Base de données CVE

CVE-2026-100390 Critique · 9.1 · 25/09/2026

Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenticated attackers connecting over IPv6 can supply arbitrary X-Forwarded-For values...

CVE-2026-97063 Critique · 9.3 · 25/09/2026

X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys/email/code without sending them to account owners. Attackers can request codes...

CVE-2026-67404 Critique · 9.2 broadcom · rabbitmq_server · 23/09/2026

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, When no CA bundle is available, ssl_options/1 falls back to [{verify, verify_none}] with no warning. An attacker...

CVE-2026-67231 Critique · 9.1 broadcom · rabbitmq_server · 23/09/2026

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The trust-store plugin installs a verify_fun that overrides {bad_cert, unknown_ca} / {bad_cert, selfsigned_peer}...

CVE-2026-86930 Critique · 9.1 claris · filemaker_server · 23/09/2026

An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially crafted image file to a container field to disclose process memory during thumbnail generation in FileMaker WebD...

CVE-2026-96755 Critique · 9.3 · 23/09/2026

orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defaults into template literals. Attackers can inject arbitrary JavaScript expressio...

CVE-2026-95848 Critique · 9.3 moquette · moquette · 23/09/2026

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, when a configured authenticator or authorizator class cannot be loaded, Server.initializeAuthenticator and Server.initializeAuthorizatorPolicy treat the failur...

CVE-2026-17618 Critique · 9.8 ibm · financial_transaction_manager · 22/09/2026

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote unauthenticated attacker to view and modify sensitive information and cause a denial of service due to improper authorization.

CVE-2026-77987 Critique · 9.3 github · enterprise_server · 22/09/2026

A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer validated the scheme and host of a user-supplied URL but did not validate the port...

CVE-2026-28324 Critique · 9.8 · 22/09/2026

SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks. Installations configured in a non-default and non-secure c...

CVE-2026-89276 Critique · 9.9 adobe · campaign · 22/09/2026

Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged at...

CVE-2026-83660 Critique · 10.0 adobe · campaign · 22/09/2026

Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-82443 Critique · 9.9 adobe · campaign · 22/09/2026

Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access...

CVE-2026-82009 Critique · 9.1 adobe · campaign · 22/09/2026

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the curren...

CVE-2026-95654 Critique · 9.1 · 22/09/2026

Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-checking token validity during acceptance. Attackers with a leaked or forwarded in...

CVE-2026-93952 Critique · 9.5 KEV Arista · VeloCloud Orchestrator · 22/09/2026

Arista VeloCloud Orchestrator Improper Input Validation Vulnerability

CVE-2026-84869 Critique · 9.9 KEV ConnectWise · ScreenConnect · 08/09/2026

ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

CVE-2021-3199 Critique · 9.8 KEV ONLYOFFICE · Docs · 26/01/2021

ONLYOFFICE Docs Server Path Traversal Vulnerability

Sources : NVD (NIST), CISA KEV, FIRST EPSS. Dernière mise à jour : 22/10/2026 16:55. Les analyses en français sont générées par IA et peuvent contenir des erreurs : vérifiez toujours l'avis de l'éditeur.