Base de données CVE

CVE-2026-102994 Élevée · 8.7 pypdf_project · pypdf · 30/09/2026

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/...

CVE-2026-102993 Élevée · 8.7 pypdf_project · pypdf · 30/09/2026

pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/_page_labels.py to generate excessively large numeral strings w...

CVE-2026-101885 Élevée · 8.5 · 30/09/2026

ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to validate the wasm_path manifest field. Attackers can convince users to install cr...

CVE-2026-101884 Élevée · 7.7 · 30/09/2026

OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GIT_CONFIG_*, DOTNET_STARTUP_HOOKS, and JAVA_TOOL_OPTIONS variables. Attackers with gateway or...

CVE-2026-101880 Élevée · 8.7 · 30/09/2026

OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShellWrapperParser fails to split commands on pipe operators or extract command sub...

CVE-2026-103474 Élevée · 8.7 · 30/09/2026

yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-access...

CVE-2026-100276 Élevée · 7.5 jetbrains · youtrack · 30/09/2026

In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action

CVE-2026-100262 Élevée · 7.1 jetbrains · youtrack · 30/09/2026

In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notification templates

CVE-2026-102578 Élevée · 8.8 moodle · moodle · 30/09/2026

A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly into database queries, resulting in a SQL (Structured Query Language) injection vul...

CVE-2026-86134 Élevée · 8.7 watchguard · fireware · 30/09/2026

A NULL pointer dereference vulnerability in the WatchGuard Fireware OS authentication process allows a remote, unauthenticated attacker to crash the management daemon by sending a specially request to the login interface...

CVE-2026-103101 Élevée · 7.5 pexip · pexip_infinity · 30/09/2026

Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to render a Pexip Infinity node inaccessible.

CVE-2026-90441 Élevée · 7.1 watchguard · fireware · 30/09/2026

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wg...

CVE-2026-86136 Élevée · 7.1 watchguard · fireware · 30/09/2026

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wg...

CVE-2026-86133 Élevée · 8.2 watchguard · fireware · 30/09/2026

An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IKEv2 handshake to crash the iked process by sending a specially crafted encrypted...

CVE-2026-86132 Élevée · 8.2 watchguard · fireware · 30/09/2026

An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the process by sending a specially crafted encrypted IKEv2 message negotiated with a...

CVE-2026-86128 Élevée · 8.2 watchguard · fireware · 30/09/2026

A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted IPv6 packet.

CVE-2026-86104 Élevée · 8.7 watchguard · fireware · 30/09/2026

An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to cause a denial of service by sending a specially crafted request.

CVE-2026-18145 Élevée · 8.6 watchguard · fireware · 30/09/2026

A stack-based buffer overflow vulnerability in the spamBlocker (spamd) service of WatchGuard Fireware OS allows an authenticated attacker with administrator privileges to crash the service or potentially execute arbitrar...

CVE-2026-13046 Élevée · 7.5 watchguard · fireware · 30/09/2026

A deserialization of untrusted data vulnerability in WatchGuard Fireware OS's SAML single sign-on session handling (samld) allows an attacker who has already obtained the ability to write files on the appliance to execut...

CVE-2026-84440 Élevée · 8.8 ibm · guardium_data_protection · 29/09/2026

IBM Guardium Data Protection 12.2 is vulnerable to command injection in the SNMP alert notification functionality. An authenticated attacker who can influence policy alert text can cause attacker-controlled data to be ex...

CVE-2026-102811 Élevée · 8.7 · 29/09/2026

Marmite through 0.4.2 contains missing authentication in the development server endpoints /__marmite__/content, /__marmite__/config, and /__marmite__/file/, allowing unauthenticated attackers to create, modify, and overw...

CVE-2026-102677 Élevée · 8.8 electronjs · electron · 29/09/2026

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From 42.3.3 until 42.10.0, 43.5.0, and 44.0.0-beta.6, Electron's sandboxed preload code cache did not verify that a...

CVE-2026-102559 Élevée · 8.6 gnome · libsoup · 29/09/2026

A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used t...

CVE-2026-92227 Élevée · 8.2 joomla · joomla\! · 29/09/2026

Joomla! Core - [20260914] - Core - MFA Authentication Bypass through rememberme cookies in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - The premature issuance of an rememberme cookie leads to a MFA bypass vulnerability.

CVE-2026-92222 Élevée · 8.9 joomla · joomla\! · 29/09/2026

Joomla! Core - [20260909] - Core - SSRF vectors in various core extensions in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 - URLs used for serverside requests were improperly validated, leading to SSRF vectors.

Sources : NVD (NIST), CISA KEV, FIRST EPSS. Dernière mise à jour : 22/10/2026 16:55. Les analyses en français sont générées par IA et peuvent contenir des erreurs : vérifiez toujours l'avis de l'éditeur.