Base de données CVE

CVE-2026-97785 Critique · 10.0 · 22/10/2026

Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-83938 Critique · 10.0 · 22/10/2026

Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-115384 Critique · 9.4 · 22/10/2026

Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback result types. Attackers...

CVE-2026-115377 Critique · 9.4 · 22/10/2026

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by planting symlinks in transferred volumes. Attac...

CVE-2026-115375 Critique · 9.4 · 22/10/2026

Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw stems from unvalidated dependent custom volume nam...

CVE-2026-115372 Critique · 9.0 · 22/10/2026

Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copy, and move operations. Attackers can set the option on a cus...

CVE-2026-115353 Critique · 9.2 · 22/10/2026

Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing in...

CVE-2022-51026 Critique · 9.3 · 22/10/2026

Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the...

CVE-2026-115324 Critique · 9.2 · 22/10/2026

mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, me...

CVE-2021-48016 Critique · 9.3 · 22/10/2026

DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer t...

CVE-2021-48014 Critique · 9.3 · 22/10/2026

FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can sen...

CVE-2026-114220 Critique · 9.3 · 22/10/2026

NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack by failing to validate the server certifica...

CVE-2026-114219 Critique · 9.1 · 22/10/2026

NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining user...

CVE-2026-114661 Critique · 9.0 · 22/10/2026

OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attacker...

CVE-2026-114575 Critique · 9.3 · 22/10/2026

A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executing a manipulation of the argument FileMd5 can lea...

CVE-2026-91403 Critique · 9.1 · 21/10/2026

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511, 8u511-perf, 11....

CVE-2026-114383 Critique · 9.3 · 21/10/2026

A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the component wireless.so. This manipulation of the argument macAddress caus...

CVE-2026-114382 Critique · 9.3 · 21/10/2026

A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecgi.cgi of the component lan.so. The manipulation of the argument Comment results...

CVE-2026-89035 Critique · 9.1 · 21/10/2026

MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session tokens across new ECDH sessions. The mak...

CVE-2026-109619 Critique · 9.2 PoC php · php · 21/10/2026

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request me...

CVE-2026-109618 Critique · 9.2 PoC php · php · 21/10/2026

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state...

CVE-2026-114403 Critique · 9.2 · 21/10/2026

PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to instantiate arbitrary PHP objects by supplying a crafted presentation file. Attackers can upload a ZIP c...

CVE-2026-113744 Critique · 9.3 · 21/10/2026

A security vulnerability has been detected in Tenda AC19 16.03.10.07. The impacted element is the function formSetFirewallCfg of the file /goform/SetFirewallCfg of the component httpd Web Management Service. Such manipul...

CVE-2026-114119 Critique · 9.3 · 21/10/2026

Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers...

CVE-2026-114108 Critique · 9.3 · 21/10/2026

HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is uns...

Sources : NVD (NIST), CISA KEV, FIRST EPSS. Dernière mise à jour : 23/10/2026 05:07. Les analyses en français sont générées par IA et peuvent contenir des erreurs : vérifiez toujours l'avis de l'éditeur.