Base de données CVE

CVE-2026-101072 Critique · 9.3 · 28/09/2026

A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system of the file /ap_ip.cgi of the component CGI Handler. Such manipulation of the argument ip leads to os command injection....

CVE-2026-88773 Critique · 9.3 PoC citrix · netscaler_application_delivery_controller · 27/09/2026

Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 1...

CVE-2026-88772 Critique · 9.5 KEV PoC Citrix · NetScaler · 27/09/2026

Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

CVE-2026-88771 Critique · 9.5 KEV PoC Citrix · NetScaler · 27/09/2026

Citrix NetScaler Improper Input Validation Vulnerability

CVE-2026-97163 Critique · 10.0 PoC lomart · up · 26/09/2026

Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

CVE-2026-97161 Critique · 9.2 PoC lomart · up · 26/09/2026

Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

CVE-2026-97160 Critique · 9.4 PoC lomart · up · 26/09/2026

Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

CVE-2026-94132 Critique · 9.5 PoC acymailing · acymailing · 26/09/2026

Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0 - MIME parts of incoming emails were saved to media/com_acym/upload/ with no e...

CVE-2026-94130 Critique · 9.3 PoC joomlaboat · youtube_gallery · 26/09/2026

Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3 - An SQL injection vulnerability in video search functionality and sorting allowed attackers to inject SQL commands i...

CVE-2026-100390 Critique · 9.1 · 25/09/2026

Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values...

CVE-2026-97063 Critique · 9.3 · 25/09/2026

X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners. Attackers can request codes...

CVE-2026-67404 Critique · 9.2 broadcom · rabbitmq_server · 23/09/2026

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, When no CA bundle is available, ssl_options/1 falls back to [{verify, verify_none}] with no warning. An attacker...

CVE-2026-67231 Critique · 9.1 broadcom · rabbitmq_server · 23/09/2026

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verify_fun that overrides {bad_cert, unknown_ca} / {bad_cert, selfsigned_peer}...

CVE-2026-86930 Critique · 9.1 claris · filemaker_server · 23/09/2026

An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially crafted image file to a container field to disclose process memory during thumbnail generation in FileMaker WebD...

CVE-2026-96755 Critique · 9.3 · 23/09/2026

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressio...

CVE-2026-95848 Critique · 9.3 moquette · moquette · 23/09/2026

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failur...

CVE-2026-17618 Critique · 9.8 ibm · financial_transaction_manager · 22/09/2026

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote unauthenticated attacker to view and modify sensitive information and cause a denial of service due to improper authorization.

CVE-2026-77987 Critique · 9.3 github · enterprise_server · 22/09/2026

A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port...

CVE-2026-28324 Critique · 9.8 · 22/09/2026

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks. Installations configured in a non-default and non-secure c...

CVE-2026-89276 Critique · 9.9 adobe · campaign · 22/09/2026

Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged at...

CVE-2026-83660 Critique · 10.0 adobe · campaign · 22/09/2026

Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-82443 Critique · 9.9 adobe · campaign · 22/09/2026

Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access...

CVE-2026-82009 Critique · 9.1 adobe · campaign · 22/09/2026

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the curren...

CVE-2026-95654 Critique · 9.1 · 22/09/2026

Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validity during acceptance. Attackers with a leaked or forwarded in...

CVE-2026-94127 Critique · 9.3 KEV PoC F5 · BIG-IP APM · 22/09/2026

F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability

Sources : NVD (NIST), CISA KEV, FIRST EPSS. Dernière mise à jour : 23/10/2026 05:07. Les analyses en français sont générées par IA et peuvent contenir des erreurs : vérifiez toujours l'avis de l'éditeur.