4642 karet z 5140 položek
· strana 44 z 78
CZ ·
EN/orig
Hvězdička u CVE znamená, že jsem to číslo vytáhl z širšího textu článku.
Neukazuju u něj proto KEV, EPSS ani CVSS, a to preventivně, protože článek se na něj mohl
jen odkazovat, třeba jako na starší kauzu.
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.8, CVEs: CVE-2026-100256, Summary: In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.8, CVEs: CVE-2026-100253, CVE-2026-100254, CVE-2026-100255, Summary: CVE-2026-100253 (CVSS: 8.8): In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL CVE-2026-100254 (CVSS: 8.8): In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF…
De multiples vulnérabilités ont été découvertes dans Redmine. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et une injection de code indirecte à distance (XSS).
De multiples vulnérabilités ont été découvertes dans Mozilla Thunderbird. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.
On October 7, 2026, the Cisco Product Security Incident Response Team (PSIRT) will publish advisories to disclose security vulnerability information along with fixed software releases for the following Cisco products: Application Policy Infrastructure Controller (security hardening release) Finesse License On-Prem, formerly Cisco Smart Software Manager On-Prem (security hardening release) Meraki (security hardening release) NX-OS Software for MDS 9000, Nexus 3000, 7000, and 9000 Series Switches…
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is warning of a new critical vulnerability in MikroTik RouterOS that could lead to remote code execution or cause a denial-of-service condition. [...]
OverviewOn September 30, 2026, Cisco published a security advisory for CVE-2026-76504, a critical API authentication bypass vulnerability affecting Cisco Catalyst SD-WAN Manager. The vulnerability has a CVSSv3.1 score of 9.8 and results from improper handling of URL encoding (CWE-177). An unauthenticated, remote attacker can send a crafted HTTP request that bypasses an authentication rule for a specific API endpoint, gaining access to the API with the privileges of the admin user.According to…
Cisco heeft een kwetsbaarheid verholpen in Cisco Catalyst SD-WAN Manager. De kwetsbaarheid bevindt zich in een API van Cisco Catalyst SD-WAN Manager. Door onjuiste verwerking van URI-encoding kunnen ongeauthenticeerde kwaadwillenden authenticatiemechanismen omzeilen. Hierdoor kan de kwaadwillende administratieve toegang tot het systeem verkrijgen en de controle over het systeem overnemen.
Artifex Software ha rilasciato aggiornamenti di sicurezza che sanano una vulnerabilità con gravità "alta" in Ghostscript, software per l'elaborazione di documenti PostScript e PDF, nella versione per Windows. Tale vulnerabilità, qualora sfruttata, potrebbe consentire a un utente malintenzionato di elevare i propri privilegi sui sistemi interessati.
Remote access software company TeamViewer warned customers on Tuesday to immediately patch a set of high-severity vulnerabilities affecting its client and host software. [...]
Disponibile Proof of Concept (PoC) per lo sfruttamento della vulnerabilità CVE-2026-94545 – già sanata dal vendor – presente in next/og ImageResponse di Next.js. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato remoto, in determinate condizioni, di eseguire codice arbitrario sui sistemi interessati.
Rilasciati aggiornamenti di sicurezza che sanano 14 vulnerabilità, di cui 4 con gravità "alta", in OpenSSL, software open source per la gestione delle comunicazioni crittografiche. Tali vulnerabilità, qualora sfruttata, potrebbero consentire ad un utente malintenzionato di compromettere la disponibilità del servizio o di accedere ad informazioni sensibili sui sistemi interessati.
[Advisory2026-11_VDE-2026-094] The CODESYS Gateway Client (CmpGatewayClient) is used by various CODESYS products to establish PLC communication via the CODESYS Gateway. Due to missing limits on memory allocations derived from a size field in a gateway response, a malicious gateway can cause excessive memory consumption in the client, resulting in a denial-of-service condition. The vulnerability can be exploited when an affected product connects to an attacker-controlled gateway.
Google ha rilasciato un aggiornamento per il browser Chrome al fine di correggere 32 nuove vulnerabilità di sicurezza, di cui 6 con gravità “critica” e 11 con gravità “alta”.
WatchGuard ha rilasciato aggiornamenti di sicurezza per risolvere molteplici vulnerabilità, di cui 1 con gravità "critica" e 13 con gravità "alta", presenti in Fireware OS, sistema operativo utilizzato nei dispositivi di sicurezza perimetrale e di protezione delle reti.
