Base de données CVE

CVE-2026-102828 Critique · 9.2 simple-git_project · simple-git · 29/09/2026

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not clas...

CVE-2026-102560 Critique · 9.8 gnome · libsoup · 29/09/2026

A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the all...

CVE-2026-102676 Critique · 9.8 electronjs · electron · 29/09/2026

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview> guest could enable nodeIntegrationInWorke...

CVE-2026-73595 Critique · 9.8 dell · policy_manager_for_secure_connect_gateway · 29/09/2026

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with remote access co...

CVE-2026-102267 Critique · 9.1 pyjwt_project · pyjwt · 28/09/2026

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configure...

CVE-2026-102266 Critique · 9.1 pyjwt_project · pyjwt · 28/09/2026

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. Thi...

CVE-2026-101077 Critique · 9.3 · 28/09/2026

A flaw has been found in Netcore NR289-GE 1.4.5102. This impacts the function process_request of the component boa_temp Handler. This manipulation causes missing authentication. The attack is possible to be carried out r...

CVE-2026-101072 Critique · 9.3 · 28/09/2026

A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system of the file /ap_ip.cgi of the component CGI Handler. Such manipulation of the argument ip leads to os command injection....

CVE-2026-100390 Critique · 9.1 · 25/09/2026

Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values...

CVE-2026-97063 Critique · 9.3 · 25/09/2026

X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners. Attackers can request codes...

CVE-2026-67404 Critique · 9.2 broadcom · rabbitmq_server · 23/09/2026

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, When no CA bundle is available, ssl_options/1 falls back to [{verify, verify_none}] with no warning. An attacker...

CVE-2026-67231 Critique · 9.1 broadcom · rabbitmq_server · 23/09/2026

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verify_fun that overrides {bad_cert, unknown_ca} / {bad_cert, selfsigned_peer}...

CVE-2026-86930 Critique · 9.1 claris · filemaker_server · 23/09/2026

An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially crafted image file to a container field to disclose process memory during thumbnail generation in FileMaker WebD...

CVE-2026-96755 Critique · 9.3 · 23/09/2026

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressio...

CVE-2026-95848 Critique · 9.3 moquette · moquette · 23/09/2026

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failur...

CVE-2026-17618 Critique · 9.8 ibm · financial_transaction_manager · 22/09/2026

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote unauthenticated attacker to view and modify sensitive information and cause a denial of service due to improper authorization.

CVE-2026-77987 Critique · 9.3 github · enterprise_server · 22/09/2026

A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port...

CVE-2026-28324 Critique · 9.8 · 22/09/2026

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks. Installations configured in a non-default and non-secure c...

CVE-2026-89276 Critique · 9.9 adobe · campaign · 22/09/2026

Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged at...

CVE-2026-83660 Critique · 10.0 adobe · campaign · 22/09/2026

Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-82443 Critique · 9.9 adobe · campaign · 22/09/2026

Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access...

CVE-2026-82009 Critique · 9.1 adobe · campaign · 22/09/2026

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the curren...

CVE-2026-95654 Critique · 9.1 · 22/09/2026

Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validity during acceptance. Attackers with a leaked or forwarded in...

CVE-2026-93952 Critique · 9.5 KEV Arista · VeloCloud Orchestrator · 22/09/2026

Arista VeloCloud Orchestrator Improper Input Validation Vulnerability

CVE-2026-84869 Critique · 9.9 KEV ConnectWise · ScreenConnect · 08/09/2026

ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

Sources : NVD (NIST), CISA KEV, FIRST EPSS. Dernière mise à jour : 23/10/2026 05:07. Les analyses en français sont générées par IA et peuvent contenir des erreurs : vérifiez toujours l'avis de l'éditeur.