Cette semaine (2026-W46)
Ce récapitulatif met en évidence les vulnérabilités exploitées connues nouvellement ajoutées affectant l'infrastructure serveur pour la semaine 2026-W46. La priorité est accordée aux logiciels actifs sur notre site et aux vulnérabilités ayant des scores EPSS élevés.
- CVE-2026-114713 — Elle affecte le logiciel UnrealIRCd présent sur notre site, permettant aux utilisateurs des serveurs liés d'injecter des commandes de serveur à serveur exécutées avec l'autorité du serveur.
- CVE-2026-123158 — Elle détient le score EPSS le plus élevé de la semaine et permet un contournement de l'authentification dans OpenBSD OpenSSH fonctionnant sous Linux.
- CVE-2026-116606 — Un attaquant distant non authentifié peut contourner l'authentification sur Barracuda ESG pour invoquer une fonction d'importation de configuration et modifier la configuration globale de l'équipement.
- CVE-2026-111560 — Elle permet à un administrateur authentifié d'injecter des commandes du système d'exploitation qui s'exécutent avec les privilèges root sur plusieurs produits Barracuda Networks.
Ajouts récents
| CVE | Titre | CVSS | Exploitée | EPSS | Publication |
|---|---|---|---|---|---|
| CVE-2026-123039 | Local privilege escalation to root in the DynamicCLI daemon via local world-writable control socket | 7.8 | KEV | 2.2% | 2026-11-12 |
| CVE-2026-114713 | The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag w... | 8.6 | KEV | 0.5% | 2026-11-08 |
| CVE-2026-125350 | Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary c... | 8.8 | KEV | 1.0% | 2026-11-11 |
| CVE-2026-116606 | Authentication Bypass Allows Global Configuration Restore in Barracuda Email Security Gateway | 9.3 | KEV | 10.9% | 2026-11-02 |
| CVE-2026-111560 | OS Command Injection in Barracuda Appliances | 8.6 | KEV | 9.1% | 2026-11-02 |
| CVE-2026-111793 | Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the... | 4.3 | KEV | 0.6% | 2026-10-17 |
| CVE-2026-124194 | Microsoft Outlook Spoofing Vulnerability | 6.5 | KEV | 1.6% | 2026-11-11 |
| CVE-2026-20320 | A vulnerability in the Open Client Interface (OCI) XML Parser of Cisco BroadWorks could allow an unauthenticat... | 7.5 | KEV | 1.0% | 2026-08-20 |
| CVE-2026-123218 | IBM Aspera Faspex Authorization Bypass | 9.8 | KEV | 0.5% | 2026-11-07 |
| CVE-2026-116779 | FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands | 9.8 | KEV | 2.5% | 2026-11-06 |
| CVE-2026-123158 | sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password... | 8.1 | KEV | 18.9% | 2026-11-05 |
| CVE-2026-102895 | GPUStack: Authentication bypass via trusted loopback source (reverse-proxy TCP peer or X-GPUStack-Real-IP head... | 9.8 | KEV | 0.5% | 2026-11-05 |
| CVE-2026-19868 | An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials... | 7.5 | KEV | 0.5% | 2026-11-07 |
| CVE-2024-27834 | The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8... | 5.5 | KEV | 1.5% | 2024-05-14 |
| CVE-2026-119977 | WordPress Core 4.7.0 - 7.1.3 - Unauthenticated Upgrade-Window Staged-Installer Remote Code Execution | 8.1 | KEV | 1.2% | 2026-10-31 |
| CVE-2026-111357 | Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuratio... | 7.0 | KEV | 0.5% | 2026-10-16 |
| CVE-2026-118527 | Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote au... | 4.3 | KEV | 0.8% | 2026-11-03 |
| CVE-2026-76418 | Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SS... | 8.6 | KEV | 0.8% | 2026-10-29 |
| CVE-2026-97229 | Integer Overflow or Wraparound in GitLab | 10.0 | KEV | 69.3% | 2026-10-13 |
| CVE-2026-46300 | net: skbuff: preserve shared-frag marker during coalescing | 7.8 | KEV | 16.1% | 2026-05-23 |
