed both agencies (Rvdr) have disclosed that their systems were impacted by cyber attacks that exploited t ... Read more Published Date: Feb 10, 2026 (16 hours, 41 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-1340 CVE-2026-1281 CVE-2026-24858 CVE-2026-21509 CVE-2025-8088

Critical SAP Alert: Code Injection (CVSS 9.9) Exposes S/4HANA Databases SAP has released its security update for February 2026, issuing patches for 26 new vulnerabilities across its enterprise ecosystem. Leading the pack is a critical code injection flaw in SAP CRM and SA ... Read more Published Date: Feb 10, 2026 (17 hours, 16 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-23689 CVE-2026-23687 CVE-2026-0509 CVE-2026-0508 CVE-2026-0490 CVE-2026-0488 CVE-2026-0485 CVE-2026-24858 CVE-2026-21509 CVE-2026-20045 CVE-2025-12383 CVE-2025-0070 CVE-2025-0066 CVE-2024-47578