4524 karet z 4993 položek
· strana 1 z 76
CZ ·
EN/orig
Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku.
Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl
jen odkazovat, třeba jako na starší kauzu.
MediaTek ha pubblicato il bollettino di sicurezza di novembre 2026 contenente correzioni per 56 vulnerabilità, di cui 6 con gravità "critica" e 16 con gravità "alta", nei chipset MediaTek, componenti hardware impiegati in numerosi dispositivi mobili e sistemi embedded.
Multiple Vulnerabilities in AM System's ALO Suite Tue, 11/03/2026 - 11:35 Aviso Affected Resources ALO Suite, version 25_09_15.03_35. Description INCIBE has coordinated the disclosure of 15 vulnerabilities, one high-severity and 14 medium-severity that affect AM System’s ALO Suite, a cloud-based business management software. The vulnerabilities were discovered by David Padilla Alvarado. These vulnerabilities have been assigned the following codes, CVSS v4.0 base score, CVSS vector, and CWE…
Google ha pubblicato il bollettino di sicurezza Android di novembre, contenente correzioni per 149 vulnerabilità, di cui 12 con gravità “critica” e 137 con gravità “alta”. Tra queste si evidenzia la CVE-2026-58882 per la quale risulta disponibile un Proof of Concept (PoC) in rete.
[VDE-2026-119] Multiple vulnerabilities in the web-based management functions of the affected Welotec routers, including VPN-related functions, may allow a remote attacker with high privileges to inject commands or trigger a buffer overflow. Successful exploitation may result in command execution with root privileges or a denial of service.
Nell’ambito del processo di divulgazione coordinata delle vulnerabilità (Coordinated Vulnerability Disclosure – CVD), si rendono note le vulnerabilità individuate da ricercatori di sicurezza, e coordinate da questo CSIRT in collaborazione con il vendor interessato, relative al prodotto di Galeno Sistemi Magistra, software per la gestione del laboratorio galenico di farmacia.
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.7, CVEs: CVE-2026-114408, CVE-2026-115654, CVE-2026-115653, Summary: CVE-2026-114408 (CVSS: 8.7): _nx_icmpv6_process_packet_too_big adds the destination quoted in an ICMPv6 Packet Too Big message to the destination table, then reads the entry the add returns without checking that the add succeeded. When the table is full, the add fails and returns a NULL entry, and the function dereferences it. A sender…
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 9.3, CVEs: CVE-2026-77877, CVE-2026-77878, CVE-2026-77879, CVE-2026-77880, CVE-2026-104080, CVE-2026-77876, CVE-2026-73695, CVE-2026-73696, CVE-2026-73697, Summary: CVE-2026-77877 (CVSS: 8.6): Control Web Panel (CWP) before webpanel_version 1.30 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting…
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-98432, Summary: A use-after-free vulnerability was found in the Linux kernel's IPv4 networking subsystem. A remote, unauthenticated attacker could exploit a race condition during TCP connection request processing to trigger remote code execution. The flaw arises when socket options are freed while still being accessed by a concurrent operation, such as a retransmitted connection…
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-109618, CVE-2026-109619, Summary: This Security Alert addresses CVE-2026-109618 and CVE-2026-109619. These vulnerabilities, known as PHP2Shell, allow for unauthenticated remote code execution in PHP. Oracle strongly recommends that customers apply the available security patches without delay. The Security Alert advisory will continue to be updated as additional product patches become…
Serial Number: AV26-1113 Date: November 2, 2026 As of November 2, 2026, SUSE is affected by a vulnerability in the following product: Rancher Prior to 2.11.19 Prior to 2.12.15 Prior to 2.13.11 Prior to 2.14.7 Prior to 2.15.3 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Rancher meta proxy allowlist bypass leading to server-side request forgery SUSE Update Advisories
Serial Number: AV26-1112 Date: November 2, 2026 As of November 2, 2026, Barracuda Networks is affected by a vulnerability in the following products: Barracuda Email Security Gateway (ESG) Prior to 9.4.0.030 Barracuda Load Balancer Application Delivery Controller (ADC) Prior to 6.4.0 Barracuda Web Application Firewall (WAF) Prior to 11.0.1 Barracuda Web Security Gateway (WSG) Prior to 16.1.100.100 Barracuda Message Archiver (BMA) Prior to 5.5.4.0 Barracuda WAF Control Center (WCC) Prior to 2.2.1…
Rilevate alcune vulnerabilità, di cui 4 con gravità "alta", in SQLite, libreria open source per la gestione di basi di dati relazionali incorporata in numerose applicazioni. Tali vulnerabilità potrebbero consentire a un attaccante di iniettare comandi di sistema, alterare la memoria dei processi interessati e compromettere la disponibilità del servizio sui sistemi coinvolti.