| CVE-2026-41709 | ESX insufficient logging vulnerability | 2.7 | KEV | 0.7% | 2026-07-30 |
| CVE-2026-111497 | Out-of-Bounds Write in Google Brotli Decoder | 9.2 | KEV | 82.6% | 2026-10-22 |
| CVE-2026-48356 | Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434) | 9.3 | KEV | 47.5% | 2026-07-15 |
| CVE-2026-109619 | RCE via stale global state | 9.2 | KEV | 100.0% | 2026-10-21 |
| CVE-2026-109618 | RCE via OOM corruption | 9.2 | KEV | 100.0% | 2026-10-21 |
| CVE-2026-110447 | Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code... | 9.2 | KEV | 73.3% | 2026-10-14 |
| CVE-2026-114625 | Security Advisory 0199 | 9.4 | KEV | 1.0% | 2026-10-23 |
| CVE-2026-110936 | A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected applica... | 8.4 | KEV | 1.0% | 2026-10-15 |
| CVE-2026-96652 | Plex Media Server SSRF | 5.3 | KEV | 11.9% | 2026-09-24 |
| CVE-2026-96654 | Plex Media Server URL injection | 6.9 | KEV | 12.7% | 2026-09-24 |
| CVE-2026-96655 | Plex Media Server arbitrary-host SSRF | 5.3 | KEV | 10.7% | 2026-09-24 |
| CVE-2026-96656 | Plex Media Server arbitrary file write | 8.6 | KEV | 19.8% | 2026-09-24 |
| CVE-2026-106931 | SiteGuard Server Edition contains an OS command injection vulnerability, which may allow an attacker to execut... | 8.5 | KEV | 2.5% | 2026-10-14 |
| CVE-2025-61624 | An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [CWE-22] vulnerability in Fo... | 5.4 | KEV | 1.4% | 2026-04-15 |
| CVE-2026-102764 | Improper Origin Validation in Internal Messaging Components of BeyondTrust Remote Support | 9.3 | KEV | 79.5% | 2026-10-16 |
| CVE-2026-21589 | This is a vulnerability in Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center,... | 9.3 | KEV | 99.7% | 2026-10-06 |
| CVE-2026-0322 | PAN-OS: Authenticated Remote Code Execution (RCE) in the Management Interface | 8.6 | KEV | 2.1% | 2026-10-15 |
| CVE-2026-105133 | Ahsay AhsayCBS API ApiStructsAction.java checkSysPwd improper authentication | 6.9 | KEV | 84.5% | 2026-10-04 |
| CVE-2026-76519 | Cisco Secure Email Gateway Arbitrary File Write Vulnerability | 9.8 | KEV | 6.2% | 2026-10-15 |
| CVE-2026-105134 | Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection | 10.0 | KEV | 81.8% | 2026-10-04 |
| CVE-2026-96951 | Windows Shell Security Feature Bypass Vulnerability | 8.8 | KEV | 9.8% | 2026-10-14 |
| CVE-2026-104935 | Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to e... | 8.6 | KEV | 88.9% | 2026-10-14 |
| CVE-2015-3306 | The mod_copy module in ProFTPD 1.3.5 allows remote attackers to read and write to arbitrary files via the site... | 10.0 | KEV | 99.5% | 2015-05-19 |
| CVE-2021-3199 | Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3... | 9.8 | KEV | 30.2% | 2021-01-22 |
| CVE-2023-22894 | Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by e... | 4.9 | KEV | 4.1% | 2023-04-19 |
| CVE-2016-3081 | Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is... | 8.1 | KEV | 96.9% | 2016-04-26 |
| CVE-2015-5477 | named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of... | 7.5 | KEV | 99.6% | 2015-07-29 |
| CVE-2026-88779 | Memory overflow vulnerability leading to Denial of Service | 8.7 | KEV | 11.4% | 2026-10-04 |
| CVE-2026-102489 | Undisclosed RCE in Zammad v6.3 and higher | 8.7 | KEV | 49.9% | 2026-10-01 |
| CVE-2026-102490 | Local privilege escalation in Zammad v1.5.0 to v7.2.2 installed via DEB or RPM package | 8.5 | KEV | 10.9% | 2026-10-01 |
| CVE-2026-104286 | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet Fo... | 9.8 | KEV | 4.6% | 2026-10-02 |
| CVE-2026-76504 | Cisco Catalyst SD-WAN Manager System Account Authorization Bypass Vulnerability | 9.8 | KEV | 38.9% | 2026-09-30 |
