Base de données CVE

CVE-2026-100276 Élevée · 7.5 jetbrains · youtrack · 30/09/2026

In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action

CVE-2026-100262 Élevée · 7.1 jetbrains · youtrack · 30/09/2026

In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates

CVE-2026-102578 Élevée · 8.8 moodle · moodle · 30/09/2026

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vul...

CVE-2026-86134 Élevée · 8.7 watchguard · fireware · 30/09/2026

A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management daemon by sending a specially request to the login interface...

CVE-2026-103101 Élevée · 7.5 pexip · pexip_infinity · 30/09/2026

Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to render a Pexip Infinity node inaccessible.

CVE-2026-90441 Élevée · 7.1 watchguard · fireware · 30/09/2026

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wg...

CVE-2026-86136 Élevée · 7.1 watchguard · fireware · 30/09/2026

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wg...

CVE-2026-86133 Élevée · 8.2 watchguard · fireware · 30/09/2026

An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to crash the iked process by sending a specially crafted encrypted...

CVE-2026-86132 Élevée · 8.2 watchguard · fireware · 30/09/2026

An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending a specially crafted encrypted IKEv2 message negotiated with a...

CVE-2026-86128 Élevée · 8.2 watchguard · fireware · 30/09/2026

A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted IPv6 packet.

CVE-2026-86104 Élevée · 8.7 watchguard · fireware · 30/09/2026

An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted request.

CVE-2026-18145 Élevée · 8.6 watchguard · fireware · 30/09/2026

A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrar...

CVE-2026-13046 Élevée · 7.5 watchguard · fireware · 30/09/2026

A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execut...

CVE-2026-84440 Élevée · 8.8 ibm · guardium_data_protection · 29/09/2026

IBM Guardium Data Protection 12.2 is vulnerable to command injection in the SNMP alert notification functionality. An authenticated attacker who can influence policy alert text can cause attacker-controlled data to be ex...

CVE-2026-102811 Élevée · 8.7 · 29/09/2026

Marmite through 0.4.2 contains missing authentication in the development server endpoints /__marmite__/content, /__marmite__/config, and /__marmite__/file/, allowing unauthenticated attackers to create, modify, and overw...

CVE-2026-102677 Élevée · 8.8 electronjs · electron · 29/09/2026

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a...

CVE-2026-102559 Élevée · 8.6 gnome · libsoup · 29/09/2026

A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used t...

CVE-2026-92227 Élevée · 8.2 joomla · joomla\! · 29/09/2026

Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The premature issuance of an rememberme cookie leads to a MFA bypass vulnerability.

CVE-2026-92222 Élevée · 8.9 joomla · joomla\! · 29/09/2026

Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - URLs used for serverside requests were improperly validated, leading to SSRF vectors.

CVE-2026-102424 Élevée · 8.9 balbooa · forms · 29/09/2026

Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during...

CVE-2026-101127 Élevée · 8.6 balbooa · forms · 29/09/2026

Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the atta...

CVE-2026-97689 Élevée · 8.9 python · urllib3 · 29/09/2026

urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size...

CVE-2026-97687 Élevée · 7.6 python · urllib3 · 29/09/2026

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_...

CVE-2026-102566 Élevée · 8.5 · 29/09/2026

CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craft malicious model files with oversized payl...

CVE-2026-73597 Élevée · 8.1 dell · policy_manager_for_secure_connect_gateway · 29/09/2026

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cross-Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vu...

Sources : NVD (NIST), CISA KEV, FIRST EPSS. Dernière mise à jour : 23/10/2026 05:07. Les analyses en français sont générées par IA et peuvent contenir des erreurs : vérifiez toujours l'avis de l'éditeur.