Base de données CVE

CVE-2026-112780 Critique · 9.3 · 19/10/2026

Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by renaming Flex form fields with replace-name@. Attackers with page-edit permissi...

CVE-2026-112770 Élevée · 8.7 · 19/10/2026

Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non-string arrow arguments as callables without the checkArrow guard used by other...

CVE-2026-112775 Élevée · 8.7 · 19/10/2026

Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because users/verify-email does not invalidate them for active users. Attackers who obt...

CVE-2026-111693 Critique · 9.3 · 16/10/2026

DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can P...

CVE-2026-111663 Critique · 9.2 · 16/10/2026

Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, inclu...

CVE-2026-111643 Critique · 9.3 · 16/10/2026

Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpo...

CVE-2026-111638 Élevée · 8.3 · 16/10/2026

sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that allows authenticated non-admin users to obtain decrypted backend private SSH keys. Attackers can req...

CVE-2026-111633 Élevée · 8.8 · 16/10/2026

ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer tokens using a hard-coded HMAC-SHA256 signing key in JwtBearerDefaults.cs. Attackers...

CVE-2026-111613 Élevée · 8.7 · 16/10/2026

AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcD...

CVE-2026-111373 Moyenne · 6.9 freerdp · freerdp · 16/10/2026

FreeRDP before 3.32.0 contains a NULL pointer dereference vulnerability in the websocket transport that allows a malicious gateway to crash clients by sending zero-length pings. When the payload length is zero, websocket...

CVE-2026-111375 Moyenne · 6.3 freerdp · freerdp · 16/10/2026

FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles. Attackers...

Sources : NVD (NIST), CISA KEV, FIRST EPSS. Dernière mise à jour : 22/10/2026 16:55. Les analyses en français sont générées par IA et peuvent contenir des erreurs : vérifiez toujours l'avis de l'éditeur.