| CVE-2026-86950 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 18.7.11 a... | 8.8 | KEV | 26.2% | 2026-09-29 |
| CVE-2026-88771 | A remote code execution vulnerability exists due to improper input validation, which can allow an unauthentica... | 9.5 | KEV | 81.9% | 2026-09-28 |
| CVE-2026-88772 | Memory overflow vulnerability leading to Remote Code Execution or Denial of Service | 9.5 | KEV | 76.6% | 2026-09-28 |
| CVE-2026-87902 | An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable... | 8.1 | KEV | 95.8% | 2026-09-23 |
| CVE-2026-65660 | Microsoft SharePoint Server Remote Code Execution Vulnerability | 8.8 | KEV | 9.9% | 2026-08-12 |
| CVE-2026-67279 | SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS | 6.9 | KEV | 2.3% | 2026-09-06 |
| CVE-2026-71362 | Adobe Commerce | Incorrect Authorization (CWE-863) | 9.1 | KEV | 91.7% | 2026-08-12 |
| CVE-2026-5430 | Authentication Bypass via JWT Algorithm Mismatch in Multiple WSO2 Products Allows Account Takeover | 10.0 | KEV | 22.4% | 2026-08-06 |
| CVE-2026-85102 | Improper Certificate Validation in Quantum Security Gateway | 9.8 | KEV | 54.1% | 2026-09-09 |
| CVE-2026-93616 | Directory Traversal and File upload allows execution of arbitrary script on the Management Server | 9.8 | KEV | 91.6% | 2026-09-22 |
| CVE-2026-94127 | BIG-IP APM OAuth vulnerability | 9.3 | KEV | 26.6% | 2026-09-22 |
| CVE-2026-93952 | Security Advisory 0183 | 9.5 | KEV | 1.4% | 2026-09-22 |
| CVE-2026-7273 | A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions throug... | 8.8 | KEV | 2.7% | 2026-06-16 |
| CVE-2025-39682 | tls: fix handling of zero-length records on the rx_list | 9.8 | KEV | 3.3% | 2025-09-06 |
| CVE-2026-53266 | netfilter: bridge: make ebt_snat ARP rewrite writable | 8.8 | KEV | 0.9% | 2026-06-25 |
| CVE-2025-39964 | crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg | 7.8 | KEV | 1.6% | 2025-10-13 |
| CVE-2026-87886 | Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Back... | 7.8 | KEV | 0.2% | 2026-09-18 |
| CVE-2026-76460 | Cisco Identity Services Engine Authentication Bypass Vulnerability | 10.0 | KEV | 75.6% | 2026-09-17 |
| CVE-2026-58704 | In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to... | 8.8 | KEV | 0.6% | 2026-09-16 |
| CVE-2026-76461 | Cisco Secure Email Gateway SQL Injection Vulnerability | 9.8 | KEV | 40.2% | 2026-09-15 |
| CVE-2026-85706 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab | 10.0 | KEV | 97.4% | 2026-09-12 |
| CVE-2026-42018 | Anonymous user token generation exposure in JFrog Artifactory | 7.5 | KEV | 10.0% | 2026-08-13 |
| CVE-2026-42016 | Incorrect authorization validation of user token in JFrog Artifactory allows Privilege Escalation | 8.1 | KEV | 8.6% | 2026-07-28 |
| CVE-2026-84869 | ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions | 9.9 | KEV | 1.2% | 2026-09-09 |
| CVE-2026-67277 | Kernel memory disclosure and denial of service in MikroTik RouterOS btest service | 8.8 | KEV | 1.6% | 2026-09-06 |
| CVE-2026-86060 | SSH session privilege manipulation via a crafted username in Mikrotik RouterOS | 9.2 | KEV | 6.4% | 2026-09-06 |
| CVE-2026-20079 | Cisco Secure Firewall Management Center Authentication Bypass Remote Code Execution Vulnerability | 10.0 | KEV | 88.7% | 2026-03-05 |
| CVE-2026-87491 | Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitra... | 8.8 | KEV | 3.5% | 2026-09-09 |
| CVE-2025-25249 | A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.... | 7.4 | KEV | 3.7% | 2026-01-14 |
| CVE-2026-19490 | NetScaler ADC and NetScaler Gateway Security Bulletin for CVE-2026-19490 | 9.3 | KEV | 33.3% | 2026-08-19 |
