Base de données CVE

CVE-2026-82093 Élevée · 8.8 ibm · datastage_on_cloud_pak_for_data · 24/09/2026

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to unsafe deserialization of untrusted data.

CVE-2026-81552 Élevée · 8.8 ibm · datastage_on_cloud_pak_for_data · 24/09/2026

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of environment variables.

CVE-2026-81549 Élevée · 7.7 ibm · datastage_on_cloud_pak_for_data · 24/09/2026

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of the X-Forwarded-Proto header.

CVE-2026-81545 Élevée · 8.8 ibm · datastage_on_cloud_pak_for_data · 24/09/2026

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of special elements used in an OS command.

CVE-2026-81539 Élevée · 8.8 ibm · datastage_on_cloud_pak_for_data · 24/09/2026

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of special elements used in an OS command.

CVE-2026-77874 Élevée · 8.6 · 24/09/2026

IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5.SP1, and 3.33.1 through 3.33.3.SP1 is vulnerable to SQL injection. A remote unauthenticated attacker could send specially crafted SQL statements, which could allow th...

CVE-2026-6730 Élevée · 7.8 ibm · concert · 23/09/2026

IBM Concert 1.0.0 through 3.0.0 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buffer and execute arbitrary code on the system.

CVE-2026-67232 Élevée · 8.2 broadcom · rabbitmq_server · 23/09/2026

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The cowboy WebSocket options at line 117 set compress => true, enabling RFC 7692 permessage-deflate negotiation....

CVE-2026-66079 Élevée · 8.2 broadcom · rabbitmq_server · 23/09/2026

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6, parse_array_primitive/2 for constructor 0x45 (list0) returns an element with byte-width B = 0. The enclosing array32 par...

CVE-2026-66070 Élevée · 7.6 broadcom · rabbitmq_server · 23/09/2026

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.17, 4.0.22, 4.1.13, and 4.2.6, match_origin/1 returned the bare reflected Origin and allowed credentials even when the wildcard "" was configured, so t...

CVE-2026-96656 Élevée · 8.6 KEV PoC Plex · Media Server · 23/09/2026

Plex Media Server External Control of File Name or Path Vulnerability

CVE-2026-95847 Élevée · 8.8 moquette · moquette · 23/09/2026

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, H2PersistentQueue derives a session's message-map name as queue_ plus the client ID and its metadata-map name as queue_ plus the client ID plus _meta. A durabl...

CVE-2026-95846 Élevée · 8.7 moquette · moquette · 23/09/2026

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH....

CVE-2026-95845 Élevée · 8.7 moquette · moquette · 23/09/2026

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, the broker does not enforce a maximum length for pending per-session message queues. When a fast publisher sends messages to a slow subscriber whose in-flight...

CVE-2026-95844 Élevée · 8.7 moquette · moquette · 23/09/2026

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before processing them through recursive CTrie insertion and matching operations. A remote c...

CVE-2026-95843 Élevée · 8.7 moquette · moquette · 23/09/2026

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractShareName before validating the complete $share/{shareName}/{to...

CVE-2026-95842 Élevée · 8.7 moquette · moquette · 23/09/2026

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. An MQTT command that raises an uncaught e...

CVE-2026-96611 Élevée · 7.8 ffmpeg · ffmpeg · 23/09/2026

FFmpeg before 9.0 has a signed integer overflow in libavformat/mov.c. In mov_read_ispe(), uint32_t width/height values from a crafted HEIF ispe box are stored into signed int fields without bounds checking, allowing valu...

CVE-2026-95676 Élevée · 7.4 watchguard · authentication_gateway · 23/09/2026

A missing/improper authentication vulnerability in the WatchGuard AuthPoint Gateway's LDAP Sync first-factor authentication allows a remote attacker to bypass single-factor password verification under non-default operati...

CVE-2026-91813 Élevée · 7.8 foxit · pdf_editor · 23/09/2026

A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows an update package to be replaced between download and high-privilege extraction due to insufficient file locking and integrity validation. This could e...

CVE-2026-91812 Élevée · 8.1 foxit · pdf_editor · 23/09/2026

A vulnerability in Foxit PDF Editor/Reader’s update mechanism allows man-in-the-middle attackers to bypass certificate validation and package integrity checks, potentially enabling arbitrary code execution with system pr...

CVE-2026-91803 Élevée · 7.8 foxit · pdf_editor · 23/09/2026

A local privilege escalation vulnerability exists in the updater of Foxit PDF Editor/Reader due to unsafe loading of dynamic-link libraries from a user-writable directory during high-privilege operations. A local attacke...

CVE-2026-18154 Élevée · 7.5 ibm · financial_transaction_manager · 22/09/2026

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to the use of a hard-coded or predictable cryptographic key.

CVE-2026-18153 Élevée · 7.1 ibm · financial_transaction_manager · 22/09/2026

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information and forge authentication tags due to the use of hard-coded cryptographic keys and i...

CVE-2026-18152 Élevée · 7.5 ibm · financial_transaction_manager · 22/09/2026

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to forge validly-signed messages due to improper verification of cryptographic signatures.

Sources : NVD (NIST), CISA KEV, FIRST EPSS. Dernière mise à jour : 22/10/2026 16:55. Les analyses en français sont générées par IA et peuvent contenir des erreurs : vérifiez toujours l'avis de l'éditeur.