Base de données CVE

CVE-2026-82335 Critique · 9.8 ibm · guardium_data_protection · 08/10/2026

IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol parser. A remote attacker could send a specially crafted MongoDB SCRAM username containing an excessive...

CVE-2026-82334 Critique · 9.1 ibm · guardium_data_protection · 08/10/2026

IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-of-bounds read in the TDS7 LOGIN7 protocol parser. A remote attacker could send a specially crafted TDS LOGIN7 packet containing invalid off...

CVE-2026-14988 Critique · 9.8 ibm · datapower_gateway · 08/10/2026

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to buffer overflow.

CVE-2026-14888 Critique · 9.8 ibm · datapower_gateway · 08/10/2026

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to execute arbitrary code due to a heap-based buffer overfl...

CVE-2026-14508 Critique · 9.1 ibm · datapower_gateway · 08/10/2026

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 could allow a remote attacker to cause a denial of service and obtain sensitive informati...

CVE-2026-76285 Critique · 9.8 splunk · splunk · 07/10/2026

As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple...

CVE-2026-76459 Critique · 9.8 · 07/10/2026

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening relea...

CVE-2026-76454 Critique · 9.1 · 07/10/2026

A vulnerability in the Cisco Smart Licensing Utility API of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem (SSM On-Prem), could allow an unauthenticated, remote attacker to write arbitrary files to...

CVE-2026-92414 Critique · 9.3 apache · jackrabbit · 07/10/2026

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token...

CVE-2026-16516 Critique · 9.0 wolfssh · wolfssh · 07/10/2026

wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey() (src/internal.c), the blob's algorithm string is used to...

CVE-2026-93675 Critique · 9.8 langflow · langflow · 07/10/2026

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion.

CVE-2026-82162 Critique · 9.8 dell · command\|configure · 06/10/2026

Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain an Improper Handling of Mixed Encoding vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leadi...

CVE-2026-106237 Critique · 9.6 google · chrome · 06/10/2026

Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-106195 Critique · 9.1 google · chrome · 06/10/2026

Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)

CVE-2026-106218 Critique · 10.0 jetbrains · teamcity · 06/10/2026

In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible

CVE-2026-105863 Critique · 9.2 payloadcms · payload · 06/10/2026

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values...

CVE-2026-105851 Critique · 9.3 payloadcms · payload · 06/10/2026

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the duplicate operation copies values from a source document even whe...

CVE-2026-67273 Critique · 9.6 dell · container_storage_modules · 06/10/2026

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker with remote access could potentially...

CVE-2026-63691 Critique · 9.6 dell · container_storage_modules · 06/10/2026

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authorization vulnerability in the Dell CSI Driver for PowerMax - csireverseproxy . An unauthenticated attacker with adjacent network access...

CVE-2026-102490 Critique · 9.4 KEV Zammad GmbH · Zammad · 30/09/2026

Zammad GmbH Zammad Improper Privilege Management Vulnerability

CVE-2026-100277 Critique · 9.8 jetbrains · youtrack · 30/09/2026

In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature

CVE-2026-100273 Critique · 9.8 jetbrains · youtrack · 30/09/2026

In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution

CVE-2026-100255 Critique · 9.8 jetbrains · teamcity · 30/09/2026

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset

CVE-2026-103109 Critique · 9.4 pexip · pexip_infinity · 30/09/2026

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger memory corruption or a software abort resulting in a den...

CVE-2026-86131 Critique · 9.2 watchguard · fireware · 30/09/2026

A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebo...

Sources : NVD (NIST), CISA KEV, FIRST EPSS. Dernière mise à jour : 23/10/2026 05:07. Les analyses en français sont générées par IA et peuvent contenir des erreurs : vérifiez toujours l'avis de l'éditeur.