Base de données CVE

CVE-2026-105850 Élevée · 8.8 payloadcms · payload · 06/10/2026

Payload is a free and open source headless content management system. In @payloadcms/plugin-ecommerce versions before 3.90.0 and canary versions before 4.0.0-canary.34, use of the Stripe payment adapter can allow a Strip...

CVE-2026-105849 Élevée · 7.7 payloadcms · payload · 06/10/2026

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in...

CVE-2026-76105 Élevée · 7.1 dell · container_storage_modules · 06/10/2026

Dell Container Storage Modules, versions prior to 1.18.0 contain(s) an Use of Insufficiently Random Values vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leadin...

CVE-2026-67270 Élevée · 7.4 dell · container_storage_modules · 06/10/2026

Dell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Improper Certificate Validation vulnerability in the proxy-server component. An unauthenticated adjacent network attacker could potentially explo...

CVE-2026-63690 Élevée · 7.4 dell · container_storage_modules · 06/10/2026

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability in the csi-powerflex; csi-powermax; csi-powerstore. An unauthenticated attacker with adjac...

CVE-2026-54472 Élevée · 7.5 dell · container_storage_modules · 06/10/2026

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Use of Hard-coded Credentials vulnerability in the csm-docs. An unauthenticated attacker with remote access could potentially exploit this vulnerabi...

CVE-2026-105841 Élevée · 7.7 · 06/10/2026

lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to execute commands by supplying crafted filenames. When lrz runs under a suffixed name...

CVE-2026-105759 Élevée · 7.5 vllm · vllm · 05/10/2026

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware records the raw HTTP method token as a Prometheus label for requests reaching register...

CVE-2026-105750 Élevée · 7.5 docling · docling · 05/10/2026

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.82.0 until 2.118.1, HTMLBackendOptions(render_page=True) permits file URLs because HTM...

CVE-2026-105745 Élevée · 7.8 docling · docling · 05/10/2026

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.27.0 until 2.131.0, Docling plugin factories in docling/models/factories/base_factory....

CVE-2026-105744 Élevée · 8.8 docling · docling · 05/10/2026

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into LatexBackendOptions(tikz_engine="tectonic")...

CVE-2026-104714 Élevée · 8.8 apache · struts · 05/10/2026

Concurrent execution using shared resource with improper synchronization ('race condition') vulnerability in Apache Struts. Where a localized message formats a date or time argument, the formatter retained for that messa...

CVE-2026-102775 Élevée · 8.7 phoca · phoca_cart · 05/10/2026

Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8 - Phoca Cart's order-file download endpoint does not verify the download tokens it asks for....

CVE-2026-88779 Élevée · 8.7 KEV Citrix · NetScaler · 04/10/2026

Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

CVE-2026-93875 Élevée · 7.2 · 02/10/2026

The JetAppointment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'friendlyTime' parameter in all versions up to, and including, 2.5.2.1 due to insufficient input sanitization and output escapi...

CVE-2026-17507 Élevée · 8.7 bouncycastle · bc-java · 02/10/2026

In Bouncy Castle for Java before 1.86, the MLS implementation (org.bouncycastle.mls) holds RFC 9420's uint32 leaf_index in a signed int, so a wire value with the top bit set decodes to a negative number. That is a legiti...

CVE-2026-12542 Élevée · 7.8 redhat · satellite · 01/10/2026

A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string...

CVE-2026-96658 Élevée · 8.8 redhat · satellite · 01/10/2026

A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods...

CVE-2026-103678 Élevée · 8.1 tnef_project · tnef · 01/10/2026

A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format (RTF) data. Because the application fails to properly validate input buf...

CVE-2026-103000 Élevée · 8.7 pypdf_project · pypdf · 30/09/2026

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide unusually large alphabetical page-label values that cause pypdf/_page_labels.py to generate strings beyond a reasonable...

CVE-2026-102999 Élevée · 8.7 pypdf_project · pypdf · 30/09/2026

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/_doc_common.py to reparse the full attachment...

CVE-2026-102998 Élevée · 8.7 pypdf_project · pypdf · 30/09/2026

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/_appearance_stream.py appearance-stream generation to repeat invariant selection-data...

CVE-2026-102997 Élevée · 8.7 pypdf_project · pypdf · 30/09/2026

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed /FlateDecode stream with padded data can force pypdf/filters.py to use inefficient byte-by-byte dec...

CVE-2026-102996 Élevée · 8.7 pypdf_project · pypdf · 30/09/2026

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an unusually large /Widths array, causing pypdf/_font.py Font._collect_tt_t1_charac...

CVE-2026-102995 Élevée · 8.7 pypdf_project · pypdf · 30/09/2026

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string tokens in a font /ToUnicode mapping, causing pypdf/_cmap.py parse_bfchar...

Sources : NVD (NIST), CISA KEV, FIRST EPSS. Dernière mise à jour : 22/10/2026 16:55. Les analyses en français sont générées par IA et peuvent contenir des erreurs : vérifiez toujours l'avis de l'éditeur.