Base de données CVE

CVE-2026-109525 Moyenne · 5.5 · 13/10/2026

A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file changebookingstatus.php of the component submit2 Ha...

CVE-2026-5048 Moyenne · 6.1 broadcom · brocade_sannav · 08/10/2026

In Brocade SANnav before 3.0.0a, an SQL Injection vulnerability in various external API inventories have a vulnerability that allows an authenticated attacker to inject malicious data into some of the REST API -query par...

CVE-2026-94579 Moyenne · 5.4 broadcom · fabric_operating_system · 08/10/2026

An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup routines during SSH session termination on Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. A...

CVE-2026-94576 Moyenne · 5.9 broadcom · fabric_operating_system · 08/10/2026

An authentication logic and privilege escalation vulnerability exists in the account management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. Under specific conditions, an authenticat...

CVE-2026-94582 Moyenne · 6.8 broadcom · fabric_operating_system · 08/10/2026

A memory buffer overflow vulnerability exists in the internal diagnostic and route validation routines used by the Fabric Shortest Path First (FSPF) protocol component of Brocade Fabric OS versions before 10.0.1. While t...

CVE-2026-87665 Moyenne · 6.0 broadcom · fabric_operating_system · 08/10/2026

A stack-based buffer overflow vulnerability exists in the Internet Key Exchange (IKEv2) protocol handler on Brocade Fabric OS versions before 10.0.1. The vulnerability occurs when processing initial IKE key exchange requ...

CVE-2026-83742 Moyenne · 5.3 wolfssh · wolfssh · 07/10/2026

Unsigned integer underflow in wstrncat() in src/port.c in wolfSSL wolfSSH from v1.4.11 through v1.5.0 on non-Windows platforms allows an authenticated remote attacker to write one out-of-bounds null byte past the end of...

CVE-2026-81535 Moyenne · 6.3 wolfssh · wolfssh · 07/10/2026

In wolfSSH through 1.5.0 built with --enable-fwd, DoChannelOpen() in src/internal.c gates only direct-tcpip channel opens with the forwarding policy callback. forwarded-tcpip opens are admitted without an authorization c...

CVE-2026-106122 Moyenne · 6.0 vmware · rabbitmq_java_client · 06/10/2026

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, ValueReader.readShortstr decodes malformed UTF-8 bytes into replacement characters...

CVE-2026-105866 Moyenne · 6.9 payloadcms · payload · 06/10/2026

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an unauthenticated attacker who knows an account email address or username can a...

CVE-2026-105852 Moyenne · 6.9 payloadcms · payload · 06/10/2026

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can exp...

CVE-2026-105848 Moyenne · 6.4 payloadcms · payload · 06/10/2026

Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled option...

CVE-2026-105751 Moyenne · 6.9 docling · docling · 05/10/2026

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocument_backend.py uses the xlink:href attri...

CVE-2026-102779 Moyenne · 6.9 techfry · tf_content · 05/10/2026

Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task `records.custom_action` without authentication, ACL, CSR...

CVE-2026-102780 Moyenne · 6.9 techfry · tf_content · 05/10/2026

Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4 - The extension unconditionally authorizes both creation and editing in its public `RecordContro...

CVE-2026-105133 Moyenne · 5.5 KEV PoC Ahsay · AhsayCBS · 04/10/2026

Ahsay AhsayCBS Improper Authentication Vulnerability

CVE-2026-104637 Moyenne · 5.5 · 02/10/2026

A weakness has been identified in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The affected element is the function add_patient/add_physician/add_account/update_account/update_...

CVE-2026-103241 Moyenne · 5.5 vllm · vllm · 30/09/2026

A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead t...

CVE-2026-103229 Moyenne · 5.5 · 30/09/2026

A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqli_query of the file admin/delete1.php of the component Unauthe...

CVE-2026-86105 Moyenne · 6.0 watchguard · fireware · 30/09/2026

An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal user to access other web applications they are not authorized for by sending a sp...

CVE-2026-90906 Moyenne · 5.9 joomla · joomla\! · 29/09/2026

Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to XSS vulnerabilities in the link method of the HTML Helper.

CVE-2026-101066 Moyenne · 5.5 · 28/09/2026

A vulnerability was determined in dbgate up to 7.3.1. The impacted element is the function createLink of the file packages/api/src/controllers/archive.js of the component Archive Link Creation. This manipulation of the a...

CVE-2026-100748 Moyenne · 6.9 svenbluege · event_gallery · 27/09/2026

Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0

CVE-2026-89134 Moyenne · 6.3 wolfssl · wolfssl · 27/09/2026

A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constraint check. The CN-as-DNS fallback was gated on cert->subjectCN != NULL && cert->...

CVE-2026-100647 Moyenne · 6.9 vllm · vllm · 26/09/2026

vLLM versions before 0.29.0 contain a denial-of-service vulnerability in the cache_salt parameter accepted on OpenAI-compatible and Anthropic API endpoints, which lacks maximum length validation and is processed on the s...

Sources : NVD (NIST), CISA KEV, FIRST EPSS. Dernière mise à jour : 22/10/2026 16:55. Les analyses en français sont générées par IA et peuvent contenir des erreurs : vérifiez toujours l'avis de l'éditeur.