| CVE-2026-85880 | Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability | 7.8 | KEV | 0.4% | 2026-09-09 |
| CVE-2026-86218 | pre-authentication remote code execution | 10.0 | KEV | 15.4% | 2026-09-06 |
| CVE-2026-81963 | Windows Update Stack Elevation of Privilege Vulnerability | 7.8 | KEV | 7.1% | 2026-09-09 |
| CVE-2026-75650 | Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) | 10.0 | KEV | 99.4% | 2026-09-08 |
| CVE-2026-85046 | Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary co... | 8.8 | KEV | 1.8% | 2026-09-04 |
| CVE-2026-83549 | Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')... | 7.8 | KEV | 9.9% | 2026-09-02 |
| CVE-2026-83548 | A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an uninten... | 10.0 | KEV | 8.0% | 2026-09-02 |
| CVE-2026-9586 | Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB | 9.3 | KEV | 19.0% | 2026-07-18 |
| CVE-2026-82329 | Potential authentication bypass leading to administrative access in Artifactory | 9.8 | KEV | 14.4% | 2026-08-29 |
| CVE-2026-49869 | Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in `AuthenticationFilter` | 10.0 | KEV | 2.1% | 2026-06-27 |
| CVE-2026-48710 | Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security chec... | 6.5 | KEV | 70.3% | 2026-05-27 |
| CVE-2026-59822 | LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback | 8.8 | KEV | 0.8% | 2026-07-09 |
| CVE-2026-81578 | PaperCut MF/NG: Authentication Bypass | 8.8 | KEV | 84.7% | 2026-08-28 |
| CVE-2026-82078 | PaperCut MF/NG: Unsafe Dynamic Class Loading in Database Connector | 9.4 | KEV | 63.0% | 2026-08-28 |
| CVE-2026-66384 | Authenticated users may write data outside the intended Docker cache path | 5.3 | KEV | 0.7% | 2026-08-13 |
| CVE-2026-53362 | ipv6: account for fraggap on the paged allocation path | 7.8 | KEV | 0.7% | 2026-07-04 |
| CVE-2023-49105 | An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete an... | 9.8 | KEV | 43.2% | 2023-11-21 |
| CVE-2019-1068 | A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of... | 8.8 | KEV | 57.3% | 2019-07-16 |
| CVE-2026-8452 | Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service | 8.8 | KEV | 1.0% | 2026-06-30 |
| CVE-2022-0995 | An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsys... | 7.8 | KEV | 8.9% | 2022-03-26 |
| CVE-2015-5287 | The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with ce... | 7.8 | KEV | 5.0% | 2015-12-08 |
| CVE-2015-3246 | libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, di... | 7.4 | KEV | 8.5% | 2015-08-11 |
| CVE-2021-23758 | Deserialization of Untrusted Data | 8.1 | KEV | 82.6% | 2021-12-04 |
| CVE-2026-60004 | Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation. | 9.8 | KEV | 24.0% | 2026-08-26 |
| CVE-2026-21962 | Vulnerability in the Oracle HTTP Server, Oracle Weblogic Server Proxy Plug-in product of Oracle Fusion Middlew... | 10.0 | KEV | 73.2% | 2026-01-21 |
| CVE-2026-73570 | A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zi... | 8.9 | KEV | 76.6% | 2026-08-14 |
| CVE-2026-72529 | A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to... | 9.3 | KEV | 1.5% | 2026-08-20 |
| CVE-2026-72530 | A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to... | 9.5 | KEV | 1.7% | 2026-08-20 |
| CVE-2026-64849 | MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTT... | 9.3 | KEV | 10.0% | 2026-08-18 |
| CVE-2026-65400 | An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate... | 9.8 | KEV | 18.1% | 2026-08-07 |
| CVE-2026-55040 | Microsoft SharePoint Server Security Feature Bypass Vulnerability | 9.1 | KEV | 69.5% | 2026-07-15 |
| CVE-2026-59310 | vCenter directory-traversal vulnerability | 9.8 | KEV | 61.7% | 2026-07-30 |
