News & Sicurezza

An unauthenticated remote attacker can bypass authentication by exploiting insufficient URI validation and using path traversal sequences (e.g., /js/../cgi-bin/post.cgi), gaining unauthorized access to protected CGI endpoints and configuration downloads.

Improper length handling when parsing multiple cookie fields (including TRACKID) allows an unauthenticated remote attacker to send oversized cookie values and trigger a stack buffer overflow, resulting in a denial‑of‑service condition and possible remote code execution.

CVE ID : CVE-2026-22906 Published : Feb. 9, 2026, 8:16 a.m. | 3 hours, 3 minutes ago Description : User credentials are stored using AES‑ECB encryption with a hardcoded key. An unauthenticated remote attacker obtaining the configuration file can decrypt and recover plaintext usernames and passwords, especially when combined with the authentication bypass. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-22904 Published : Feb. 9, 2026, 8:16 a.m. | 3 hours, 3 minutes ago Description : Improper length handling when parsing multiple cookie fields (including TRACKID) allows an unauthenticated remote attacker to send oversized cookie values and trigger a stack buffer overflow, resulting in a denial‑of‑service condition and possible remote code execution. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-22905 Published : Feb. 9, 2026, 8:16 a.m. | 3 hours, 3 minutes ago Description : An unauthenticated remote attacker can bypass authentication by exploiting insufficient URI validation and using path traversal sequences (e.g., /js/../cgi-bin/post.cgi), gaining unauthorized access to protected CGI endpoints and configuration downloads. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-2222 Published : Feb. 9, 2026, 8:16 a.m. | 3 hours, 3 minutes ago Description : A weakness has been identified in code-projects Online Reviewer System 1.0. Affected by this vulnerability is an unknown functionality of the file /system/system/admins/manage/users/btn_functions.php. Executing a manipulation of the argument firstname can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. Severity: 4.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie. This can trigger a stack buffer overflow in the modified lighttpd server, causing it to crash and potentially enabling remote code execution due to missing stack protections.

CVE ID : CVE-2026-22903 Published : Feb. 9, 2026, 8:16 a.m. | 3 hours, 3 minutes ago Description : An unauthenticated remote attacker can send a crafted HTTP request containing an overly long SESSIONID cookie. This can trigger a stack buffer overflow in the modified lighttpd server, causing it to crash and potentially enabling remote code execution due to missing stack protections. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID : CVE-2026-25916 Published : Feb. 9, 2026, 9:16 a.m. | 6 hours, 2 minutes ago Description : Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage. Severity: 4.3 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Critical FortiClientEMS Vulnerability Let Attackers Execute Malicious Code Remotely FortiClientEMS RCE Vulnerability Fortinet has issued a critical security advisory warning administrators to immediately patch instances of FortiClientEMS, its central management solution for endpoint ... Read more Published Date: Feb 09, 2026 (18 hours, 51 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-21643

BeyondTrust Fixes Critical Pre-Auth RCE Vulnerability in Remote Support and PRA BeyondTrust has released updates to address a critical security flaw impacting Remote Support (RS) and Privileged Remote Access (PRA) products that, if successfully exploited, could result in remote c ... Read more Published Date: Feb 09, 2026 (16 hours, 52 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-1731 CVE-2026-24858 CVE-2026-21509 CVE-2025-8088

Singapore Launches Largest-Ever Cyber Defense Operation After UNC3886 Targets All Major Telcos Singapore has launched its largest-ever coordinated cyber defense operation following a highly targeted cyberattack on telecommunications that affected all four of the country’s major telecommunicatio ... Read more Published Date: Feb 09, 2026 (15 hours, 5 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2025-54309