News & Sicurezza

CVE ID :CVE-2026-93368 Published : Sept. 23, 2026, 9:17 a.m. | 1 hour, 10 minutes ago Description :The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' (Username) Parameter in all versions up to, and including, 2.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. WordPress core applies wp_unslash() to the 'log' POST value before dispatching the wp_login_failed action, stripping magic-quotes backslash escaping and allowing a raw single quote to reach the plugin's handler unimpeded. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-42801 Published : Sept. 23, 2026, 9:17 a.m. | 1 hour, 10 minutes ago Description :NULL pointer dereference vulnerability in ASR Crane，Falcon on Linux (as_rrc module) allows Pointer Manipulation. This vulnerability is associated with program file 3g.mod/lib/src/urrsir.c. Severity: 7.4 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-31377 Published : Sept. 23, 2026, 9:17 a.m. | 1 hour, 10 minutes ago Description :An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access internal metadata service endpoints. The affected endpoints relied on client-supplied node information for authentication without providing sufficient authentication of the requesting party. Under certain network configurations, a remote attacker may be able to bypass the intended access control and access internal FE metadata interfaces, potentially exposing sensitive cluster information. This issue affects Apache Doris: from 2.0.0 through 2.0.*, from 2.1.0 through 2.1.*, from 3.0.0 through 3.0.*, from 3.1.0 through 3.1.*, from 4.0.0 before 4.0.8, and from 4.1.0 before 4.1.4. Versions 1.2.x and earlier are not affected by this header-trust vulnerability. Users are recommended to upgrade to a fixed release (4.0.8 or 4.1.4), which fixes the issue. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution on the victim's local computer.

CVE ID :CVE-2026-15027 Published : Sept. 23, 2026, 9:17 a.m. | 1 hour, 10 minutes ago Description :CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command execution on the victim's local computer. Severity: 8.8 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CISA en NCSC waarschuwen voor kwetsbaarheid in Arista VeloCloud Het Amerikaanse Cybersecurity and Infrastructure Security Agency (CISA) en het Nederlandse Nationaal Cyber Security Centrum (NCSC) waarschuwen voor een actief aangevallen kwetsbaarheid in Arista VeloC ... Read more Published Date: Sep 23, 2026 (5 days, 1 hour ago) Vulnerabilities has been mentioned in this article. CVE-2026-93952

CVE ID :CVE-2026-73192 Published : Sept. 23, 2026, 9:09 a.m. | 1 hour, 18 minutes ago Description :An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache Sling XSS version 2.4.10 and prior may allow an attacker to perform a reflected cross-site scripting (XSS) attack in every feature using this method. In order to successfully attack an application, the attacker needs to be able to submit a value which is not correctly sanitized by that library. Upgrade to Apache Sling XSS >= 2.4.12 Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

F5 Patches Critical BIG-IP APM Zero-Day Exploited for Unauthenticated RCE on OAuth Servers Attackers are exploiting a critical flaw in F5 BIG-IP Access Policy Manager (APM) that lets them run code on a BIG-IP system without logging in, F5 says. The flaw, CVE-2026-94127, affects only systems ... Read more Published Date: Sep 23, 2026 (5 jours ago) Vulnerabilities has been mentioned in this article. CVE-2026-94127 CVE-2025-53521

Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware A Chinese threat actor codenamed UTA0565 has been observed exploiting the recently disclosed Google Chrome-Microsoft Windows exploit chain as zero-days through fake websites. The attacks, detected on ... Read more Published Date: Sep 23, 2026 (4 jours, 22 heures ago) Vulnerabilities has been mentioned in this article. CVE-2026-87491 CVE-2026-85880 CVE-2026-85046

NCSC waarschuwt voor actief misbruikt zerodaylek in F5 BIG-IP Het Nationaal Cyber Security Centrum (NCSC) waarschuwt organisaties voor een ernstige kwetsbaarheid in F5 BIG-IP Access Policy Manager (APM) die monenteel actief wordt misbruikt. F5 heeft beveiligings ... Read more Published Date: Sep 23, 2026 (4 days, 18 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-94127

CVE ID :CVE-2026-91817 Published : Sept. 23, 2026, 8:17 a.m. | 2 hours, 10 minutes ago Description :A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of wide strings in embedded PDF JavaScript. Insufficient validation of string-deletion ranges can cause an integer underflow, resulting in an out-of-bounds read and application crash. Severity: 6.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-92378 Published : Sept. 23, 2026, 8:17 a.m. | 2 hours, 10 minutes ago Description :A session management vulnerability exists in the Legacy UI Reduced Function Login feature of NT-ware uniFLOW Online. Under specific timing conditions during Service Offline Emergency Mode, a previously authenticated session may be retained after logout, which could allow a subsequent user to be authenticated as the previous user and gain unauthorised limited access to device functionality. Severity: 4.1 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...