| CVE-2026-33824 | Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability | 9.8 | KEV | 77.4% | 2026-04-15 |
| CVE-2025-62593 | Ray is vulnerable to RCE via Safari & Firefox Browsers through DNS Rebinding Attack | 9.4 | KEV | 60.2% | 2025-11-27 |
| CVE-2026-72898 | Metabase SQL injection via password reset endpoint | 10.0 | KEV | 98.2% | 2026-08-10 |
| CVE-2026-68820 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | 7.0 | KEV | 8.6% | 2026-08-12 |
| CVE-2026-20349 | Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SS... | 8.6 | KEV | 1.0% | 2026-08-12 |
| CVE-2026-8037 | OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Objec... | 9.6 | KEV | 99.8% | 2026-06-04 |
| CVE-2026-63077 | In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the ag... | 9.8 | KEV | 94.9% | 2026-07-28 |
| CVE-2026-9198 | Unauthenticated Remote Code Execution via Auto-Login Bypass and Code Validation | 9.8 | KEV | 28.7% | 2026-07-18 |
| CVE-2026-34486 | Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor | 7.5 | KEV | 98.5% | 2026-04-10 |
| CVE-2026-18556 | Unauthenticated administrative account takeover | 8.2 | KEV | 43.9% | 2026-08-02 |
| CVE-2026-18577 | Incomplete patch leads to administrative account takeover | 8.2 | KEV | 14.6% | 2026-08-03 |
| CVE-2026-20316 | Cisco Secure Firewall Management Center Software Static Credential Vulnerability | 5.3 | KEV | 35.1% | 2026-07-30 |
| CVE-2026-16812 | VeloCloud Orchestrator OS Command Injection | 10.0 | KEV | 1.8% | 2026-07-28 |
| CVE-2025-68686 | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortine... | 5.3 | KEV | 29.5% | 2026-02-11 |
| CVE-2026-50522 | Microsoft SharePoint Remote Code Execution Vulnerability | 9.8 | KEV | 3.0% | 2026-07-15 |
| CVE-2026-16232 | Authentication Bypass in the SmartConsole Login Process Using an Application Token | 9.3 | KEV | 3.5% | 2026-07-22 |
| CVE-2021-27137 | An issue was discovered in router/upnp/src/ssdp.c in DD-WRT before 45724. An unsafe strcpy in the UPnP handlin... | 8.1 | KEV | 4.0% | 2026-07-16 |
| CVE-2026-0770 | Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerabi... | 9.8 | KEV | 62.6% | 2026-01-23 |
| CVE-2026-63030 | WordPress < 7.0.2 - REST API batch-route confusion and SQL injection issue leading to Remote Code Execution | 9.8 | KEV | 10.6% | 2026-07-18 |
| CVE-2026-60137 | WordPress < 7.0.2 - Facilitated SQL Injection via author__not_in in WP_Query | 5.9 | KEV | 5.3% | 2026-07-18 |
| CVE-2026-39808 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in... | 9.1 | KEV | 93.2% | 2026-04-15 |
| CVE-2026-25089 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in... | 9.1 | KEV | 76.1% | 2026-06-09 |
| CVE-2026-58644 | Microsoft SharePoint Remote Code Execution Vulnerability | 9.8 | KEV | 15.9% | 2026-07-15 |
| CVE-2023-4346 | KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation,... | 7.5 | KEV | 1.4% | 2023-08-30 |
| CVE-2026-46817 | Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Suppo... | 9.8 | KEV | 12.3% | 2026-05-29 |
| CVE-2026-15410 | Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identifie... | 7.2 | KEV | 11.8% | 2026-07-15 |
| CVE-2026-15409 | A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place int... | 10.0 | KEV | 6.8% | 2026-07-15 |
| CVE-2026-56164 | Microsoft SharePoint Server Elevation of Privilege Vulnerability | 5.3 | KEV | 27.3% | 2026-07-15 |
| CVE-2026-56155 | Active Directory Federation Services Elevation of Privilege Vulnerability | 7.8 | KEV | 0.3% | 2026-07-15 |
| CVE-2008-4128 | Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 1... | 8.1 | KEV | 33.9% | 2008-09-19 |
| CVE-2026-48939 | Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15 | 10.0 | KEV | 20.1% | 2026-06-20 |
