Base de données CVE

CVE-2026-109619 Critique · 9.2 PoC php · php · 21/10/2026

PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request me...

CVE-2026-109618 Critique · 9.2 PoC php · php · 21/10/2026

PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state...

CVE-2026-102764 Critique · 9.3 KEV PoC BeyondTrust · Remote Support · 15/10/2026

BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability

CVE-2026-76519 Critique · 9.8 KEV PoC Cisco · Secure Email Gateway · 14/10/2026

Cisco Secure Email Gateway Relative Path Traversal Vulnerability

CVE-2026-107806 Critique · 9.4 PoC nginxui · nginx_ui · 09/10/2026

Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure session can submit attacker-controlled portable backup key material and a matching m...

CVE-2026-82531 Critique · 9.2 PoC · 06/10/2026

Smarty before 4.5.8 and 5.x before 5.8.5 contains a code injection vulnerability where the top-level nocache_hash is never restored during extends:/multi-component template inheritance, leaving it null. Attackers can sup...

CVE-2026-21589 Critique · 9.3 KEV PoC Atlassian · Multiple Products · 05/10/2026

Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability

CVE-2026-102428 Critique · 9.3 PoC ordasoft · joomla_cck · 05/10/2026

Joomla Extension - ordasoft.com - Unauthenticated SQL injection in OrdaSoft Joomla CCK < 8.3.16 - The order column for records was user provided and not properly validated, leading to a SQL injection vector.

CVE-2026-105134 Critique · 9.3 KEV PoC Ahsay · AhsayCBS · 04/10/2026

Ahsay AhsayCBS Command Injection Vulnerability

CVE-2026-104286 Critique · 9.8 KEV PoC Fortinet · FortiMail · 01/10/2026

Fortinet FortiMail Path Traversal Vulnerability

CVE-2026-13043 Critique · 9.3 PoC watchguard · endpoint_security · 01/10/2026

A missing authentication vulnerability in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and...

CVE-2026-102489 Critique · 9.4 KEV PoC Zammad GmbH · Zammad · 30/09/2026

Zammad GmbH Zammad Session Fixation Vulnerability

CVE-2026-102427 Critique · 10.0 PoC ordasoft · joomla_cck · 30/09/2026

Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no aut...

CVE-2026-76570 Critique · 10.0 PoC joomcode · jc_tables · 30/09/2026

Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API controller performs no Joomla token validation and no authentication check on any tas...

CVE-2026-76504 Critique · 9.8 KEV PoC Cisco · Catalyst SD-WAN Manager · 30/09/2026

Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability

CVE-2026-102827 Critique · 9.8 PoC simple-git_project · simple-git · 29/09/2026

simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option...

CVE-2026-102425 Critique · 9.5 PoC balbooa · forms · 29/09/2026

Joomla Extension - balbooa.com - Unauthenticated RCE via field shortcode injection in Balbooa Forms < 2.4.3.4 - Balbooa Forms supports administrator-defined PHP code which runs after a public form submission. The feature...

CVE-2026-101110 Critique · 9.3 PoC ordasoft · book_library · 28/09/2026

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6 - site/booklibrary.php’s books() function reads the field and direction request parameters and passes each through a function...

CVE-2026-88773 Critique · 9.3 PoC citrix · netscaler_application_delivery_controller · 27/09/2026

Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 1...

CVE-2026-88772 Critique · 9.5 KEV PoC Citrix · NetScaler · 27/09/2026

Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

CVE-2026-88771 Critique · 9.5 KEV PoC Citrix · NetScaler · 27/09/2026

Citrix NetScaler Improper Input Validation Vulnerability

CVE-2026-97163 Critique · 10.0 PoC lomart · up · 26/09/2026

Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

CVE-2026-97161 Critique · 9.2 PoC lomart · up · 26/09/2026

Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

CVE-2026-97160 Critique · 9.4 PoC lomart · up · 26/09/2026

Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29

CVE-2026-94132 Critique · 9.5 PoC acymailing · acymailing · 26/09/2026

Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0 - MIME parts of incoming emails were saved to media/com_acym/upload/ with no e...

Sources : NVD (NIST), CISA KEV, FIRST EPSS. Dernière mise à jour : 22/10/2026 16:55. Les analyses en français sont générées par IA et peuvent contenir des erreurs : vérifiez toujours l'avis de l'éditeur.