[Advisory2026-12_VDE-2026-097] The monitoring functionality of affected CODESYS Control runtime systems processes read and write requests to PLC application data sent by the CODESYS Development System and other clients such as HMIs. Due to improper synchronization in the CmpMonitor2 component when processing concurrent requests from multiple clients, incorrect data may be read or written, potentially resulting in unexpected behavior of the affected product. PLCs based on the CODESYS Runtime…
SQL Injection in the Integratec Application Wed, 09/30/2026 - 10:16 Aviso Affected Resources Integratec App . Description INCIBE has coordinated the disclosure of a critically severe vulnerability affecting the Integratec application, a talent and human resources management platform. The vulnerability was discovered by Christopher Alejandro (Moroco).This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector, and CWE vulnerability type:CVE-2026-13695: CVSS v4.0: 9…
Rilevato lo sfruttamento attivo in rete della vulnerabilità CVE-2026-89013 - già sanata dal vendor - relativa a Dolibarr, soluzione open source per la gestione di documenti e processi aziendali. Tale vulnerabilità, qualora sfruttata, potrebbe consentire a un utente non autenticato di leggere file arbitrari sui sistemi interessati.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of WatchGuard FireWare OS. An attacker must first obtain the ability to write to the samld session directory on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.5. The following CVEs are assigned: CVE-2026-13046.
This vulnerability allows remote attackers to execute arbitrary code on affected installations of WatchGuard FireWare OS. Authentication is required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 7.2. The following CVEs are assigned: CVE-2026-18145.
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.1, CVEs: CVE-2026-102831, Summary: JupyterLab 4.5.0 enabled copying and pasing cells through the system clipboard. The paste path parses clipboard text as cell JSON and inserts the cells without clearing metadata.trusted, so a payload can declare its own output as trusted. JupyterLab does not sanitize a trusted output and evaluates the elements it contains, so pasting the cell runs attacker's JavaScript…
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: CVE-2026-96760, Summary: Authlib (versions up to and including 1.7.2) contain a signature‑verification bypass in the JSON Web Signature (JWS) general JSON serialization handling. The JsonWebSignature.deserialize_json() function accepts a JWS object with an empty "signatures" array and treats the payload as successfully verified, allowing attackers to supply arbitrary forged content without…
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: None, CVEs: CVE-2026-90906, CVE-2026-90907, CVE-2026-90913, CVE-2026-90914, CVE-2026-90915, CVE-2026-90916, CVE-2026-90917, CVE-2026-90918, CVE-2026-92222, CVE-2026-92223, CVE-2026-92225, CVE-2026-92226, CVE-2026-92232, CVE-2026-92227, CVE-2026-92231, Summary: The Joomla! Project is pleased to announce the release of Joomla 6.1.4 and Joomla 5.4.9. These are security & bugfix releases for the Joomla 5.x…
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.9, CVEs: CVE-2026-89078, CVE-2026-93577, CVE-2026-84739, CVE-2026-92470, CVE-2026-92874, CVE-2026-92530, CVE-2026-8937, CVE-2026-92529, CVE-2026-10518, CVE-2026-4523, CVE-2026-92628, Summary: On September 23, 2026, we released versions 19.4.1, 19.3.3, 19.2.7 for GitLab Community Edition (CE) and Enterprise Edition (EE). These versions contain important bug and security fixes, and we strongly recommend…
Classification: Severe, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 8.2, CVEs: CVE-2026-76718, CVE-2026-76719, CVE-2026-76720, Summary: Potential security vulnerabilities have been identified in Hewlett Packard Enterprise OneView Software. These vulnerabilities could be exploited allowing a remote attacker to perform session hijacking, data theft, unauthorized actions or URL redirect.
Classification: Important, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 7.1, CVEs: CVE-2026-95520, Summary: A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one byte, after which the payload's independently-controlled cpio filesize field is used to write attacker…
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 9.1, CVEs: CVE-2026-102268, Summary: PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, is_pem_format in jwt/utils.py is affected because is_pem_format does not recognize every PEM representation accepted by the cryptography loader. This occurs when an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes. As a result,…
De multiples vulnérabilités ont été découvertes dans GitLab. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et un contournement de la politique de sécurité. Gitlab indique que la vulnérabilité CVE-2026-85706 est activement exploitée.
De multiples vulnérabilités ont été découvertes dans OpenSSL. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.
De multiples vulnérabilités ont été découvertes dans les produits Mozilla. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.
De multiples vulnérabilités ont été découvertes dans Google Chrome. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Serial number: AV26-977Date: September 29, 2026 As of September 29, 2026, TeamViewer is affected by vulnerabilities in the following products: TeamViewer Full Client (Windows/Linux/MacOS) Multiple versions and Platforms TeamViewer Host (Windows/Linux/MacOS) Multiple versions and Platforms The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Security Update for Multiple Vulnerabilities in TeamViewer…
Serial number: AV26-976Date: September 29, 2026 As of September 29, 2026, Mozilla is affected by vulnerabilities in the following products: Firefox ESR Versions prior to 153.4 Versions prior to 140.17 Versions prior to 115.42 Firefox Versions prior to 157 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Security Vulnerabilities fixed in Firefox 157 Security Vulnerabilities fixed in Firefox ESR 153.4…
Cybersecurity firms say attackers exploited the Citrix NetScaler CVE-2026-88772 zero-day to deploy custom web shells and tunneling malware, gain root access, steal credentials, and spread into internal networks. [...]
