Base de données CVE

CVE-2026-92414 Critique · 9.3 apache · jackrabbit · 07/10/2026

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token...

CVE-2026-16516 Critique · 9.0 wolfssh · wolfssh · 07/10/2026

wolfSSH does not validate that the ECDSA curve identifier in a KEXDH_REPLY host key blob matches the algorithm negotiated during key exchange. In ParseECCPubKey() (src/internal.c), the blob's algorithm string is used to...

CVE-2026-93675 Critique · 9.8 langflow · langflow · 07/10/2026

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to an expected dependency confusion.

CVE-2026-82162 Critique · 9.8 dell · command\|configure · 06/10/2026

Dell Command | Configure (DCC), versions prior to 5.2.3.35, contain an Improper Handling of Mixed Encoding vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leadi...

CVE-2026-106237 Critique · 9.6 google · chrome · 06/10/2026

Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)

CVE-2026-106195 Critique · 9.1 google · chrome · 06/10/2026

Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic. (Chromium security severity: Low)

CVE-2026-106218 Critique · 10.0 jetbrains · teamcity · 06/10/2026

In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible

CVE-2026-105863 Critique · 9.2 payloadcms · payload · 06/10/2026

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values...

CVE-2026-105851 Critique · 9.3 payloadcms · payload · 06/10/2026

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the duplicate operation copies values from a source document even whe...

CVE-2026-67273 Critique · 9.6 dell · container_storage_modules · 06/10/2026

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker with remote access could potentially...

CVE-2026-63691 Critique · 9.6 dell · container_storage_modules · 06/10/2026

Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authorization vulnerability in the Dell CSI Driver for PowerMax - csireverseproxy . An unauthenticated attacker with adjacent network access...

CVE-2026-102490 Critique · 9.4 KEV Zammad GmbH · Zammad · 30/09/2026

Zammad GmbH Zammad Improper Privilege Management Vulnerability

CVE-2026-100277 Critique · 9.8 jetbrains · youtrack · 30/09/2026

In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature

CVE-2026-100273 Critique · 9.8 jetbrains · youtrack · 30/09/2026

In JetBrains YouTrack before 2026.2.19197 authorisation bypass in the scripts debugger allowed arbitrary code execution

CVE-2026-100255 Critique · 9.8 jetbrains · teamcity · 30/09/2026

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset

CVE-2026-103109 Critique · 9.4 pexip · pexip_infinity · 30/09/2026

Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger memory corruption or a software abort resulting in a den...

CVE-2026-86131 Critique · 9.2 watchguard · fireware · 30/09/2026

A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the remote VPN server to execute arbitrary commands as root on the connecting Firebo...

CVE-2026-102828 Critique · 9.2 simple-git_project · simple-git · 29/09/2026

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. From 3.15.0 until 4.0.1, the default blockUnsafeOperationsPlugin does not clas...

CVE-2026-102560 Critique · 9.8 gnome · libsoup · 29/09/2026

A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the all...

CVE-2026-102676 Critique · 9.8 electronjs · electron · 29/09/2026

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, and 44.0.0-beta.5, an Electron <webview> guest could enable nodeIntegrationInWorke...

CVE-2026-73595 Critique · 9.8 dell · policy_manager_for_secure_connect_gateway · 29/09/2026

Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, Versions prior to 5.36, contains a Download of Code Without Integrity Check vulnerability. An unauthenticated attacker with remote access co...

CVE-2026-102267 Critique · 9.1 pyjwt_project · pyjwt · 28/09/2026

PyJWT is a Python implementation of JSON Web Token standards. Prior to 2.14.0, PyJWT PyJWKClient is affected because redirect destinations are not revalidated against the JWKS trust boundary. This occurs when a configure...

CVE-2026-102266 Critique · 9.1 pyjwt_project · pyjwt · 28/09/2026

PyJWT is a Python implementation of JSON Web Token standards. From 2.13.0 until 2.14.0, HMACAlgorithm.from_jwk is affected because PyJWK verification path used the decoded key without applying prepare_key validation. Thi...

CVE-2026-101077 Critique · 9.3 · 28/09/2026

A flaw has been found in Netcore NR289-GE 1.4.5102. This impacts the function process_request of the component boa_temp Handler. This manipulation causes missing authentication. The attack is possible to be carried out r...

CVE-2026-101072 Critique · 9.3 · 28/09/2026

A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system of the file /ap_ip.cgi of the component CGI Handler. Such manipulation of the argument ip leads to os command injection....

Sources : NVD (NIST), CISA KEV, FIRST EPSS. Dernière mise à jour : 22/10/2026 16:55. Les analyses en français sont générées par IA et peuvent contenir des erreurs : vérifiez toujours l'avis de l'éditeur.