| CVE-2026-56291 | Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 | 10.0 | KEV | 14.9% | 2026-07-09 |
| CVE-2026-48282 | ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) | 10.0 | KEV | 42.4% | 2026-07-01 |
| CVE-2026-56290 | Joomla Extension - joomlack.fr - Unauthenticated file upload in Page Builder CK extension < 3.6.0 | 10.0 | KEV | 30.9% | 2026-06-29 |
| CVE-2026-55255 | Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another... | 8.4 | KEV | 0.9% | 2026-06-24 |
| CVE-2026-48908 | Joomla Extension - joomshaper.com - Remote Code Execution in SP Pagebuilder extension for Joomla < 6.6.2 | 10.0 | KEV | 89.2% | 2026-06-20 |
| CVE-2026-45659 | Microsoft SharePoint Remote Code Execution Vulnerability | 8.8 | KEV | 80.2% | 2026-05-23 |
| CVE-2026-48558 | SimpleHelp Authentication Bypass via Missing OIDC JWT Signature Verification | 9.5 | KEV | 80.3% | 2026-06-13 |
| CVE-2026-20230 | Cisco Unified Communications Manager Server-Side Request Forgery Vulnerability | 8.6 | KEV | 88.5% | 2026-06-04 |
| CVE-2026-12569 | Remote Code Execution (RCE) vulnerability in Windchill PDMlink | 9.3 | KEV | 46.0% | 2026-06-18 |
| CVE-2026-34908 | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in U... | 10.0 | KEV | 88.9% | 2026-05-22 |
| CVE-2026-34909 | A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS de... | 10.0 | KEV | 69.2% | 2026-05-22 |
| CVE-2026-34910 | A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in... | 10.0 | KEV | 90.0% | 2026-05-22 |
| CVE-2025-67038 | Lantronix EDS5000, G520, and X300 OS Command Injection | 9.3 | KEV | 21.1% | 2026-03-11 |
| CVE-2026-20253 | Unauthenticated Arbitrary File Creation and Truncation in a PostgreSQL Sidecar Service Endpoint in Splunk Ente... | 9.8 | KEV | 96.9% | 2026-06-11 |
| CVE-2026-48907 | Joomla Extension - joomlacontenteditor.net - Remote Code Execution in JCE extension for Joomla < 2.9.99.5 | 10.0 | KEV | 85.4% | 2026-06-05 |
| CVE-2026-20262 | Cisco Catalyst SD-WAN Manager Arbitrary File Write Vulnerability | 6.5 | KEV | 29.1% | 2026-06-16 |
| CVE-2026-54420 | LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlin... | 8.5 | KEV | 1.4% | 2026-06-14 |
| CVE-2026-35273 | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Enviro... | 9.8 | KEV | 96.7% | 2026-06-11 |
| CVE-2026-10520 | An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows... | 10.0 | KEV | 99.9% | 2026-06-09 |
| CVE-2026-20245 | Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability | 7.8 | KEV | 25.3% | 2026-06-05 |
| CVE-2026-7473 | Arista EOS Unexpected Tunnel Protocol Decapsulation and Forwarding Bypass | 6.9 | KEV | 1.1% | 2026-06-06 |
| CVE-2026-11645 | Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execu... | 8.8 | KEV | 2.4% | 2026-06-09 |
| CVE-2026-50751 | User Authentication Bypass in VPN Remote Access and Mobile Access | 9.3 | KEV | 85.3% | 2026-06-08 |
| CVE-2026-42271 | LiteLLM: Authenticated command execution via MCP stdio test endpoints | 8.7 | KEV | 91.4% | 2026-05-08 |
| CVE-2026-28318 | SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability | 7.5 | KEV | 87.3% | 2026-06-04 |
| CVE-2026-45247 | Mirasvit Cache Warmer for Magento < 1.11.12 PHP Object Injection | 9.3 | KEV | 26.2% | 2026-05-26 |
| CVE-2025-48595 | In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This coul... | 8.4 | KEV | 2.0% | 2026-06-02 |
| CVE-2022-0492 | A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c fu... | 7.8 | KEV | 5.5% | 2022-03-03 |
| CVE-2024-21182 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported... | 7.5 | KEV | 74.2% | 2024-07-17 |
