News & Sicurezza

CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution on the victim's local computer.

CVE ID :CVE-2026-15027 Published : Sept. 23, 2026, 9:17 a.m. | 1 hour, 10 minutes ago Description :CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution on the victim's local computer. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CISA en NCSC waarschuwen voor kwetsbaarheid in Arista VeloCloud Het Amerikaanse Cybersecurity and Infrastructure Security Agency (CISA) en het Nederlandse Nationaal Cyber Security Centrum (NCSC) waarschuwen voor een actief aangevallen kwetsbaarheid in Arista VeloC ... Read more Published Date: Sep 23, 2026 (5 days, 1 hour ago) Vulnerabilities has been mentioned in this article. CVE-2026-93952

CVE ID :CVE-2026-73192 Published : Sept. 23, 2026, 9:09 a.m. | 1 hour, 18 minutes ago Description :An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache Sling XSS version 2.4.10 and prior may allow an attacker to perform a reflected cross-site scripting (XSS) attack in every feature using this method. In order to successfully attack an application, the attacker needs to be able to submit a value which is not correctly sanitized by that library. Upgrade to Apache Sling XSS >= 2.4.12 Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM) that lets them run code on a BIG-IP system without logging in, F5 says. The flaw, CVE-2026-94127, affects only systems ... Read more Published Date: Sep 23, 2026 (5 jours ago) Vulnerabilities has been mentioned in this article. CVE-2026-94127 CVE-2025-53521

Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware A Chinese threat actor codenamed UTA0565 has been observed exploiting the recently disclosed Google Chrome-Microsoft Windows exploit chain as zero-days through fake websites. The attacks, detected on ... Read more Published Date: Sep 23, 2026 (4 jours, 22 heures ago) Vulnerabilities has been mentioned in this article. CVE-2026-87491 CVE-2026-85880 CVE-2026-85046

NCSC waarschuwt voor actief misbruikt zerodaylek in F5 BIG-IP Het Nationaal Cyber Security Centrum (NCSC) waarschuwt organisaties voor een ernstige kwetsbaarheid in F5 BIG-IP Access Policy Manager (APM) die monenteel actief wordt misbruikt. F5 heeft beveiligings ... Read more Published Date: Sep 23, 2026 (4 days, 18 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-94127

CVE ID :CVE-2026-92378 Published : Sept. 23, 2026, 8:17 a.m. | 2 hours, 10 minutes ago Description :A session management vulnerability exists in the Legacy UI Reduced Function Login feature of NT-ware uniFLOW Online. Under specific timing conditions during Service Offline Emergency Mode, a previously authenticated session may be retained after logout, which could allow a subsequent user to be authenticated as the previous user and gain unauthorised limited access to device functionality. Severity: 4.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-91818 Published : Sept. 23, 2026, 8:17 a.m. | 2 hours, 10 minutes ago Description :A use-after-free vulnerability exists in Foxit PDF Editor/Reader’s JavaScript handling of PDF annotations. Reentrant page-event processing during annotation enumeration may release the associated page object, which is subsequently accessed, resulting in an application crash. Severity: 7.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-91817 Published : Sept. 23, 2026, 8:17 a.m. | 2 hours, 10 minutes ago Description :A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of wide strings in embedded PDF JavaScript. Insufficient validation of string-deletion ranges can cause an integer underflow, resulting in an out-of-bounds read and application crash. Severity: 6.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-91811 Published : Sept. 23, 2026, 8:17 a.m. | 28 minutes ago Description :A heap-based out-of-bounds write vulnerability exists in Foxit PDF Editor/Reader’s PRC parser due to insufficient validation of vertex indices in triangular fan texture meshes. Successful exploitation could result in memory corruption and an application crash. Severity: 7.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-91810 Published : Sept. 23, 2026, 8:17 a.m. | 28 minutes ago Description :A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed PDF image masks. Inconsistent image metadata may cause incorrect alpha-channel processing during rendering, resulting in an out-of-bounds read and application crash. Severity: 6.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...