News & Sicurezza

CVE ID : CVE-2025-66630 Published : Feb. 9, 2026, 6:04 p.m. | 17 minutes ago Description : Fiber is an Express inspired web framework written in Go. Before 2.52.11, on Go versions prior to 1.24, the underlying crypto/rand implementation can return an error if secure randomness cannot be obtained. Because no error is returned by the Fiber v2 UUID functions, application code may unknowingly rely on predictable, repeated, or low-entropy identifiers in security-critical pathways. This is especially impactful because many Fiber v2 middleware components (session middleware, CSRF, rate limiting, request-ID generation, etc.) default to using utils.UUIDv4(). This vulnerability is fixed in 2.52.11. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

More than 135,000 OpenClaw instances exposed to internet in latest vibe-coded disaster It's a day with a name ending in Y, so you know what that means: Another OpenClaw cybersecurity disaster. This time around, SecurityScorecard's STRIKE threat intelligence team is sounding the alarm ov ... Read more Published Date: Feb 09, 2026 (21 hours, 31 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-25157 CVE-2026-24763 CVE-2026-25253

CVE ID : CVE-2026-2242 Published : Feb. 9, 2026, 5:02 p.m. | 1 hour, 19 minutes ago Description : A vulnerability was determined in janet-lang janet up to 1.40.1. This impacts the function janetc_if of the file src/core/specials.c. Executing a manipulation can lead to out-of-bounds read. The attack needs to be launched locally. The exploit has been publicly disclosed and may be utilized. This patch is called c43e06672cd9dacf2122c99f362120a17c34b391. It is advisable to implement a patch to correct this issue. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-21419 Published : Feb. 9, 2026, 5:01 p.m. | 1 hour, 20 minutes ago Description : Dell Display and Peripheral Manager (Windows) versions prior to 2.2 contain an Improper Link Resolution Before File Access ('Link Following') vulnerability in the Installer and Service. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges Severity: 6.6 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Hackers Exploiting Ivanti EPMM Devices to Deploy Dormant Backdoors Ivanti EPMM Devices Exploited Hackers are actively exploiting Ivanti Endpoint Manager Mobile (EPMM) appliances to plant “dormant” backdoors that can sit unused for days or weeks. Ivanti recently discl ... Read more Published Date: Feb 09, 2026 (22 hours, 2 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-1340 CVE-2026-1281

CVE ID : CVE-2026-2240 Published : Feb. 9, 2026, 4:16 p.m. | 2 hours, 5 minutes ago Description : A vulnerability has been found in janet-lang janet up to 1.40.1. The impacted element is the function janetc_pop_funcdef of the file src/core/compile.c. Such manipulation leads to out-of-bounds read. The attack must be carried out locally. The exploit has been disclosed to the public and may be used. The name of the patch is 4dd08a4cdef5b1c42d9a2c19fc24412e97ef51d5. A patch should be applied to remediate this issue. Severity: 4.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-24095 Published : Feb. 9, 2026, 4:16 p.m. | 2 hours, 5 minutes ago Description : Improper permission enforcement in Checkmk versions 2.4.0 before 2.4.0p21, 2.3.0 before 2.3.0p43, and 2.2.0 (EOL) allows users with the "Use WATO" permission to access the "Analyze configuration" page by directly navigating to its URL, bypassing the intended "Access analyze configuration" permission check. If these users also have the "Make changes, perform actions" permission, they can perform unauthorized actions such as disabling checks or acknowledging results. Severity: 5.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

NCSC: meerdere organisaties via kritiek Ivanti EPMM-lek gehackt Aanvallers hebben meerdere organisaties via een kritieke kwetsbaarheid in Ivanti EPMM weten te hacken, zo laat het Nationaal Cyber Security Centrum (NCSC) vandaag weten. De Nederlandse overheidsinstan ... Read more Published Date: Feb 09, 2026 (20 hours, 44 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-1340 CVE-2026-1281

CVE ID : CVE-2025-7432 Published : Feb. 9, 2026, 4:07 p.m. | 2 hours, 14 minutes ago Description : DPA countermeasures in Silicon Labs' Series 2 devices are not reseeded under certain conditions. This may allow an attacker to eventually extract secret keys through a DPA attack. Severity: 1.0 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2241 Published : Feb. 9, 2026, 4:02 p.m. | 2 hours, 19 minutes ago Description : A vulnerability was found in janet-lang janet up to 1.40.1. This affects the function os_strftime of the file src/core/os.c. Performing a manipulation results in out-of-bounds read. The attack must be initiated from a local position. The exploit has been made public and could be used. The patch is named 0f285855f0e34f9183956be5f16e045f54626bff. To fix this issue, it is recommended to deploy a patch. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Ransomware group breached SmarterTools via flaw in its SmarterMail deployment SmarterTools, the company behind the popular Microsoft Exchange alternative SmarterMail, has been breached by a ransomware-wielding group that leveraged a recently fixed vulnerability in that solution ... Read more Published Date: Feb 09, 2026 (19 hours, 36 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-24423

CVE ID : CVE-2025-63354 Published : Feb. 9, 2026, 3:16 p.m. | 3 hours, 5 minutes ago Description : Hitron HI3120 v7.2.4.5.2b1 allows stored XSS via the Parental Control option when creating a new filter. The device fails to properly handle inputs, allowing an attacker to inject and execute JavaScript. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...