News & Sicurezza

CVE ID :CVE-2026-4994 Published : March 28, 2026, 10:16 a.m. | 1 hour, 37 minutes ago Description :A vulnerability was found in wandb OpenUI up to 1.0/3.5-turb. Affected is the function generic_exception_handler of the file backend/openui/server.py of the component APIStatusError Handler. The manipulation of the argument key results in information exposure through error message. Access to the local network is required for this attack. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 5.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-4993 Published : March 28, 2026, 10:16 a.m. | 1 hour, 37 minutes ago Description :A vulnerability has been found in wandb OpenUI up to 0.0.0.0/1.0. This impacts an unknown function of the file backend/openui/config.py. The manipulation of the argument LITELLM_MASTER_KEY leads to hard-coded credentials. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Severity: 3.3 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Citrix NetScaler Under Active Recon for CVE-2026-3055 (CVSS 9.3) Memory Overread Bug A recently disclosed critical security flaw impacting Citrix NetScaler ADC and NetScaler Gateway is witnessing active reconnaissance activity, according to Defused Cyber and watchTowr. The vulnerabili ... Read more Published Date: Mar 28, 2026 (7 hours, 41 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-3055 CVE-2025-7775 CVE-2025-6543 CVE-2025-5777 CVE-2023-4966

Attackers are exploiting RCE vulnerability in BIG-IP APM systems (CVE-2025-53521) A critical unauthenticated remote code execution vulnerability (CVE-2025-53521) in F5’s BIG-IP Access Policy Manager (APM) solution is under active exploitation, the US Cybersecurity and Infrastructur ... Read more Published Date: Mar 28, 2026 (7 hours, 50 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-33634 CVE-2026-33017 CVE-2025-53521

NCSC waarschuwt voor actief misbruik van kritiek beveiligingslek in F5 BIG-IP Het Nationaal Cyber Security Centrum (NCSC) waarschuwt organisaties voor actief misbruik van een kritieke kwetsbaarheid in F5 BIG-IP-producten waardoor remote code execution mogelijk is. F5 kwam afgel ... Read more Published Date: Mar 28, 2026 (8 hours, 52 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2025-53521

CVE ID :CVE-2026-23399 Published : March 28, 2026, 8:15 a.m. | 3 hours, 37 minutes ago Description :In the Linux kernel, the following vulnerability has been resolved: nf_tables: nft_dynset: fix possible stateful expression memleak in error path If cloning the second stateful expression in the element via GFP_ATOMIC fails, then the first stateful expression remains in place without being released. unreferenced object (percpu) 0x607b97e9cab8 (size 16): comm "softirq", pid 0, jiffies 4294931867 hex dump (first 16 bytes on cpu 3): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 backtrace (crc 0): pcpu_alloc_noprof+0x453/0xd80 nft_counter_clone+0x9c/0x190 [nf_tables] nft_expr_clone+0x8f/0x1b0 [nf_tables] nft_dynset_new+0x2cb/0x5f0 [nf_tables] nft_rhash_update+0x236/0x11c0 [nf_tables] nft_dynset_eval+0x11f/0x670 [nf_tables] nft_do_chain+0x253/0x1700 [nf_tables] nft_do_chain_ipv4+0x18d/0x270 [nf_tables] nf_hook_slow+0xaa/0x1e0 ip_local_deliver+0x209/0x330 Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-1307 Published : March 28, 2026, 7:15 a.m. | 4 hours, 37 minutes ago Description :The Ninja Forms - The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.14.1 via a callback function for the admin_enqueue_scripts action handler in blocks/bootstrap.php. This makes it possible for authenticated attackers, with Contributor-level access and above, to gain access to an authorization token to view form submissions for arbitrary forms, which could potentially contain sensitive information. Severity: 6.5 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CISA Adds CVE-2025-53521 to KEV After Active F5 BIG-IP APM Exploitation The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added a critical security flaw impacting F5 BIG-IP Access Policy Manager (APM) to its Known Exploited Vulnerabilities (KEV) c ... Read more Published Date: Mar 28, 2026 (9 hours, 45 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2025-53521

CVE ID :CVE-2025-15445 Published : March 28, 2026, 6:16 a.m. | 5 hours, 37 minutes ago Description :The Restaurant Cafeteria WordPress theme through 0.4.6 exposes insecure admin-ajax actions without nonce or capability checks, allowing any logged-in user, like subscriber, to perform privileged operations. An attacker can install and activate a from a user-supplied URL, leading to arbitrary PHP code execution, and also import demo content that rewrites site configuration, including Restaurant Cafeteria WordPress theme through 0.4.6_mods, pages, menus, and front page settings. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CISA Adds CVE-2025-53521 F5 BIG-IP APM to KEV CISA has added CVE-2025-53521 to its Known Exploited Vulnerabilities catalog, designating it as actively exploited in the wild. Federal agencies under BOD 22-01 have until March 30, 2026 to patch or i ... Read more Published Date: Mar 28, 2026 (11 hours, 39 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2025-53521

The Oxygen Theme theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.8 via the laborator_calc_route AJAX action. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

CVE ID :CVE-2025-12886 Published : March 28, 2026, 4:16 a.m. | 7 hours, 36 minutes ago Description :The Oxygen Theme theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.8 via the laborator_calc_route AJAX action. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Severity: 7.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...