The maintainer of BTCPay Server, an open-source cryptocurrency payment processor, has urged users to install the latest version as hackers have been draining "hot wallets" on instances running older versions. [...]
Serial number: AV26-1111 Date: November 2, 2026 As of October 30, 2026, Red Hat is affected by vulnerabilities in the following products: Red Hat Build of Keycloak All version Red Hat Enterprise Linux 10 All version Red Hat Enterprise Linux 6 All version Red Hat Enterprise Linux 7 All version Red Hat Enterprise Linux 8 All version Red Hat Enterprise Linux 9 All version Red Hat Fuse 7 All version Red Hat Hardened Images All version Red Hat JBoss Enterprise Application Platform 7 All version Red…
Serial number: AV26-1110 Date: November 2, 2026 As of October 30, 2026, Dell is affected by vulnerabilities in the following products: OpenManage Enterprise Prior to 4.8.0 PowerProtect Data Domain Prior to 7.13.1.90 Prior to 8.3.1.50 Prior to 8.6.1.30 Prior to 8.9.0.0 PowerProtect Data Domain Management Center Prior to 7.13.1.90 Prior to 8.3.1.50 Prior to 8.6.1.30 Prior to 8.9.0.0 PowerProtect Data Domain Virtual Edition Prior to 7.13.1.90 Prior to 8.3.1.50 Prior to 8.6.1.30 Prior to 8.9.0.0…
Serial number: AV26-1109 Date: November 2, 2026 As of October 29, 2026, Google is affected by vulnerabilities in the following product: Stable Channel Chrome for Desktop Versions prior to 156.0.8078.79/.80 (Windows/Mac), and 156.0.8078.79 (Linux) The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. Google Chrome Security Advisory
Taiwanese network-attached storage (NAS) appliance maker Synology warned customers to update their devices immediately due to a surge in C3RB3r ransomware attacks. [...]
Rilevate quattro vulnerabilità di sicurezza, di cui 2 con gravità “alta”, in Chamilo LMS, sistema di e-learning e gestione dei contenuti. Tali vulnerabilità potrebbero consentire a un attaccante remoto, in determinate condizioni, di eseguire codice arbitrario o di compromettere un account esistente, anche amministrativo.
Aggiornamenti di sicurezza sanano tre vulnerabilità con gravità “alta” che interessano i prodotti ManageEngine SharePoint Manager Plus, soluzione per la gestione e il monitoraggio degli ambienti SharePoint, nonché ManageEngine Password Manager Pro e PAM360, piattaforme per la gestione di credenziali, account privilegiati e accessi amministrativi.
Ivanti released security updates to patch two more Connect Secure (ICS) remote access gateway flaws that have been chained in zero-day attacks since at least October 1. [...]
Canonical heeft een kwetsbaarheid verholpen in LXD. De kwetsbaarheid (CVE-2026-112816) wordt veroorzaakt door onjuiste validatie van certificaatketens binnen de HTTPS API van Canonical LXD. De kwetsbaarheid treft LXD-versies vóór 4.0.15, 5.0.11, 5.21.9 en 6.10.1 binnen de betreffende releasebranches. Hierdoor kunnen niet-geauthenticeerde aanvallers die netwerktoegang hebben tot de HTTPS API en beschikken over het publieke certificaat van een vertrouwde client, zich voordoen als die client. Dit…
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Qlib. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Qlib. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Qlib. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.8.
