Vulnérabilités citées
Les CVE mentionnées dans l’actualité, avec leur gravité. Un score élevé indique une faille sérieuse, mais pas forcément exploitée.
| CVE | Score | Description | Articles |
|---|---|---|---|
| CVE-2026-116606 | 9.3 | An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import fu… | 2 |
| CVE-2023-20198 Exploitée activement |
10 | Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed re… | 1 |
| CVE-2026-109593 | 9.1 | An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive inf… | 1 |
| CVE-2026-58868 | 9.8 | In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additiona… | 1 |
| CVE-2026-63017 | 9.4 | Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators. | 1 |
| CVE-2026-63774 | 9.4 | Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands. | 1 |
| CVE-2026-98432 | 9.8 | In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownershi… | 2 |
| CVE-2026-58115 | 10 | A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2… | 1 |
| CVE-2026-81648 | 10 | The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invok… | 1 |
| CVE-2026-97229 Exploitée activement |
10 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, … | 1 |
| CVE-2026-111497 Exploitée activement |
9.2 | A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated atta… | 1 |
| CVE-2026-114595 | 9.3 | In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of … | 1 |
| CVE-2026-16436 | 9.2 | Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONI… | 1 |
| CVE-2026-16438 | 9.4 | Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versio… | 1 |
| CVE-2026-48356 Exploitée activement |
9.3 | Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current… | 1 |
| CVE-2026-109618 Exploitée activement |
9.2 | PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario … | 2 |
| CVE-2026-109619 Exploitée activement |
9.2 | PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being re… | 2 |
| CVE-2026-110447 Exploitée activement |
9.2 | Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and Octobe… | 1 |
| CVE-2026-114625 Exploitée activement |
9.4 | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host… | 1 |
| CVE-2023-28531 | 9.8 | ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. The earliest affected version is 8.9. | 1 |
| CVE-2025-71316 | 9.2 | SQLite 'sqldiff.exe' does not securely handle the way the Microsoft Windows C runtime converts Unicode characters to ANSI codepages. An attacker could use the '-L' optio… | 1 |
| CVE-2026-107861 | 9.4 | The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquot… | 1 |
| CVE-2026-109122 | 9.4 | The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An… | 1 |
| CVE-2026-110243 | 9.4 | The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configur… | 1 |
| CVE-2026-111594 | 9.2 | InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view transmitted data and use that data to log into the device. | 1 |
This product uses data from the NVD API but is not endorsed or certified by the NVD.