Vulnérabilités
Aggrégat CVE / GHSA / KEV / OSV — filtrage par étiquette et catégorie.
| ID | Titre | |
|---|---|---|
| CVE-2021-47959 |
|
WordPress Plugin WPGraphQL 1.3.5 contains a denial of service vulnerability that allows...
WordPress Plugin WPGraphQL 1.3.5 contains a denial of service vulnerability that allows...
|
| CVE-2021-47963 |
|
Anote 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to...
Anote 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to...
|
| CVE-2026-4094 |
|
The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to...
The FOX – Currency Switcher Professional for WooCommerce plugin for WordPress is vulnerable to...
|
| CVE-2026-46445 |
|
SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.
SOGo before 5.12.7, when PostgreSQL is used, allows SQL injection.
|
| CVE-2026-46446 |
|
SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored,...
SOGo before 5.12.7, when PostgreSQL or MariaDB is used, and cleartext passwords are stored,...
|
| CVE-2026-8321 |
|
A vulnerability was detected in inkeep agents 0.58.14. This vulnerability affects the function...
A vulnerability was detected in inkeep agents 0.58.14. This vulnerability affects the function...
|
| CVE-2026-45223 |
|
Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator user...
Crabbox before 0.9.0 contains an authentication bypass vulnerability in the coordinator user...
|
| CVE-2026-45224 |
|
Crabbox contains a path traversal vulnerability in the Islo provider's workspace path resolution
Crabbox contains a path traversal vulnerability in the Islo provider's workspace path resolution
|
| CVE-2026-41940 KEV |
|
[KEV] Vulnérabilité dans Webpros cpanel-whm-and-wp2-wordpress-squared (CVE-2026-41940)
vulnérabilité dans Webpros cpanel-whm-and-wp2-wordpress-squared (CVE-2026-41940). Risque d'opérations non autorisées ou de divulgation. Inscrit au CISA KEV — exploitation active confirmée.
|
| CVE-2024-1708 KEV |
|
[KEV] Traversée de chemin dans Connectwise screenconnect (CVE-2024-1708)
traversée de chemin dans Connectwise screenconnect (CVE-2024-1708). Risque d'opérations non autorisées ou de divulgation. Inscrit au CISA KEV — exploitation active confirmée.
|
| CVE-2024-57728 KEV |
|
[KEV] Traversée de chemin dans Simplehelp path-traversal (CVE-2024-57728)
traversée de chemin dans Simplehelp path-traversal (CVE-2024-57728). Risque d'opérations non autorisées ou de divulgation. Inscrit au CISA KEV — exploitation active confirmée.
|
| CVE-2026-39987 KEV |
|
[KEV] Vulnérabilité dans Marimo remote-attack (CVE-2026-39987)
vulnérabilité dans Marimo remote-attack (CVE-2026-39987). Risque d'opérations non autorisées ou de divulgation. Inscrit au CISA KEV — exploitation active confirmée.
|
| CVE-2026-20122 KEV |
|
[KEV] Vulnérabilité dans Cisco catalyst-sd-wan-manger (CVE-2026-20122)
vulnérabilité dans Cisco catalyst-sd-wan-manger (CVE-2026-20122). Risque d'opérations non autorisées ou de divulgation. Inscrit au CISA KEV — exploitation active confirmée.
|
| CVE-2025-2749 KEV |
|
[KEV] Traversée de chemin dans Kentico path-traversal (CVE-2025-2749)
traversée de chemin dans Kentico path-traversal (CVE-2025-2749). Risque d'opérations non autorisées ou de divulgation. Inscrit au CISA KEV — exploitation active confirmée.
|
| CVE-2025-48700 KEV |
|
[KEV] XSS (Cross-Site Scripting) dans Synacor zimbra-collaboration-suite-zcs (CVE-2025-48700)
XSS dans Synacor zimbra-collaboration-suite-zcs (CVE-2025-48700). Risque d'opérations non autorisées ou de divulgation. Inscrit au CISA KEV — exploitation active confirmée.
|
| CVE-2024-27199 KEV |
|
[KEV] Vulnérabilité dans Jetbrains teamcity (CVE-2024-27199)
vulnérabilité dans Jetbrains teamcity (CVE-2024-27199). Risque d'opérations non autorisées ou de divulgation. Inscrit au CISA KEV — exploitation active confirmée.
|
| CVE-2026-40316 |
|
OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Versions prior to 2.1.1 contain an RCE vulnerability in the .github/workflo...
