Vulnérabilités citées
Les CVE mentionnées dans l’actualité, avec leur gravité. Un score élevé indique une faille sérieuse, mais pas forcément exploitée.
| CVE | Score | Description | Articles |
|---|---|---|---|
| CVE-2026-123158 | 8.1 | sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misinterpretation of wheth… | 3 |
| CVE-2026-83844 | 8.1 | Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network. | 1 |
| CVE-2026-19868 | 7.5 | An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authen… | 1 |
| CVE-2026-116606 | 9.3 | An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import fu… | 2 |
| CVE-2023-20198 Exploitée activement |
10 | Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed re… | 1 |
| CVE-2026-109518 | 7.7 | On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT clie… | 1 |
| CVE-2024-27834 Exploitée activement |
5.5 | The issue was addressed with improved checks. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, wa… | 2 |
| CVE-2026-109593 | 9.1 | An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive inf… | 1 |
| CVE-2000-0411 | 5 | Matt Wright's FormMail CGI script allows remote attackers to obtain environmental variables via the env_report parameter. | 1 |
| CVE-2026-58868 | 9.8 | In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additiona… | 1 |
| CVE-2026-119977 Exploitée activement |
8.1 | WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3. This is due to predictable, web-accessible staging paths used during full-package cor… | 2 |
| CVE-2026-63774 | 9.4 | Insufficient input validation in the PowerSYSTEM Center report designer allows an authenticated user to execute unauthorized SQL commands. | 1 |
| CVE-2026-63017 | 9.4 | Incorrect authorization in PowerSYSTEM Center allows a low-privileged, authenticated user to access resources normally limited to administrators. | 1 |
| CVE-2026-98432 | 9.8 | In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after an RCU grace period tcp_v4_syn_recv_sock() transfers ownershi… | 2 |
| CVE-2026-58115 | 10 | A vulnerability has been identified in SIMATIC IoT2050 Advanced (6ES7647-0BA00-1YA2) (All versions < V4.3.4-1 running Industrial OS with Node-RED installed), SIMATIC IoT2… | 1 |
| CVE-2026-81648 | 10 | The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invok… | 1 |
| CVE-2026-118527 Exploitée activement |
4.3 | Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlle… | 1 |
| CVE-2026-111357 Exploitée activement |
7 | Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploite… | 1 |
| CVE-2026-97229 Exploitée activement |
10 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, … | 1 |
| CVE-2026-89209 | 7.6 | A vulnerability has been identified in Mendix SAML (Mendix 10 compatible) (All versions < V4.2.4), Mendix SAML (Mendix 11 compatible) (All versions < V4.2.4), Mendix SAML… | 1 |
| CVE-2026-76418 Exploitée activement |
8.6 | A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) So… | 1 |
| CVE-2026-43284 | 8.8 | In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe … | 1 |
| CVE-2026-13162 | 7.7 | An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the d… | 1 |
| CVE-2026-10756 | 7.7 | TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localho… | 1 |
| CVE-2026-106087 | 8.7 | TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitrary files on the affected devic… | 1 |
This product uses data from the NVD API but is not endorsed or certified by the NVD.