News & Sicurezza

CVE ID :CVE-2026-24067 Published : June 10, 2026, 12:16 p.m. | 22 minutes ago Description :Slate Digital Connect 1.37.0 for macOS installs a privileged helper tool, com.slatedigital.connect.privileged.helper.tool, which exposes the XPC service com.slatedigital.connect.privileged.helper.tool2. The helper validates connecting XPC clients by obtaining the client's process identifier and using it to retrieve code-signing information for the process. This PID-based client validation is subject to a time-of-check time-of-use race condition because process identifiers can be reused. A local attacker can exploit PID reuse so that validation is performed against a trusted process instead of the original connecting process. This allows unauthorized access to privileged helper functionality and may lead to local privilege escalation. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

NCSC verwacht misbruik Ivanti-lekken na blogpost cybersecuritybedrijf Het Nationaal Cyber Security Centrum (NCSC) verwacht dat aanvallers misbruik zullen maken van kritieke kwetsbaarheden in Ivanti Sentry nadat cybersecuritybedrijf watchTowr een blogpost met details ove ... Read more Published Date: Jun 10, 2026 (2 days, 8 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-10523 CVE-2026-10520

Vulnerability in Aix-DB software Vulnerability in Aix-DB software CVE ID CVE-2026-8335 Publication date 10 June 2026 Vendor Aix-DB Product Aix-DB Vulnerable versions All through 1.2.4 Vulnerability type (CWE) Missing Authentication f ... Read more Published Date: Jun 10, 2026 (2 days, 8 hours ago) Vulnerabilities has been mentioned in this article.

The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscriber_id’ parameter in all versions up to, and including, 4.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

CVE ID :CVE-2026-11853 Published : June 10, 2026, 10:16 a.m. | 2 hours, 22 minutes ago Description :Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Debian source packages (.dsc) and upload artifacts (.changes) are manifest files that name the files that make up the artifact. The parser used to read these files in Debusine accepted arbitrary fully user-controlled paths. The mergeuploads task could be abused to create arbitrary symbolic links on a worker, overwriting any file that the worker user has access to. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-3018 Published : June 10, 2026, 10:16 a.m. | 2 hours, 22 minutes ago Description :The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘wpmlsubscriber_id’ parameter in all versions up to, and including, 4.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Severity: 7.5 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-11852 Published : June 10, 2026, 10:16 a.m. | 2 hours, 22 minutes ago Description :Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Files managed by debusine are organized into artifacts. The endpoints that create and delete relationships between artifacts enforced no permissions checks beyond being able to see the artifacts in question. Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

The Doctreat Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.6.8. This is due to the doctreat_process_registration() function not properly restricting the roles that a user can register with. This makes it possible for unauthenticated attackers to register as an administrator user.

CVE ID :CVE-2025-6254 Published : June 10, 2026, 10:16 a.m. | 2 hours, 22 minutes ago Description :The Doctreat Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.6.8. This is due to the doctreat_process_registration() function not properly restricting the roles that a user can register with. This makes it possible for unauthenticated attackers to register as an administrator user. Severity: 9.8 | CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Microsoft Patches Record 206 Flaws, Including Three Zero-Days and Critical RCE Bugs Microsoft on Tuesday released fixes for a record 206 security vulnerabilities impacting its software portfolio, including three flaws that have been publicly disclosed at the time of release. Of the 2 ... Read more Published Date: Jun 10, 2026 (1 day, 23 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-8863 CVE-2026-50507 CVE-2026-49160 CVE-2026-47291 CVE-2026-45658 CVE-2026-45657 CVE-2026-45655 CVE-2026-45586 CVE-2026-44815 CVE-2025-10263 CVE-2026-11645 CVE-2026-20230 CVE-2026-45585 CVE-2026-23479 CVE-2020-17103

CVE ID :CVE-2026-9019 Published : June 10, 2026, 8:16 a.m. | 4 hours, 22 minutes ago Description :The Easy Image Collage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'grid[properties][borderColor]' and 'grid[images][N][attachment_url]' Parameters in all versions up to, and including, 1.13.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the data is stored via update_post_meta() rather than wp_insert_post() post content, WordPress's unfiltered_html restriction does not apply, meaning Authors cannot be blocked from this attack path by capability controls alone. Severity: 6.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE ID :CVE-2026-8853 Published : June 10, 2026, 8:16 a.m. | 4 hours, 22 minutes ago Description :The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'memo' parameter in all versions up to, and including, 5.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the memo value is stored via update_post_meta() rather than wp_insert_post(), WordPress's built-in kses and unfiltered_html protections do not apply, allowing attackers to break out of the textarea element via injected closing tags regardless of role-based content filtering. Severity: 4.4 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...