News & Sicurezza

A flaw was found in migration-planner. The agent-API middleware processes JSON Web Tokens (JWTs) for authentication, but its UpdateSourceInventory and UpdateAgentStatus handlers fail to validate the source_id claim within these tokens against the requested source ID. This oversight allows an authenticated attacker with a valid agent token to manipulate data across different tenants, leading to a complete collapse of tenant isolation. This could result in unauthorized overwriting of victim inventory, planting of malicious credential URLs, or corruption of migration assessments.

A flaw was found in migration-planner. An authenticated attacker could exploit an improper access control vulnerability in the `/api/v1/sources/{id}/image-url` endpoint. This flaw allows the attacker to bypass an ownership check and obtain presigned S3 URLs for Open Virtual Appliance (OVA) images belonging to other users. Consequently, the attacker can download OVA images containing sensitive information, such as long-lived agent JSON Web Tokens (JWTs) and source configurations, potentially leading to unauthorized access and modification of the victim's source.

A flaw was found in migration-planner. An authenticated user can exploit this vulnerability by sending a DELETE request to the /api/v1/sources route, which lacks proper authorization and filtering. This allows for the destruction of all customer data, including sources, agents, and assessments, leading to a critical loss of availability and integrity across the entire SaaS platform.

Ivanti, Fortinet, and SAP Release Patches for Multiple Critical Vulnerabilities Fortinet, Ivanti, and SAP have released security updates to address multiple critical security vulnerabilities that could result in arbitrary code execution and information disclosure. The security fl ... Read more Published Date: Jun 10, 2026 (4 days, 18 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-25089 CVE-2026-10523 CVE-2026-10520 CVE-2026-44748 CVE-2026-40128 CVE-2026-27671 CVE-2026-11645 CVE-2026-20230 CVE-2026-23479 CVE-2026-22732

Unpatched Langflow Flaw CVE-2026-5027 Exploited for Unauthenticated RCE A high-severity unpatched security flaw in Langflow, an open-source low-code platform to build artificial intelligence (AI) applications, has come under active exploitation in the wild, according to f ... Read more Published Date: Jun 10, 2026 (4 days, 16 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-11645 CVE-2026-20230 CVE-2026-23479 CVE-2026-5027 CVE-2026-33017 CVE-2026-0770 CVE-2026-21445 CVE-2025-34291

CISA Adds Cisco, Chrome, and Arista Flaws to KEV Catalog Amid Active Exploitation The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added three new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitati ... Read more Published Date: Jun 10, 2026 (4 days, 16 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-11645 CVE-2026-7473 CVE-2026-20245 CVE-2026-20230 CVE-2026-23479

Microsoft komt met update voor actief aangevallen XSS-lek in Exchange Server Microsoft heeft een beveiligingsupdate uitgebracht voor een actief aangevallen cross-site scripting (XSS) lek in Exchange Server en roept organisaties en beheerders op om de patch zo snel mogelijk te ... Read more Published Date: Jun 10, 2026 (3 days, 23 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-42897

CVE ID :CVE-2026-9758 Published : June 10, 2026, 2:16 p.m. | 23 minutes ago Description :Improper comparison with the certificates trusted list in S2OPC allows an attacker well-formed untrusted certificate to be considered trusted Severity: 7.3 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-53441 Published : June 10, 2026, 2:16 p.m. | 23 minutes ago Description :Jenkins 2.483 through 2.567 (both inclusive), LTS 2.492.1 through 2.555.2 (both inclusive) does not escape the user-provided description of a generic offline cause that could be set through the `POST config.xml` API, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-53442 Published : June 10, 2026, 2:16 p.m. | 23 minutes ago Description :Jenkins 2.567 and earlier, LTS 2.555.2 and earlier does not encrypt secrets from POST config.xml submissions before storing them in job configurations unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-52759 Published : June 10, 2026, 2:16 p.m. | 23 minutes ago Description :Ghidra before 12.1.1 contains an uncontrolled memory allocation vulnerability in the Mach-O binary parser that allows attackers to cause denial of service. An attacker can supply a crafted Mach-O binary with an arbitrarily large ncmds load command count value, forcing the parser to allocate excessive heap memory without validating file size, crashing the Ghidra JVM. Severity: 6.7 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-53436 Published : June 10, 2026, 2:16 p.m. | 23 minutes ago Description :Jenkins 2.567 and earlier, LTS 2.555.2 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins when it contains relative path segments (`./` or `../`), allowing attackers to perform phishing attacks. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...