News & Sicurezza

CVE ID : CVE-2025-15314 Published : Feb. 10, 2026, 12:16 a.m. | 2 hours, 5 minutes ago Description : Tanium addressed an arbitrary file deletion vulnerability in end-user-cx. Severity: 5.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-15313 Published : Feb. 10, 2026, 12:16 a.m. | 2 hours, 5 minutes ago Description : Tanium addressed an arbitrary file deletion vulnerability in Tanium EUSS. Severity: 5.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-15310 Published : Feb. 10, 2026, 12:16 a.m. | 2 hours, 5 minutes ago Description : Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools. Severity: 7.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-25925 Published : Feb. 9, 2026, 10:16 p.m. | 4 hours, 5 minutes ago Description : PowerDocu contains a Windows GUI executable to perform technical documentations. Prior to 2.4.0, PowerDocu contains a critical security vulnerability in how it parses JSON files within Flow or App packages. The application blindly trusts the $type property in JSON files, allowing an attacker to instantiate arbitrary .NET objects and execute code. This vulnerability is fixed in 2.4.0. Severity: 7.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-25923 Published : Feb. 9, 2026, 10:16 p.m. | 4 hours, 5 minutes ago Description : my little forum is a PHP and MySQL based internet forum that displays the messages in classical threaded view. Prior to 20260208.1, the application fails to filter the phar:// protocol in URL validation, allowing attackers to upload a malicious Phar Polyglot file (disguised as JPEG) via the image upload feature, trigger Phar deserialization through BBCode [img] tag processing, and exploit Smarty 4.1.0 POP chain to achieve arbitrary file deletion. This vulnerability is fixed in 20260208.1. Severity: 8.7 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Someone's attacking SolarWinds WHD to steal high‑privilege credentials - but we don't know who or how Digital intruders exploited buggy SolarWinds Web Help Desk (WHD) instances in December to break into victims' IT environments, move laterally, and steal high-privilege credentials, according to Micros ... Read more Published Date: Feb 09, 2026 (17 hours ago) Vulnerabilities has been mentioned in this article. CVE-2025-40551 CVE-2025-40536 CVE-2025-26399 CVE-2024-28988 CVE-2024-28986

CVE ID : CVE-2026-25808 Published : Feb. 9, 2026, 9:50 p.m. | 31 minutes ago Description : Hollo is a federated single-user microblogging software designed to be federated through ActivityPub. Prior to 0.6.20 and 0.7.2, there is a security vulnerability where DMs and followers-only posts were exposed through the ActivityPub outbox endpoint without authorization. This vulnerability is fixed in 0.6.20 and 0.7.2. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-15316 Published : Feb. 9, 2026, 9:48 p.m. | 33 minutes ago Description : Tanium addressed a local privilege escalation vulnerability in Tanium Server. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-15315 Published : Feb. 9, 2026, 9:48 p.m. | 33 minutes ago Description : Tanium addressed a local privilege escalation vulnerability in Tanium Module Server. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-25807 Published : Feb. 9, 2026, 9:46 p.m. | 35 minutes ago Description : ZAI Shell is an autonomous SysOps agent designed to navigate, repair, and secure complex environments. Prior to 9.0.3, the P2P terminal sharing feature (share start) opens a TCP socket on port 5757 without any authentication mechanism. Any remote attacker can connect to this port using a simple socket script. An attacker who connects to a ZAI-Shell P2P session running in --no-ai mode can send arbitrary system commands. If the host user approves the command without reviewing its contents, the command executes directly with the user's privileges, bypassing all Sentinel safety checks. This vulnerability is fixed in 9.0.3. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2025-15317 Published : Feb. 9, 2026, 9:43 p.m. | 38 minutes ago Description : Tanium addressed an uncontrolled resource consumption vulnerability in Tanium Server. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-25961 Published : Feb. 9, 2026, 10:16 p.m. | 4 hours, 5 minutes ago Description : SumatraPDF is a multi-format reader for Windows. In 3.5.0 through 3.5.2, SumatraPDF's update mechanism disables TLS hostname verification (INTERNET_FLAG_IGNORE_CERT_CN_INVALID) and executes installers without signature checks. A network attacker with any valid TLS certificate (e.g., Let's Encrypt) can intercept the update check request, inject a malicious installer URL, and achieve arbitrary code execution. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...