Base de données CVE

CVE-2017-20287 Élevée · 8.7 · 22/10/2026

Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the jvfrm_spot_get_json AJAX action. Attackers can...

CVE-2026-114221 Moyenne · 5.9 · 22/10/2026

NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Basic Authentication challenge from an unvalidated source in the WebView under spec...

CVE-2026-114220 Critique · 9.3 · 22/10/2026

NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack by failing to validate the server certifica...

CVE-2026-114219 Critique · 9.1 · 22/10/2026

NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining user...

CVE-2026-114664 Élevée · 7.1 · 22/10/2026

Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the frappe.desk.doctype.event.event.get_events method, which fails to properly neutralize user-supplied input before including it in SQL que...

CVE-2026-114663 Élevée · 8.6 · 22/10/2026

Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parse_Name resolves their names in the using function's scope rather than at declaration. When a...

CVE-2026-114662 Élevée · 8.6 · 22/10/2026

Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API keys by choosing token request IDs. Attackers can create a token request via POS...

CVE-2026-114661 Critique · 9.0 · 22/10/2026

OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user to start, stop and query gateway tunnels without an administrative role. Attacker...

CVE-2026-114658 Élevée · 8.7 · 22/10/2026

Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors to obtain super user accounts. Attackers can define an invitation form granting...

CVE-2026-114656 Moyenne · 6.9 · 22/10/2026

Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients to skip client-certificate checks because negated Host matchers are counted as served domains. Attacke...

CVE-2026-114642 Élevée · 7.0 · 22/10/2026

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a client-connection slot not keyed by ServersTransport, so one service's TLS client configuration is reused for anot...

CVE-2026-114640 Élevée · 7.0 · 22/10/2026

Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards client-supplied Ssl-Client-* headers on the plaintext HTTP router. When ssl-redire...

CVE-2026-114639 Élevée · 7.0 · 22/10/2026

Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request preauthenticated with an Authorization: Negotiate token authenticates a socket in the globally shared backen...

CVE-2026-114638 Élevée · 7.0 · 22/10/2026

Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX provider that merges client CAs when auth-tls-secret names collide after dot-to-dash normalization. Attacker...

CVE-2026-114637 Élevée · 7.0 · 22/10/2026

Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fails to pin NTLM/Negotiate-authenticated backend connections to their frontend conn...

CVE-2026-114636 Élevée · 7.0 · 22/10/2026

Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated for ssl-passthrough Ingresses on non-TLS entry points never applies the Ingress's...

CVE-2026-114635 Élevée · 7.0 · 22/10/2026

Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped when request TLS state is nil. Unauthenticated clients can send HTTP/2 requests with the :scheme http...

CVE-2026-114577 Moyenne · 5.5 · 22/10/2026

A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the component Insertion Handler. The manipulation of the argument costomer_id/payme...

CVE-2026-114575 Critique · 9.3 · 22/10/2026

A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executing a manipulation of the argument FileMd5 can lea...

CVE-2026-76307 Élevée · 7.2 · 21/10/2026

In Splunk SOAR versions below 8.7.0, a user that holds a role with the Users and Roles view permission could use the Representational State Transfer (REST) API to infer authentication token values for other users. If the...

CVE-2026-76306 Élevée · 7.5 · 21/10/2026

In Splunk SOAR versions below 8.7.0, a user that has the "Observer" role could use query filters in the Representational State Transfer (REST) API to infer password hashes and authorization tokens for other users. The in...

CVE-2026-76291 Élevée · 8.8 · 21/10/2026

In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user that holds a role with the schedule_search capability could bypass the expected safeguards in the scheduled search workflow. The user could...

CVE-2026-114441 Moyenne · 5.5 · 21/10/2026

A weakness has been identified in oretnom23 php-travel-agency-system. This issue affects some unknown processing of the file admin/update.php. This manipulation of the argument action/full_name/visa_no/hiden/title/descri...

CVE-2026-114440 Moyenne · 5.5 · 21/10/2026

A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipulation of the argument costomer_id/ticket_id/payment_id/id/document_id/salary_id/...

CVE-2026-114439 Moyenne · 5.5 · 21/10/2026

A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file admin/session.php of the component Session Handler. Executing a manipulation of the a...

Sources : NVD (NIST), CISA KEV, FIRST EPSS. Dernière mise à jour : 22/10/2026 16:55. Les analyses en français sont générées par IA et peuvent contenir des erreurs : vérifiez toujours l'avis de l'éditeur.