De multiples vulnérabilités ont été découvertes dans Ivanti Connect Secure. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et un contournement de la politique de sécurité. Ivanti indique que les vulnérabilités CVE-2026-104935,...
De multiples vulnérabilités ont été découvertes dans Microsoft Edge. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
De multiples vulnérabilités ont été découvertes dans Tenable Identity Exposure. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
De multiples vulnérabilités ont été découvertes dans Redmine. Certaines d'entre elles permettent à un attaquant de provoquer une injection de code indirecte à distance (XSS), un contournement de la politique de sécurité et un déni de service.
Hackers attempted to exploit a critical GitLab vulnerability in Alpine Linux's development infrastructure on October 20-21, prompting the open-source project to rebuild its GitLab server and reset all passwords over concerns of a possible compromise. [...]
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2026-118636, Summary: JavaNativeMessageDecoder in the MINA 3.0 codec module calls ObjectInputStream.readObject() on frame bytes with no class filter, so an application that puts it in front of an untrusted peer is open to gadget-chain RCE. As the 3.0.0 branch is inactive, we do not plan to release a version that fixes this issue. Users are recommended to use the latest Apache MINA 2.2.X…
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.5, CVEs: CVE-2026-120194, Summary: A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service.
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 9.4, CVEs: CVE-2026-103093, CVE-2026-103094, CVE-2026-6877, Summary: CVE-2026-103093 (CVSS: 9.4): ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI Platform. This vulnerability could enable an authenticated user with the admin role to bypass Rhino sandbox restrictions and execute arbitrary code on the underlying host operating system, potentially enabling…
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 9.3, CVEs: CVE-2026-107239, CVE-2026-107238, CVE-2023-22793, Summary: CVE-2026-107239 (CVSS: 8.8): A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (RCE) on servers running the Veeam Management Pack for Microsoft System Center Collector service. CVE-2026-107238 (CVSS: 8.7): A vulnerability allowing an authenticated domain user to perform…
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.8, CVEs: CVE-2025-31704, Summary: A vulnerability has been found in the Dahua Intelligent Connection Center. A remote attacker could send a specially crafted request to the affected system, allowing the attacker to execute arbitrary commands, resulting in remote code execution.
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.1, CVEs: CVE-2026-119553, CVE-2026-119554, CVE-2026-119555, CVE-2026-119556, Summary: CVE-2026-119553 (CVSS: 7.1): Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path traversal vulnerability in the Blackboard question import format. Teachers with question import or lesson edit rights can upload a crafted zip with img src values containing ../…
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv4.0: 8.7, CVEs: CVE-2026-119408, Summary: CVE-2026-119408 (CVSS: 8.7): The Function and Function Item nodes run user code in the vm2 sandbox, and the LangChain Code node runs user code in the n8n main process. An authenticated user with permission to create or modify workflows could use these nodes to execute arbitrary code in the n8n main process, outside the task runner isolation that applies to the Code node.
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.5, CVEs: CVE-2026-119371, CVE-2026-119372, CVE-2026-119373, CVE-2026-119374, CVE-2026-119375, CVE-2026-119376, CVE-2026-119377, CVE-2026-119378, CVE-2026-119379, Summary: CVE-2026-119371 (CVSS: 6.8): SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers…
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.8, CVEs: CVE-2026-119528, Summary: A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a crash and potentially arbitrary code execution.
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.5, CVEs: CVE-2026-119718, CVE-2026-119719, CVE-2026-119720, CVE-2026-119721, CVE-2026-119722, Summary: CVE-2026-119718 (CVSS: 8.5): Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in ptcache_data_alloc() when reading point cache files. Attackers can supply a crafted point cache file with a large totpoint value alongside a .blend file to…
Aggiornamenti di sicurezza Progress risolvono molteplici vulnerabilità, di cui 6 con gravità “critica” e 3 con gravità “alta”, presenti in WS_FTP Server, soluzione software di file transfer sicuro utilizzata per trasferire, condividere e gestire file all'interno di organizzazioni e tra partner esterni.
