Vulnérabilités citées
Les CVE mentionnées dans l’actualité, avec leur gravité. Un score élevé indique une faille sérieuse, mais pas forcément exploitée.
| CVE | Score | Description | Articles |
|---|---|---|---|
| CVE-2026-46300 Exploitée activement |
7.8 | In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags… | 1 |
| CVE-2026-41709 Exploitée activement |
2.7 | VMware ESX contains an insufficient logging vulnerability. A malicious administrator could exploit this issue to perform certain operations without them being logged. | 1 |
| CVE-2026-48356 Exploitée activement |
9.3 | Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current… | 1 |
| CVE-2026-16438 | 9.4 | Incorrect Privilege Assignment vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, ICONICS Suite versions 10.97.3 and prior, Hyper Historian versio… | 1 |
| CVE-2026-16437 | 7.1 | Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONI… | 1 |
| CVE-2026-16436 | 9.2 | Weak Password Recovery Mechanism for Forgotten Password vulnerability in Mitsubishi Electric GENESIS versions 11.03 and prior, GENESIS64 versions 10.97.3 and prior, ICONI… | 1 |
| CVE-2026-114598 | 8.7 | In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of… | 1 |
| CVE-2026-114597 | 8.7 | In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of… | 1 |
| CVE-2026-114596 | 8.8 | In EPICS Base release 7.0.10 and prior, an improper validation of message length values during protocol parsing can trigger an integer overflow, resulting in an out-of-bo… | 1 |
| CVE-2026-114595 | 9.3 | In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of … | 1 |
| CVE-2026-111497 Exploitée activement |
9.2 | A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated atta… | 1 |
| CVE-2023-4863 Exploitée activement |
8.8 | Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafte… | 1 |
| CVE-2026-109619 Exploitée activement |
9.2 | PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being re… | 2 |
| CVE-2026-109618 Exploitée activement |
9.2 | PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario … | 2 |
| CVE-2026-114625 Exploitée activement |
9.4 | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host… | 1 |
| CVE-2026-110447 Exploitée activement |
9.2 | Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and Octobe… | 1 |
| CVE-2026-96616 | 8.3 | Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making the… | 1 |
| CVE-2026-92450 | 8.7 | The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string with… | 1 |
| CVE-2026-89208 | 6.9 | A vulnerability has been identified in Capital Embedded AR Classic 431-422 (All versions), Capital Embedded AR Classic R20-11 (All versions < V2303), Desigo PXC00-E.D (Al… | 1 |
| CVE-2026-89205 | 5.3 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform server-side authorization checks for requests to… | 1 |
| CVE-2026-89204 | 5.3 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to database queries used for subnet mana… | 1 |
| CVE-2026-89203 | 5.3 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly restrict access to various database queries, allowing us… | 1 |
| CVE-2026-89202 | 7.1 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform authorization checks for device disconnection re… | 1 |
| CVE-2026-89201 | 7.7 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in device group or facility n… | 1 |
| CVE-2026-89200 | 8.4 | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input in the Name and Value fields … | 1 |
This product uses data from the NVD API but is not endorsed or certified by the NVD.