Base de données CVE

CVE-2026-102764 Critique · 9.3 KEV PoC BeyondTrust · Remote Support · 15/10/2026

BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

CVE-2026-109829 Critique · 9.1 nodejs · undici · 15/10/2026

undici is an HTTP client library for Node.js. In versions 7.0.0 through 7.30.0 and 8.0.0 through 8.12.1, when an originless Agent composes the redirect and cache interceptors in that order with a shared cache store, the...

CVE-2026-109383 Critique · 9.1 nodejs · undici · 15/10/2026

undici is an HTTP client library for Node.js. In versions 4.0.0 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, its Agent dispatcher passes its constructor options through a JSON-based deep clone before f...

CVE-2026-111094 Critique · 9.8 jetbrains · teamcity · 15/10/2026

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible

CVE-2026-110770 Critique · 9.2 · 14/10/2026

Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password reset codes via POST /api/v1/users/reset-password. Attackers can request a six-...

CVE-2026-76519 Critique · 9.8 KEV PoC Cisco · Secure Email Gateway · 14/10/2026

Cisco Secure Email Gateway Relative Path Traversal Vulnerability

CVE-2026-89073 Critique · 9.8 progress · moveit_transfer · 14/10/2026

Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

CVE-2026-89068 Critique · 9.8 progress · moveit_transfer · 14/10/2026

Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

CVE-2026-110640 Critique · 9.3 · 14/10/2026

Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell...

CVE-2026-110635 Critique · 9.3 · 14/10/2026

webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings pas...

CVE-2020-37282 Critique · 9.3 · 14/10/2026

office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...), back...

CVE-2026-83888 Critique · 9.8 microsoft · windows_10_1607 · 13/10/2026

Buffer over-read in Windows CD-ROM Driver allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-82110 Critique · 9.9 ibm · datastage_on_cloud_pak_for_data · 12/10/2026

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal.

CVE-2026-82101 Critique · 9.6 ibm · datastage_on_cloud_pak_for_data · 12/10/2026

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.

CVE-2026-19622 Critique · 9.8 ibm · planning_analytics · 12/10/2026

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.

CVE-2026-109566 Critique · 9.3 · 12/10/2026

Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with passwo...

CVE-2026-109422 Critique · 9.2 · 12/10/2026

NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in the renderer-process IPC bridge os.navigateExternal, which passes caller-supplie...

CVE-2026-108107 Critique · 9.3 · 09/10/2026

PHPNuxBill through 2025.3.20 contains an unauthenticated SQL injection vulnerability in the radius.php FreeRADIUS REST endpoint that interpolates request parameters into whereRaw() queries. Attackers can send crafted use...

CVE-2026-107806 Critique · 9.4 PoC nginxui · nginx_ui · 09/10/2026

Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching m...

CVE-2026-76779 Critique · 9.8 dell · policy_manager_for_secure_connect_gateway · 09/10/2026

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An unauthenticated attacker with remote access could po...

CVE-2026-84246 Critique · 9.8 ibm · guardium_data_protection · 08/10/2026

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.

CVE-2026-84209 Critique · 9.8 ibm · guardium_data_protection · 08/10/2026

IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary SQL commands due to improper neutralization of special elements used in an SQL command.

CVE-2026-84198 Critique · 9.8 ibm · guardium_data_protection · 08/10/2026

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.

CVE-2026-84058 Critique · 9.8 ibm · guardium_data_protection · 08/10/2026

IBM Guardium Data Protection 12.0, 12.1, and 12.2 is vulnerable to a buffer overrun in the TDS (Microsoft SQL Server) PRELOGIN packet decoder. A remote attacker who can send a specially crafted TDS PRELOGIN packet to a n...

CVE-2026-84057 Critique · 9.8 ibm · guardium_data_protection · 08/10/2026

IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

Sources : NVD (NIST), CISA KEV, FIRST EPSS. Dernière mise à jour : 23/10/2026 05:07. Les analyses en français sont générées par IA et peuvent contenir des erreurs : vérifiez toujours l'avis de l'éditeur.