Hardware wallet device maker Trezor has received credible reports about a suspected hardware crypto-theft implant in a Trezor Safe 5 sold by its reseller CryptoBilis in Southeast Asia. [...]
Serial Number: AV26-1107 Date: October 30, 2026 As of October 28, 2026, MongoDB is affected by vulnerabilities in the following product: Laravel MongoDB Prior to 5.12.0 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Test Laravel HasOneThrough/HasManyThrough relations MongoDB Alerts
Serial Number: AV26-1106 Date: October 30, 2026 As of October 29, 2026, HashiCorp is affected by vulnerabilities in the following products: Nomad Prior to 2.1.0 Nomad Enterprise Prior to 2.1.0 Prior to 1.11.12 Prior to 1.10.18 Boundary Prior to 1.0.2 Boundary Enterprise Prior to 1.0.2 and 0.21.6 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. HCSEC-2026-52 - Nomad dispatch payload writes can escape…
Serial number: AV26-1105 Date: October 30, 2026 As of October 28, 2026, Drupal is affected by a vulnerability in the following product: Commerce Core Versions prior to 2.41 and 3.0.0 versions prior to 3.3.13 Open-source reporting indicates that CVE-2026-118539 is being exploited in the wild. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Commerce Core - Highly critical - Access bypass - SA-CONTRIB…
Tenable ha rilasciato aggiornamenti di sicurezza per risolvere 3 vulnerabilità, di cui una con gravità "critica", in Tenable Identity Exposure, piattaforma dedicata al rilevamento e alla gestione delle esposizioni negli ambienti Microsoft Active Directory. Tale vulnerabilità, qualora sfruttata, potrebbe consentire a un utente autenticato con privilegi limitati di eseguire codice arbitrario con privilegi elevati sul controller di dominio interessato.
Cisco heeft een ernstige kwetsbaarheid verholpen in Cisco Secure Firewall Adaptive Security Appliance (ASA) en Cisco Secure Firewall Threat Defense (FTD). Cisco bevestigt dat de kwetsbaarheid actief wordt misbruikt. Deze kwetsbaarheid met kenmerk CVE-2026-76418 heeft een CVSS-score van 8.6 en bevindt zich in de Remote Access SSL VPN-functionaliteit. Een niet-geauthenticeerde kwaadwillende kan de kwetsbaarheid op afstand misbruiken door een speciaal vervaardigd verzoek naar de VPN-dienst te…
Google ha rilasciato un aggiornamento per il browser Chrome al fine di correggere 21 nuove vulnerabilità di sicurezza, di cui una con gravità “critica” e 19 con gravità “alta”. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un attaccante remoto di accedere a informazioni sensibili, compromettere la disponibilità del servizio, eludere i meccanismi di sicurezze ed eseguire codice arbitrario sui sistemi interessati.
During its own research, CERT Polska has found 3 XSS vulnerabilities (from CVE-2026-105454 to CVE-2026-105456) in Request Tracker (RT) and RT for Incident Response software (RTIR).
Aggiornamenti di sicurezza risolvono tre vulnerabilità, di cui una con gravità "critica" e una con gravità "alta", in ServiceNow AI Platform, piattaforma di intelligenza artificiale e automazione di ServiceNow. Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un utente malintenzionato autenticato di accedere ad informazioni sensibili e, in determinate condizioni, di eludere i meccanismi di isolamento della piattaforma ed eseguire codice arbitrario sul sistema host sottostante.
Juniper heeft meerdere kwetsbaarheden verholpen in Juniper Networks Session Smart Router en Session Smart Conductor. De kwetsbaarheden betreffen verschillende componenten van de Juniper Networks Session Smart Router en Session Smart Conductor. - Er zijn out-of-bounds read- en write-fouten in HTTP-parser, TCP proxy, TCP header verwerking en VRRPv3 packet verwerking, die kunnen leiden tot service crashes, geheugenbeschadiging, sessie desynchronisatie en mogelijke informatielekken. - Een improper…