OWASP BLT is a QA testing and vulnerability disclosure platform that encompasses websites, apps, git repositories, and more. Versions prior to 2.1.1 contain an RCE vulnerability in the .github/workflows/regenerate-migrations.yml workflow. The workflow uses the pull_request_target trigger to run with...
|
| CVE-2023-21529 KEV |
|
[KEV] Désérialisation non sécurisée dans Microsoft exchange-server (CVE-2023-21529)
vulnérabilité dans Microsoft exchange-server (CVE-2023-21529). Risque d'opérations non autorisées ou de divulgation. Inscrit au CISA KEV — exploitation active confirmée.
|
| CVE-2020-9715 KEV |
|
[KEV] Use-After-Free dans Adobe acrobat (CVE-2020-9715)
vulnérabilité dans Adobe acrobat (CVE-2020-9715). Risque d'opérations non autorisées ou de divulgation. Inscrit au CISA KEV — exploitation active confirmée.
|
| CVE-2026-34621 KEV |
|
[KEV] Vulnérabilité dans Adobe acrobat-and-reader (CVE-2026-34621)
vulnérabilité dans Adobe acrobat-and-reader (CVE-2026-34621). Risque d'opérations non autorisées ou de divulgation. Inscrit au CISA KEV — exploitation active confirmée.
|
| CVE-2026-4326 |
|
The Vertex Addons for Elementor plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.6.4. This is due to improper authorization enforcement in the activate...
The Vertex Addons for Elementor plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.6.4. This is due to improper authorization enforcement in the activate_required_plugins() function. Specifically, the current_user_can('install_plugins') capability check...
|
| CVE-2026-3243 |
|
The Advanced Members for ACF plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the create_crop function in all versions up to, and including, 1....
The Advanced Members for ACF plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the create_crop function in all versions up to, and including, 1.2.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...
|
| CVE-2026-35209 |
|
defu is software that allows uers to assign default properties recursively. Prior to version 6.1.5, applications that pass unsanitized user input (e.g. parsed JSON request bodies, database records, or...
defu is software that allows uers to assign default properties recursively. Prior to version 6.1.5, applications that pass unsanitized user input (e.g. parsed JSON request bodies, database records, or config files from untrusted sources) as the first argument to `defu()` are vulnerable to prototype...
|
| CVE-2026-1233 |
|
The Text to Speech for WP (AI Voices by Mementor) plugin for WordPress is vulnerable to sensitive information exposure in all versions up to, and including, 1.9.8. This is due to the plugin containing...
The Text to Speech for WP (AI Voices by Mementor) plugin for WordPress is vulnerable to sensitive information exposure in all versions up to, and including, 1.9.8. This is due to the plugin containing hardcoded MySQL database credentials for the vendor's external telemetry server in the `Mementor_TT...
|
| CVE-2026-3445 |
|
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to unauthorized membership payment bypass i...
The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to unauthorized membership payment bypass in all versions up to, and including, 4.16.11. This is due to a missing ownership verification on the...
|
| CVE-2026-4896 |
|
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and inclu...
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.25 via multiple AJAX actions including `wcfm_modify_order_status`, `delete_wcfm_article`,...
|
| CVE-2026-4350 |
|
The Perfmatters plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 2.5.9.1. This is due to the `PMCS::action_handler()` method proce...
The Perfmatters plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 2.5.9.1. This is due to the `PMCS::action_handler()` method processing the `$_GET['delete']` parameter without any sanitization, authorization check, or nonce verifi...
|
| CVE-2026-3502 KEV |
|
[KEV] Vulnérabilité dans Trueconf client (CVE-2026-3502)
vulnérabilité dans Trueconf client (CVE-2026-3502). Risque d'opérations non autorisées ou de divulgation. Inscrit au CISA KEV — exploitation active confirmée.
|
| CVE-2026-1618 |
|
Authentication Bypass Using an Alternate Path or Channel vulnerability in Universal Software Inc....
