CVE-2026-36960

CVE-2026-36960: Cross-Site Request Forgery CSRF nell'interfaccia di gestione web ID CVE: CVE-2026-36960 Data: 2026-04-29 Scopritore: Kirubel Solomne Vendor: U-SPEED Prodotto: Router U-SPEED Versione Firmware: V1.0.0 CWE: CWE-352 - Cross-Site Request Forgery CSRF Descrizione Il firmware V1.0.0 del...

CVE-2026-36959

CVE-2026-36959: Assenza di Rate Limiting sull'Endpoint di Login ID CVE: CVE-2026-36959 Data: 2026-04-29 Scopritore: Kirubel Solomne Venditore: U-SPEED Prodotto: Router U-SPEED Versione Firmware: V1.0.0 CWE: CWE-307 - Restrizione Impropria dei Tentativi di Autenticazione Eccessivi Descrizione Il...

CVE-2026-36958

CVE-2026-36958: Denial of Service tramite Richieste HTTP Concorrenti CVE ID: CVE-2026-36958 Data: 2026-04-29 Scopritore: Kirubel Solomne Vendor: U-SPEED Prodotto: Router U-SPEED Versione Firmware: V1.0.0 CWE: CWE-400 - Consumo di Risorse Non Controllato Descrizione Il firmware V1.0.0 del Router...

catalyst

Catalyst Accelera le tue reazioni Sito web - Il Manuale di Catalyst Documentazione - Demo Catalyst è una piattaforma di risposta agli incidenti. Può aiutare ad automatizzare la gestione degli avvisi e le procedure di risposta agli incidenti. Funzionalità Gestione dei Ticket Avvisi e Incidenti I...

turbo-intruder

Turbo Intruder Turbo Intruder è un'estensione di Burp Suite per inviare un gran numero di richieste HTTP e analizzare i risultati. È pensata per complementare Burp Intruder gestendo attacchi che richiedono velocità, durata o complessità eccezionali. Le seguenti caratteristiche la distinguono:...

PF_RING

PFRING™ مقدمة PFRING™ هي وحدة نواة لينكس وإطار عمل في مساحة المستخدم تسمح لك بمعالجة الحزم بمعدلات عالية مع توفير واجهة برمجة تطبيقات API متسقة لتطبيقات معالجة الحزم. من يحتاج PFRING™؟ بشكل أساسي كل من يضطر إلى التعامل مع العديد من الحزم في الثانية. يتغير مصطلح "العديد" وفقًا للعتاد الذي تستخدمه...

conn-burst

Identificazione delle Connessioni a Raffica Burst Questo pacchetto identifica le "connessioni a raffica" bursting connections, ovvero connessioni che trasferiscono una grande quantità di dati rapidamente. Una volta identificata una connessione a raffica, questa non viene più monitorata come tale...

Astra Linux – Vulnerability in Linux, Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: hwmon: mlxreg-fan Returns a non-zero value when the fan’s current state is enforced from sysfs. The minimum fan speed can be enforced from sysfs. For example, setting the current fan speed to 20 is used to force the fan speed ...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: xhci: Fixed a issue where a NULL pointer dereference could occur during full-speed re-enumeration of devices. This occurs when re-enumering full-speed devices after a failed “address device” command can trigger a NULL pointer...

Astra Linux - Vulnerability in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: prefer nftchainvalidate nftchainvalidate already performs loop detection because a cycle will result in a call stack overflow ctx-level = NFTJUMPSTACKSIZE. It also processes maps via the -validate callback in...

CVE-2026-14287 TenWeb Speed Optimizer < 2.33.5 - Unauthenticated Stored XSS via Critical CSS Token Bypass

The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as...

CVE-2026-72143

A flaw was found in the Linux kernel's Intel Speed Select Technology ISST power management component for x86 platforms. When a system resumes from suspend, the SST-PP control settings for all power domains are not fully restored, affecting only power domain 0. This occurs due to an incorrect base...

CVE-2026-15421

The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15421 Speed Optimizer <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes

The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-62219

The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15421

The Speed Optimizer WordPress plugin (versions ≤ 7.8.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) via image tag attributes in its Lazy Load Media feature. The root cause is insufficient input sanitization and output escaping in the lazy-load image processing code. An authenticated attac...

PT-2026-78256

Name of the Vulnerable Software and Affected Versions Speed Optimizer versions prior to 7.8.1 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This occurs via image tag...

CVE-2026-74871

opensslencrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. When configured with a single KDF and no prior hashing stage, attackers can bypass memory-hard key derivation and perform offline password...

EUVD-2026-60090

opensslencrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. When configured with a single KDF and no prior hashing stage, attackers can bypass memory-hard key derivation and perform offline password...

CVE-2026-74871 openssl_encrypt before 1.4.6 KDF Bypass via Sequential-XOR

opensslencrypt versions before 1.4.6 contain a key derivation flaw in sequential XOR composition mode where the last stage cancels out during key generation. When configured with a single KDF and no prior hashing stage, attackers can bypass memory-hard key derivation and perform offline password...