Base de données CVE

CVE-2026-106555 Élevée · 7.5 openbsd · openssh · 06/10/2026

In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.

CVE-2026-106553 Élevée · 7.5 openbsd · openssh · 06/10/2026

In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.

CVE-2026-104048 Élevée · 8.1 fedoraproject · sssd · 06/10/2026

A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user...

CVE-2026-96890 Élevée · 8.7 github · enterprise_server · 06/10/2026

A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which co...

CVE-2026-71168 Élevée · 7.8 dell · system_update · 06/10/2026

Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with local access could potentially explo...

CVE-2026-63697 Élevée · 7.2 dell · system_update · 06/10/2026

Dell System Update, versions prior to 2.3.0.0, contains an Improper Certificate Validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote exec...

CVE-2026-106221 Élevée · 8.3 google · chrome · 06/10/2026

Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: L...

CVE-2026-106199 Élevée · 8.2 google · chrome · 06/10/2026

Incorrect authorization in Actor in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially bypass site isolation via a crafted HTML page. (Chr...

CVE-2026-106198 Élevée · 8.2 google · chrome · 06/10/2026

Missing authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security sever...

CVE-2026-106196 Élevée · 7.6 google · chrome · 06/10/2026

Missing authorization in Navigation in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Med...

CVE-2026-106188 Élevée · 7.1 google · chrome · 06/10/2026

Confused deputy in SignIn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity:...

CVE-2026-106121 Élevée · 7.5 vmware · rabbitmq_java_client · 06/10/2026

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read() fails to terminate when input ends inside...

CVE-2026-106219 Élevée · 7.5 jetbrains · teamcity · 06/10/2026

In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server

CVE-2026-105868 Élevée · 8.6 payloadcms · payload · 06/10/2026

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, local upload configurations that accept XML files can store an XML file and styl...

CVE-2026-105861 Élevée · 7.2 payloadcms · payload · 06/10/2026

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destinati...

CVE-2026-105860 Élevée · 7.1 payloadcms · payload · 06/10/2026

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an...

CVE-2026-105856 Élevée · 8.6 payloadcms · payload · 06/10/2026

Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to a collection containing a json field or a blocks field with...

CVE-2026-105855 Élevée · 7.6 payloadcms · payload · 06/10/2026

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the server fails to enforce a field-level access.update restriction on the passw...

CVE-2026-105854 Élevée · 8.7 payloadcms · payload · 06/10/2026

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a malformed multipart request body can cause multipart Content-Type p...

CVE-2026-105850 Élevée · 8.8 payloadcms · payload · 06/10/2026

Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Strip...

CVE-2026-105849 Élevée · 7.7 payloadcms · payload · 06/10/2026

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in...

CVE-2026-76105 Élevée · 7.1 dell · container_storage_modules · 06/10/2026

Dell Container Storage Modules, versions prior to 1.18.0 contain(s) an Use of Insufficiently Random Values vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leadin...

CVE-2026-67270 Élevée · 7.4 dell · container_storage_modules · 06/10/2026

Dell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Improper Certificate Validation vulnerability in the proxy-server component. An unauthenticated adjacent network attacker could potentially explo...

CVE-2026-63690 Élevée · 7.4 dell · container_storage_modules · 06/10/2026

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability in the csi-powerflex; csi-powermax; csi-powerstore. An unauthenticated attacker with adjac...

CVE-2026-54472 Élevée · 7.5 dell · container_storage_modules · 06/10/2026

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the csm-docs. An unauthenticated attacker with remote access could potentially exploit this vulnerabi...

Sources : NVD (NIST), CISA KEV, FIRST EPSS. Dernière mise à jour : 23/10/2026 05:07. Les analyses en français sont générées par IA et peuvent contenir des erreurs : vérifiez toujours l'avis de l'éditeur.