Authentication Bypass Using an Alternate Path or Channel vulnerability in Universal Software Inc....
|
| CVE-2020-37210 |
|
SpotIE 2.9.5 contains a denial of service vulnerability in the registration key input that allows attackers to crash the application. Attackers can generate a 1000-character buffer payload and paste i...
SpotIE 2.9.5 contains a denial of service vulnerability in the registration key input that allows attackers to crash the application. Attackers can generate a 1000-character buffer payload and paste it into the 'Key' field to trigger an application crash.
|
| CVE-2020-37211 |
|
SpotIM 2.2 contains a denial of service vulnerability that allows attackers to crash the application by inputting a large buffer in the registration name field. Attackers can generate a 1000-character...
SpotIM 2.2 contains a denial of service vulnerability that allows attackers to crash the application by inputting a large buffer in the registration name field. Attackers can generate a 1000-character payload and paste it into the 'Name' field to trigger an application crash.
|
| CVE-2020-37212 |
|
SpotMSN 2.4.6 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application. Attackers can generate a 1000-character payload and paste...
SpotMSN 2.4.6 contains a denial of service vulnerability in the registration name input field that allows attackers to crash the application. Attackers can generate a 1000-character payload and paste it into the 'Name' field to trigger an application crash.
|
| CVE-2026-1819 |
|
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')...
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')...
|
| CVE-2025-2155 |
|
Unrestricted Upload of File with Dangerous Type vulnerability in Echo Call Center Services Trade...
Unrestricted Upload of File with Dangerous Type vulnerability in Echo Call Center Services Trade...
|
| CVE-2025-64666 |
|
Vulnérabilité dans microsoft (CVE-2025-64666)
vulnérabilité dans microsoft (CVE-2025-64666). L'exploitation peut entraîner la prise de contrôle totale du système.
|
| CVE-2025-2411 |
|
Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft TaskPano...
Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft TaskPano...
|
| CVE-2025-2413 |
|
Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft ProKuafor...
Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft ProKuafor...
|
| CVE-2025-0610 |
|
Cross-Site Request Forgery (CSRF) vulnerability in Akınsoft QR Menü allows Cross Site Request...
Cross-Site Request Forgery (CSRF) vulnerability in Akınsoft QR Menü allows Cross Site Request...
|
| CVE-2025-53786 |
|
Contournement d'authentification dans microsoft (CVE-2025-53786)
contournement d'authentification dans microsoft (CVE-2025-53786). L'exploitation peut entraîner la prise de contrôle totale du système.
|
| CVE-2024-5971 |
|
A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not s...
A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not send the expected 0\r\n termination of the chunked response. This results in uncontrolled resource co...
|
| CVE-2024-27289 |
|
pgx is a PostgreSQL driver and toolkit for Go. Prior to version 4.18.2, SQL injection can occur when all of the following conditions are met: the non-default simple protocol is used; a placeholder for...
pgx is a PostgreSQL driver and toolkit for Go. Prior to version 4.18.2, SQL injection can occur when all of the following conditions are met: the non-default simple protocol is used; a placeholder for a numeric value must be immediately preceded by a minus; there must be a second placeholder for a s...
|
| CVE-2022-27224 |
|
An issue was discovered in Galleon NTS-6002-GPS 4.14.103-Galleon-NTS-6002.V12 4. An authenticated...
An issue was discovered in Galleon NTS-6002-GPS 4.14.103-Galleon-NTS-6002.V12 4. An authenticated...
|
| CVE-2021-41164 |
|
Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML
Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTML
|
| CVE-2020-7564 |
|
Vulnérabilité dans schneider-electric (CVE-2020-7564)
vulnérabilité dans schneider-electric (CVE-2020-7564). L'exploitation peut entraîner la prise de contrôle totale du système.
|
| CVE-2020-11111 |
|
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, an...
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).
|
| CVE-2020-11112 |
|
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/common...
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).
|
| CVE-2020-11113 |
|
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).
|
| CVE-2020-10969 |
|
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.
|
| CVE-2020-10968 |
|
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).
|
| CVE-2020-10672 |
|
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka...
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).
|