Base de données CVE

CVE-2026-102424 Élevée · 8.9 balbooa · forms · 29/09/2026

Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms < 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during...

CVE-2026-101127 Élevée · 8.6 balbooa · forms · 29/09/2026

Joomla Extension - balbooa.com - Unauthenticated upload filename stored XSS in Balbooa Forms < 2.4.3.4 - The public form upload endpoint validates the uploaded file's extension and detected MIME type, but stores the atta...

CVE-2026-97689 Élevée · 8.9 python · urllib3 · 29/09/2026

urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size...

CVE-2026-97687 Élevée · 7.6 python · urllib3 · 29/09/2026

urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_...

CVE-2026-102566 Élevée · 8.5 · 29/09/2026

CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allocated buffer size. Attackers can craft malicious model files with oversized payl...

CVE-2026-73597 Élevée · 8.1 dell · policy_manager_for_secure_connect_gateway · 29/09/2026

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cross-Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vu...

CVE-2026-73594 Élevée · 8.8 dell · policy_manager_for_secure_connect_gateway · 29/09/2026

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access...

CVE-2026-96423 Élevée · 7.1 wireshark · wireshark · 29/09/2026

X11 protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

CVE-2026-96419 Élevée · 7.8 wireshark · wireshark · 29/09/2026

Profile import crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service and possible code execution

CVE-2026-95387 Élevée · 8.8 wireshark · wireshark · 29/09/2026

SPDY protocol dissector crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service

CVE-2026-102275 Élevée · 8.2 pyjwt_project · pyjwt · 28/09/2026

PyJWT is a Python implementation of JSON Web Token standards. From 2.1.0 until 2.15.0, PyJWT OKPAlgorithm.from_jwk in jwt/algorithms.py is affected because private-JWK import path does not compare the public key derived...

CVE-2026-102274 Élevée · 7.5 pyjwt_project · pyjwt · 28/09/2026

PyJWT is a Python implementation of JSON Web Token standards. From 2.9.0 until 2.14.0, PyJWKSet does not catch the plain ValueError raised for malformed RSA JWK components by RSAAlgorithm.from_jwk in jwt/api_jwk.py. Thi...

CVE-2026-101918 Élevée · 7.5 pyjwt_project · pyjwt · 28/09/2026

PyJWT is a Python implementation of JSON Web Token standards. From 2.0.0a1 until 2.15.0, PyJWT PyJWKClient.get_signing_key_from_jwt is affected because payload parser catches ValueError but not RecursionError. This occur...

CVE-2026-101917 Élevée · 7.5 pyjwt_project · pyjwt · 28/09/2026

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT get_signing_key_from_jwt is affected because unknown kid misses force refreshes without a negative cache or minimum refresh interval. T...

CVE-2026-86950 Élevée · 8.8 KEV PoC Apple · Multiple Products · 28/09/2026

Apple Multiple Products Out-of-Bounds Write Vulnerability

CVE-2026-75600 Élevée · 8.6 sangoma · freepbx · 28/09/2026

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access t...

CVE-2026-54710 Élevée · 8.6 sangoma · freepbx · 28/09/2026

FreePBX is an open source IP PBX. Prior to versions 16.0.40 and 17.0.7, a critical remote code execution (RCE) vulnerability exists in the superfecta module due to unsafe inclusion of arbitrary PHP files, allowing authen...

CVE-2026-54708 Élevée · 8.6 sangoma · freepbx · 28/09/2026

FreePBX is an open source IP PBX. Prior to versions 16.0.72 and 17.0.7, a critical vulnerability exists in the FreePBX backup Module that allows authenticated attackers to execute arbitrary code on the server. Authentica...

CVE-2026-54675 Élevée · 8.7 sangoma · freepbx · 28/09/2026

FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the sound language upload and conversion functionality that allows an authenticated attacker to perform arbitrary...

CVE-2026-54674 Élevée · 8.6 sangoma · freepbx · 28/09/2026

FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel (UCP) are able to execute arbitrary commands on the PBX as the webserver user (typically asterisk) using...

CVE-2026-45562 Élevée · 7.7 sangoma · freepbx · 28/09/2026

FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold (MoH) module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands wit...

CVE-2026-101081 Élevée · 8.5 · 28/09/2026

A security flaw has been discovered in D-Link DI-8400 16.07. This vulnerability affects the function menu_nat_more_asp of the file menu_nat_more.asp of the component Web Administration Service. The manipulation of the ar...

CVE-2026-101038 Élevée · 8.6 · 28/09/2026

A vulnerability was determined in FAST FAC1200R 5.0_20201119_1.0.2. Affected by this vulnerability is the function MmtAtePrase of the component MmtAtePrase Parser. This manipulation causes stack-based buffer overflow. Re...

CVE-2026-88778 Élevée · 8.8 citrix · netscaler_application_delivery_controller · 27/09/2026

Predictable exact value from previous values vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.2...

CVE-2026-88777 Élevée · 8.8 citrix · netscaler_application_delivery_controller · 27/09/2026

Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDc...

Sources : NVD (NIST), CISA KEV, FIRST EPSS. Dernière mise à jour : 22/10/2026 16:55. Les analyses en français sont générées par IA et peuvent contenir des erreurs : vérifiez toujours l'avis de l'éditeur.