Base de données CVE

CVE-2026-21589 Critique · 9.3 KEV PoC Atlassian · Multiple Products · 05/10/2026

Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

CVE-2026-102428 Critique · 9.3 PoC ordasoft · joomla_cck · 05/10/2026

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector.

CVE-2026-105134 Critique · 9.3 KEV PoC Ahsay · AhsayCBS · 04/10/2026

Ahsay AhsayCBS Command Injection Vulnerability

CVE-2026-104286 Critique · 9.8 KEV PoC Fortinet · FortiMail · 01/10/2026

Fortinet FortiMail Path Traversal Vulnerability

CVE-2026-13043 Critique · 9.3 PoC watchguard · endpoint_security · 01/10/2026

A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and...

CVE-2026-102490 Critique · 9.4 KEV Zammad GmbH · Zammad · 30/09/2026

Zammad GmbH Zammad Improper Privilege Management Vulnerability

CVE-2026-102489 Critique · 9.4 KEV PoC Zammad GmbH · Zammad · 30/09/2026

Zammad GmbH Zammad Session Fixation Vulnerability

CVE-2026-102427 Critique · 10.0 PoC ordasoft · joomla_cck · 30/09/2026

Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no aut...

CVE-2026-100277 Critique · 9.8 jetbrains · youtrack · 30/09/2026

In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature

CVE-2026-100273 Critique · 9.8 jetbrains · youtrack · 30/09/2026

In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution

CVE-2026-100255 Critique · 9.8 jetbrains · teamcity · 30/09/2026

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset

CVE-2026-76570 Critique · 10.0 PoC joomcode · jc_tables · 30/09/2026

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any tas...

CVE-2026-76504 Critique · 9.8 KEV PoC Cisco · Catalyst SD-WAN Manager · 30/09/2026

Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

CVE-2026-103109 Critique · 9.4 pexip · pexip_infinity · 30/09/2026

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger memory corruption or a software abort resulting in a den...

CVE-2026-86131 Critique · 9.2 watchguard · fireware · 30/09/2026

A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebo...

CVE-2026-102828 Critique · 9.2 simple-git_project · simple-git · 29/09/2026

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not clas...

CVE-2026-102827 Critique · 9.8 PoC simple-git_project · simple-git · 29/09/2026

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option...

CVE-2026-102560 Critique · 9.8 gnome · libsoup · 29/09/2026

A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the all...

CVE-2026-102676 Critique · 9.8 electronjs · electron · 29/09/2026

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview> guest could enable nodeIntegrationInWorke...

CVE-2026-102425 Critique · 9.5 PoC balbooa · forms · 29/09/2026

Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature...

CVE-2026-73595 Critique · 9.8 dell · policy_manager_for_secure_connect_gateway · 29/09/2026

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with remote access co...

CVE-2026-102267 Critique · 9.1 pyjwt_project · pyjwt · 28/09/2026

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configure...

CVE-2026-102266 Critique · 9.1 pyjwt_project · pyjwt · 28/09/2026

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. Thi...

CVE-2026-101110 Critique · 9.3 PoC ordasoft · book_library · 28/09/2026

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6 - site/booklibrary.php’s books() function reads the field and direction request parameters and passes each through a function...

CVE-2026-101077 Critique · 9.3 · 28/09/2026

A flaw has been found in Netcore NR289-GE 1.4.5102. This impacts the function process_request of the component boa_temp Handler. This manipulation causes missing authentication. The attack is possible to be carried out r...

Sources : NVD (NIST), CISA KEV, FIRST EPSS. Dernière mise à jour : 23/10/2026 05:07. Les analyses en français sont générées par IA et peuvent contenir des erreurs : vérifiez toujours l'avis de l'éditeur.