News & Sicurezza

Keycloak Under Siege: Patch Now to Stop Token Theft and Account Takeovers The popular open-source identity and access management solution Keycloak has released a critical security update, version 26.5.7, addressing a series of vulnerabilities that could allow attackers to b ... Read more Published Date: Apr 06, 2026 (1 day, 2 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-35616 CVE-2026-34838 CVE-2026-4636 CVE-2026-3872 CVE-2026-5281 CVE-2026-3502 CVE-2026-33032 CVE-2026-3429 CVE-2026-21962 CVE-2026-1002 CVE-2025-5777

CVE-2026-34838 (CVSS 10): Critical RCE Flaw Uncovered in GroupOffice CRM In a significant discovery for enterprises and public sector organizations, a critical security vulnerability has been unmasked in GroupOffice, the popular open-source CRM and groupware suite. The fla ... Read more Published Date: Apr 06, 2026 (1 day ago) Vulnerabilities has been mentioned in this article. CVE-2026-34982 CVE-2026-35616 CVE-2026-34838 CVE-2026-5281 CVE-2026-24164 CVE-2026-3502 CVE-2026-33032 CVE-2025-33244 CVE-2026-4681 CVE-2026-21962

CVE ID :CVE-2026-3524 Published : April 6, 2026, 1:17 p.m. | 38 minutes ago Description :Mattermost Plugin Legal Hold versions Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Critical RCE and SQLi Flaws Shatter mbCONNECT24 Industrial Security In a significant alert for the industrial automation sector, CERT@VDE has disclosed a series of high-severity vulnerabilities affecting the mbCONNECT24 and mymbCONNECT24 remote service platforms. Thes ... Read more Published Date: Apr 06, 2026 (1 day, 1 hour ago) Vulnerabilities has been mentioned in this article.

CVE ID :CVE-2026-5659 Published : April 6, 2026, 1 p.m. | 55 minutes ago Description :A vulnerability was found in pytries datrie up to 0.8.3. The affected element is the function Trie.load/Trie.read/Trie.__setstate__ of the file src/datrie.pyx of the component trie File Handler. The manipulation results in deserialization. The attack can be launched remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

⚡ Weekly Recap: Axios Hack, Chrome 0-Day, Fortinet Exploits, Paragon Spyware and More This week had real hits. The key software got tampered with. Active bugs showed up in the tools people use every day. Some attacks didn’t even need much effort because the path was already there. One ... Read more Published Date: Apr 06, 2026 (1 day, 2 hours ago) Vulnerabilities has been mentioned in this article.

CVE ID :CVE-2026-5650 Published : April 6, 2026, 12:16 p.m. | 1 hour, 39 minutes ago Description :A vulnerability was found in code-projects Online Application System for Admission 1.0. Impacted is an unknown function of the file /enrollment/database/oas.sql. Performing a manipulation results in insecure storage of sensitive information. The attack is possible to be carried out remotely. The exploit has been made public and could be used. Severity: 5.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Whitespace Flaw Re-Opens Critical JWT “Algorithm Confusion” Bypass Security researchers have disclosed two major vulnerabilities within fast-jwt, a high-performance library used to implement JSON Web Tokens (JWT). The flaws reveal that even minor oversights in code l ... Read more Published Date: Apr 06, 2026 (1 day, 2 hours ago) Vulnerabilities has been mentioned in this article.

Apache Traffic Server Vulnerabilities Let Attackers Trigger DoS Attack The Apache Software Foundation has released emergency security updates to address two severe vulnerabilities in the Apache Traffic Server (ATS). ATS operates as a high-performance web proxy cache that ... Read more Published Date: Apr 06, 2026 (1 day, 1 hour ago) Vulnerabilities has been mentioned in this article. CVE-2025-65114 CVE-2025-58136

A flaw has been found in code-projects Simple Laundry System 1.0. This vulnerability affects unknown code of the file /userfinishregister.php of the component Parameter Handler. This manipulation of the argument firstName causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used.

A security vulnerability has been detected in code-projects Easy Blog Site 1.0. Affected by this issue is some unknown functionality of the file login.php. The manipulation of the argument username/password leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

A weakness has been identified in projectworlds Car Rental System 1.0. Affected by this vulnerability is an unknown functionality of the file /pay.php of the component Parameter Handler. Executing a manipulation of the argument mpesa can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.