News & Sicurezza

30-Year-Old Bug: High-Severity libpng Flaw (CVSS 8.3) Exposes Millions of Apps A high-severity vulnerability has been unearthed in libpng, the official and ubiquitous reference library for handling PNG images. The flaw, tracked as CVE-2026-25646, carries a CVSS score of 8.3 and ... Read more Published Date: Feb 10, 2026 (19 hours, 56 minutes ago) Vulnerabilities has been mentioned in this article.

BeyondTrust Remote Support Critical Vulnerability- CVE-2026-1731 February 10, 2026Vulnerability SummaryIdentifier: CVE-2026-1731Severity: Critical (CVSS 4.0 base score ~9.9)Type: Pre-authentication remote code execution (RCE) via OS command injectionAffected Softwa ... Read more Published Date: Feb 10, 2026 (20 hours, 26 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-1731

Triple Threat: Critical Gogs Flaws (CVSS 9.3) Allow RCE & 2FA Bypass A triple threat of security vulnerabilities has been uncovered in Gogs, the popular self-hosted Git service known for its lightweight footprint. The flaws, tracked as CVE-2025-64111, CVE-2025-64175, a ... Read more Published Date: Feb 10, 2026 (22 hours, 18 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-24135 CVE-2025-64175 CVE-2025-64111 CVE-2026-24858 CVE-2026-21509 CVE-2026-20045 CVE-2025-8110

Virtual Invasion: SolarWinds WHD Exploited to Host Hidden QEMU VMs Image: Microsoft In a striking display of “living off the land” gone wrong, threat actors are turning legitimate administrative tools into stealthy backdoors. The Microsoft Defender Research Team has ... Read more Published Date: Feb 10, 2026 (22 hours, 23 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2025-40551 CVE-2025-40536 CVE-2026-24858 CVE-2026-21509 CVE-2026-20045 CVE-2025-26399 CVE-2024-28987

Trust Broken: Critical Keylime Flaw (CVSS 9.4) Disables mTLS Authentication A critical-severity vulnerability has been discovered in Keylime, the open-source tool used by cloud tenants to verify the integrity of their remote systems. Tracked as CVE-2026-1709, the flaw carries ... Read more Published Date: Feb 10, 2026 (22 hours, 27 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-1709 CVE-2026-24858 CVE-2026-21509 CVE-2026-20045

Silent Killer: Black Basta Bundles “BYOVD” Driver to Blind Antivirus The notorious Black Basta ransomware group has upgraded its arsenal with a dangerous new capability, embedding defense evasion tools directly inside its ransomware payload. A new report by The Threat ... Read more Published Date: Feb 10, 2026 (16 hours, 32 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-25592 CVE-2026-24858 CVE-2026-21509 CVE-2026-20045 CVE-2025-68947

CVE-2026-25592: Critical Semantic Kernel Flaw (CVSS 10.0) Allows File Overwrite Microsoft has issued a critical security advisory for developers using its Semantic Kernel .NET SDK, warning of a vulnerability that could allow AI agents to overwrite sensitive files on the host syst ... Read more Published Date: Feb 10, 2026 (16 hours, 36 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-25592 CVE-2026-24858 CVE-2026-21509 CVE-2026-20045 CVE-2025-50151 CVE-2025-49656

The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'WCFM_Settings_Controller::processing' function in all versions up to, and including, 6.7.24. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.

CVE ID : CVE-2026-0845 Published : Feb. 10, 2026, 12:16 a.m. | 2 hours, 5 minutes ago Description : The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the 'WCFM_Settings_Controller::processing' function in all versions up to, and including, 6.7.24. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to update arbitrary options on the WordPress site. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site. Severity: 7.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2026-25544: Critical Payload CMS SQLi (CVSS 9.8) Exposes Admin Tokens A massive security hole has been blown open in Payload, the popular “Next.js native CMS” designed to live directly inside application folders. The vulnerability, tracked as CVE-2026-25544, carries a c ... Read more Published Date: Feb 10, 2026 (16 hours, 48 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-25544 CVE-2026-24858 CVE-2026-21509 CVE-2026-20045

CVE ID : CVE-2026-2258 Published : Feb. 10, 2026, 12:16 a.m. | 2 hours, 5 minutes ago Description : A flaw has been found in aardappel lobster up to 2025.4. Affected by this vulnerability is the function WaveFunctionCollapse in the library dev/src/lobster/wfc.h. Executing a manipulation can lead to memory corruption. The attack can only be executed locally. The exploit has been published and may be used. This patch is called c2047a33e1ac2c42ab7e8704b33f7ea518a11ffd. It is advisable to implement a patch to correct this issue. Severity: 4.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-15147 Published : Feb. 10, 2026, 12:16 a.m. | 2 hours, 5 minutes ago Description : The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.11.8 via the 'WCFMvm_Memberships_Payment_Controller::processing' due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify other users' membership payments. Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...