Serial number: AV26-975Date: September 29, 2026 As of September 29, 2026, Hitachi Energy is affected by vulnerabilities in the following product: RTU500 series CMU firmware Prior to 12.7.8, 13.9.1 or later The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Vulnerabilities in Hitachi Energy RTU500 End-of-Life versions (PDF) Hitachi Vulnerability Information
Aggiornamenti di sicurezza sanano molteplici vulnerabilità, di cui 1 con gravità “critica” e 39 con gravità “alta”, nei prodotti Firefox e Firefox ESR.
Serial number: AV26-974Date: September 29, 2026 As of September 28, 2026, SUSE is affected by vulnerabilities in the following product: Rancher Prior to 0.12.19 Prior to 0.13.15 Prior to 0.13.16 Prior to 0.14.10 Prior to 0.14.10 Prior to 0.15.6 Prior to 0.15.7 Prior to 0.16.1 Prior to 0.16.2 Prior to 2.11.18 Prior to 2.12.14 Prior to 2.13.10 Prior to 2.14.6 Prior to 2.15.2 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as…
Serial number: AV26-973Date: September 29, 2026 As of September 28, 2026, FreePBX is affected by vulnerabilities in the following products: music Prior to 16.0.4 Prior to 17.0.6 ucp Prior to 16.0.39 Prior to 17.0.6 soundlang Prior to 17.0.5 Prior to 16.0.10 backup Prior to 16.0.72 Prior to 17.0.7 superfecta Prior to 16.0.40 Prior to 17.0.7 api Prior to 17.0.9 The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become…
Rilasciati aggiornamenti di sicurezza per risolvere 3 vulnerabilità, di cui 2 con gravità "alta", che interessano i prodotti HPE OneView e HPE Synergy Composer.
Serial number: AV26-972Date: September 29, 2026 As of September 28, 2026, WatchGuard is affected by vulnerabilities in the following product: WatchGuard AP Prior to 3.4.8 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. CVE-2026-101891 — WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access CVE-2026-86102 — WatchGuard AP Command Injection in Internal Management API Allows…
Rilevato lo sfruttamento attivo in rete della CVE-2026-82329 con gravità "critica", relativa al prodotto JFrog Artifactory. Tale vulnerabilità potrebbe consentire a un utente malintenzionato remoto non autenticato di eludere i controlli di accesso e ottenere privilegi amministrativi sui sistemi interessati.
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to replace software and execute arbitrary code with root privileges. The following versions of Lantronix G520 Series Cellular Gateway are affected: G520 Series 2.6.0.4R6_stable (CVE-2026-84409, CVE-2026-91191) CVSS Vendor Equipment Vulnerabilities v3 7.5 Lantronix Lantronix G520 Series Cellular Gateway Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), Improper…
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to access critical data or execute arbitrary code. The following versions of Toptech TMS7 and TopHAT are affected: TMS7 7.6.3 (CVE-2026-71379, CVE-2026-70356, CVE-2026-72510, CVE-2026-63713, CVE-2026-68954, CVE-2026-68068, CVE-2026-72507, CVE-2026-71302, CVE-2026-69662, CVE-2026-71189) TopHAT 7.6.3 (CVE-2026-71379, CVE-2026-70356, CVE-2026-72510, CVE-2026-63713, CVE-2026-68954, CVE-2026-68068, CVE-2026…
View CSAF Summary Successful exploitation of these vulnerabilities could allow attackers to access, modify, or delete sensitive user data and critical system files, potentially compromising the operation of the entire platform. The following versions of Viidure Dashcam Android Application are affected: Dashcam Android Application <=3.3.1.260403 (CVE-2026-94204, CVE-2026-96587) CVSS Vendor Equipment Vulnerabilities v3 10 Viidure Viidure Dashcam Android Application Incorrect Permission Assignment…
View CSAF Summary Successful exploitation of these vulnerabilities could allow an attacker to access sensitive information, access user accounts, execute OS-level commands, or take full control over the device. The following versions of Anjvision YSSD-RTMP-H5 are affected: YSSD-RTMP-H5 firmware 3.3.2.4_build_2024-12-26 (CVE-2026-100291, CVE-2026-100292, CVE-2026-100293, CVE-2026-100294, CVE-2026-100295, CVE-2026-100296, CVE-2026-100297, CVE-2026-100298, CVE-2026-100299) CVSS Vendor Equipment…
View CSAF Summary Successful exploitation of this vulnerability may allow attackers to achieve remote command execution on affected devices, potentially with root privileges, leading to full compromise of the camera system. The following versions of VIVOTEK Camera Firmware are affected: V Series model_FD9187 (CVE-2026-22755) V Series model_FD9189 (CVE-2026-22755) V Series model_FD9365 (CVE-2026-22755) V Series model_FD9387 (CVE-2026-22755) V Series model_FD9389 (CVE-2026-22755) V Series model…
View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to inject malformed messages which may lead to a denial-of-service condition. The following versions of Baicells Nova 430H are affected: Nova 430H eNodeB (model pBS3101SH) <=BaiBLQ_3.0.12 (CVE-2026-96274) CVSS Vendor Equipment Vulnerabilities v3 7.4 Baicells Technologies Baicells Nova 430H Uncaught Exception Background Critical Infrastructure Sectors: Communications, Information Technology Countries/Areas…