Base de données CVE

CVE-2026-93449 Élevée · 8.8 langflow · langflow · 07/10/2026

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of code generation.

CVE-2026-93445 Élevée · 8.8 langflow · langflow · 07/10/2026

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper control of generation of code.

CVE-2026-93443 Élevée · 8.8 langflow · langflow · 07/10/2026

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in code.

CVE-2026-106583 Élevée · 7.8 openbsd · openssh · 07/10/2026

In ssh in OpenSSH before 10.6, a $ or \ character can occur in a command-line username, leading to injection.

CVE-2026-106509 Élevée · 8.8 linuxfoundation · backstage_plugin-techdocs-node · 06/10/2026

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs theme configuration in techdocs. When TechDocs is c...

CVE-2026-106505 Élevée · 8.5 linuxfoundation · backstage_plugin-techdocs-node · 06/10/2026

Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is affected by bypass of mkdocs configuration sanitizer in techdocs backend. Users wi...

CVE-2026-106555 Élevée · 7.5 openbsd · openssh · 06/10/2026

In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts.

CVE-2026-106553 Élevée · 7.5 openbsd · openssh · 06/10/2026

In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt.

CVE-2026-104048 Élevée · 8.1 fedoraproject · sssd · 06/10/2026

A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user...

CVE-2026-96890 Élevée · 8.7 github · enterprise_server · 06/10/2026

A Server-Side Request Forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed a repository contributor to cause the appliance to issue requests to attacker-controlled internal hosts, which co...

CVE-2026-71168 Élevée · 7.8 dell · system_update · 06/10/2026

Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with local access could potentially explo...

CVE-2026-63697 Élevée · 7.2 dell · system_update · 06/10/2026

Dell System Update, versions prior to 2.3.0.0, contains an Improper Certificate Validation vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Remote exec...

CVE-2026-106221 Élevée · 8.3 google · chrome · 06/10/2026

Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: L...

CVE-2026-106199 Élevée · 8.2 google · chrome · 06/10/2026

Incorrect authorization in Actor in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially bypass site isolation via a crafted HTML page. (Chr...

CVE-2026-106198 Élevée · 8.2 google · chrome · 06/10/2026

Missing authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security sever...

CVE-2026-106196 Élevée · 7.6 google · chrome · 06/10/2026

Missing authorization in Navigation in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Med...

CVE-2026-106188 Élevée · 7.1 google · chrome · 06/10/2026

Confused deputy in SignIn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity:...

CVE-2026-106121 Élevée · 7.5 vmware · rabbitmq_java_client · 06/10/2026

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read() fails to terminate when input ends inside...

CVE-2026-106219 Élevée · 7.5 jetbrains · teamcity · 06/10/2026

In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server

CVE-2026-105868 Élevée · 8.6 payloadcms · payload · 06/10/2026

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, local upload configurations that accept XML files can store an XML file and styl...

CVE-2026-105861 Élevée · 7.2 payloadcms · payload · 06/10/2026

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, authenticated external URL-based upload retrieval can forward authentication data to a redirected destinati...

CVE-2026-105860 Élevée · 7.1 payloadcms · payload · 06/10/2026

Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an...

CVE-2026-105856 Élevée · 8.6 payloadcms · payload · 06/10/2026

Payload is a free and open source headless content management system. Prior to 3.90.0 and 4.0.0-canary.34, an attacker with read and create or update access to a collection containing a json field or a blocks field with...

CVE-2026-105855 Élevée · 7.6 payloadcms · payload · 06/10/2026

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, the server fails to enforce a field-level access.update restriction on the passw...

CVE-2026-105854 Élevée · 8.7 payloadcms · payload · 06/10/2026

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, a malformed multipart request body can cause multipart Content-Type p...

Sources : NVD (NIST), CISA KEV, FIRST EPSS. Dernière mise à jour : 22/10/2026 16:55. Les analyses en français sont générées par IA et peuvent contenir des erreurs : vérifiez toujours l'avis de l'éditeur.