| CVE-2026-0257 | PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities | 7.8 | KEV | 95.6% | 2026-05-14 |
| CVE-2026-8398 | A supply chain attack compromised the official installation packages of DAEMON Tools Lite (Windows versions 12... | 9.3 | KEV | 1.5% | 2026-05-15 |
| CVE-2026-45321 | Malware in 42 @tanstack/* packages exfiltrates cloud credentials, GitHub tokens, and SSH keys | 9.6 | KEV | 3.3% | 2026-05-12 |
| CVE-2026-48027 | Compromised Nx Console version 18.95.0 | 9.3 | KEV | 1.8% | 2026-05-28 |
| CVE-2026-48172 | LiteSpeed User-End cPanel Plugin before 2.4.5 allows privilege escalation (possibly to root), as exploited in... | 10.0 | KEV | 17.9% | 2026-05-21 |
| CVE-2026-9082 | Drupal core - Highly critical - SQL injection - SA-CORE-2026-004 | 9.8 | KEV | 89.4% | 2026-05-21 |
| CVE-2026-34926 | A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local... | 6.7 | KEV | 13.4% | 2026-05-21 |
| CVE-2025-34291 | Langflow <= 1.6.9 CORS Misconfiguration to Token Hijack & RCE | 9.4 | KEV | 93.2% | 2025-12-06 |
| CVE-2026-45498 | Microsoft Defender Denial of Service Vulnerability | 4.0 | KEV | 63.1% | 2026-05-20 |
| CVE-2026-41091 | Microsoft Defender Elevation of Privilege Vulnerability | 7.8 | KEV | 8.2% | 2026-05-20 |
| CVE-2010-0806 | Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6,... | 8.8 | KEV | 82.1% | 2010-03-11 |
| CVE-2010-0249 | Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP... | 8.8 | KEV | 91.9% | 2010-01-16 |
| CVE-2009-3459 | Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2... | 8.8 | KEV | 86.5% | 2009-10-13 |
| CVE-2009-1537 | Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft Direct... | 8.8 | KEV | 51.1% | 2009-05-30 |
| CVE-2008-4250 | The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1,... | 9.8 | KEV | 98.8% | 2008-10-24 |
| CVE-2026-42897 | Microsoft Exchange Server Spoofing Vulnerability | 8.1 | KEV | 70.7% | 2026-05-15 |
| CVE-2026-20182 | Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability | 10.0 | KEV | 91.1% | 2026-05-15 |
| CVE-2026-42208 | LiteLLM: SQL injection in Proxy API key verification | 9.3 | KEV | 89.4% | 2026-05-08 |
| CVE-2026-6973 | An Improper Input Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remotely... | 7.2 | KEV | 34.5% | 2026-05-08 |
| CVE-2026-0300 | PAN-OS: Unauthenticated user initiated Buffer Overflow Vulnerability in User-ID™ Authentication Portal | 9.3 | KEV | 41.7% | 2026-05-07 |
| CVE-2026-31431 | crypto: algif_aead - Revert to operating out-of-place | 7.8 | KEV | 98.1% | 2026-04-22 |
| CVE-2026-41940 | WebPros cPanel and WHM Authentication Bypass via Login Flow | 9.3 | KEV | 98.5% | 2026-04-30 |
| CVE-2026-32202 | Windows Shell Spoofing Vulnerability | 4.3 | KEV | 71.3% | 2026-04-15 |
| CVE-2024-1708 | Improper limitation of a pathname to a restricted directory (“path traversal”) | 8.4 | KEV | 95.4% | 2024-02-22 |
| CVE-2024-57726 | SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technician... | 9.9 | KEV | 66.4% | 2025-01-15 |
| CVE-2024-57728 | SimpleHelp remote support software v5.5.7 and before allows admin users to upload arbitrary files anywhere on... | 7.2 | KEV | 64.5% | 2025-01-15 |
Suivez ces versions sur vos propres serveurs
InfraGuard collecte les versions logicielles installées sur chaque serveur et signale celles qui présentent des vulnérabilités connues. Auto-hébergé : rien ne quitte votre réseau.
Source : CISA Known Exploited Vulnerabilities Catalog (CC0 1.0). Ce produit utilise des données de l’API du NVD, mais n’est ni approuvé ni certifié par le NVD. CVE® est une marque déposée de The MITRE Corporation ; les enregistrements CVE sont utilisés conformément aux conditions d’utilisation du CVE Program.