Base de données CVE

CVE-2026-109619 Critique · 9.2 PoC php · php · 21/10/2026

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request me...

CVE-2026-109618 Critique · 9.2 PoC php · php · 21/10/2026

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state...

CVE-2026-53995 Élevée · 8.8 PoC · 19/10/2026

MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal...

CVE-2026-102764 Critique · 9.3 KEV PoC BeyondTrust · Remote Support · 15/10/2026

BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

CVE-2026-110936 Élevée · 8.4 KEV PoC Siemens · Software Center · 15/10/2026

Siemens Software Center Uncontrolled Search Path Element Vulnerability

CVE-2026-0322 Élevée · 8.6 KEV PoC Palo Alto Networks · PAN-OS · 14/10/2026

Palo Alto Networks PAN-OS Code Injection Vulnerability

CVE-2026-76519 Critique · 9.8 KEV PoC Cisco · Secure Email Gateway · 14/10/2026

Cisco Secure Email Gateway Relative Path Traversal Vulnerability

CVE-2026-104935 Élevée · 8.6 KEV PoC Ivanti · Connect Secure · 13/10/2026

Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability

CVE-2026-107806 Critique · 9.4 PoC nginxui · nginx_ui · 09/10/2026

Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching m...

CVE-2026-82531 Critique · 9.2 PoC · 06/10/2026

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can sup...

CVE-2026-21589 Critique · 9.3 KEV PoC Atlassian · Multiple Products · 05/10/2026

Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

CVE-2026-102428 Critique · 9.3 PoC ordasoft · joomla_cck · 05/10/2026

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector.

CVE-2026-105134 Critique · 9.3 KEV PoC Ahsay · AhsayCBS · 04/10/2026

Ahsay AhsayCBS Command Injection Vulnerability

CVE-2026-105133 Moyenne · 5.5 KEV PoC Ahsay · AhsayCBS · 04/10/2026

Ahsay AhsayCBS Improper Authentication Vulnerability

CVE-2026-104286 Critique · 9.8 KEV PoC Fortinet · FortiMail · 01/10/2026

Fortinet FortiMail Path Traversal Vulnerability

CVE-2026-13043 Critique · 9.3 PoC watchguard · endpoint_security · 01/10/2026

A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and...

CVE-2026-102489 Critique · 9.4 KEV PoC Zammad GmbH · Zammad · 30/09/2026

Zammad GmbH Zammad Session Fixation Vulnerability

CVE-2026-102427 Critique · 10.0 PoC ordasoft · joomla_cck · 30/09/2026

Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no aut...

CVE-2026-76570 Critique · 10.0 PoC joomcode · jc_tables · 30/09/2026

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any tas...

CVE-2026-76504 Critique · 9.8 KEV PoC Cisco · Catalyst SD-WAN Manager · 30/09/2026

Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

CVE-2026-102827 Critique · 9.8 PoC simple-git_project · simple-git · 29/09/2026

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option...

CVE-2026-102425 Critique · 9.5 PoC balbooa · forms · 29/09/2026

Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature...

CVE-2026-86950 Élevée · 8.8 KEV PoC Apple · Multiple Products · 28/09/2026

Apple Multiple Products Out-of-Bounds Write Vulnerability

CVE-2026-101110 Critique · 9.3 PoC ordasoft · book_library · 28/09/2026

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6 - site/booklibrary.php’s books() function reads the field and direction request parameters and passes each through a function...

CVE-2026-88776 Élevée · 8.8 PoC citrix · netscaler_application_delivery_controller · 27/09/2026

Memory overflow vulnerability vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcP...

Sources : NVD (NIST), CISA KEV, FIRST EPSS. Dernière mise à jour : 22/10/2026 16:55. Les analyses en français sont générées par IA et peuvent contenir des erreurs : vérifiez toujours l'avis de l'éditeur.