VIGIE VULN · VULNERABILITY INTELLIGENCE
Toutes les CVE et les alertes, en Europe
La base de données qui assure au CLI VigieVuln des scans en toute autonomie.
416 349Vulnérabilités publiées
307 170Avis
Mises à jour des données : CVE List (cvelistV5) : CISA KEV : EPSS (FIRST.org) : ENISA EUVD : CERT-FR (ANSSI) : NVD (fkie-cad mirror) : OSV.dev :
Librairies hautement exposées
- github.com/labstack/echo/v4 Go
4.0.0 – < 4.16.1CRITICAL 9.1 CWE-444 Dissimulation de requête ou de réponse HTTP +1CVE-2026-118264 2 CVE critiques - github.com/labstack/echo/v5 Go
5.0.0 – < 5.4.1CRITICAL 9.1 CWE-444 Dissimulation de requête ou de réponse HTTP +1CVE-2026-118264 - com.xwiki.pro/xwiki-pro-macros Maven
1.13 – < 1.14.5CRITICAL 9.9 CWE-95 Injection via evalCVE-2026-44179 - mlflow PyPI
3.12.0rc0 – < 3.17.0CRITICAL 9.8 CWE-94 Injection de code +1CVE-2026-116692 28 CVE critiques - praisonai PyPI
4.2.1 – < 4.6.59CRITICAL 9.8 CWE-200 Exposition d'informations sensibles à un acteur non autorisé +2CVE-2026-57116 32 CVE critiques - github.com/bytebase/bytebase Go
< 1.0.1CRITICAL 9.3 CWE-290 Contournement d'authentification par usurpationCVE-2022-51026 - litellm PyPI
1.91.0 – < 1.100.4 ; 1.101.0 – < 1.101.3 ; 1.102.0 – < 1.102.2 ; …CRITICAL 9.9 CWE-269 Gestion incorrecte des privilèges +2CVE-2026-114612 8 CVE critiques - better-auth npm
1.4.0-beta.18 – < 1.7.7CRITICAL 9.1 CWE-287 Authentification incorrecteCVE-2026-114607 7 CVE critiques - brotli PyPI
1.0.3 – < 1.2.1CRITICAL 9.2 CWE-787 Écriture hors limites +1CVE-2026-111497 2 CVE critiques - brotlicffi PyPI
1.0.3 – < 1.2.1.0CRITICAL 9.2 CWE-787 Écriture hors limites +1CVE-2026-111497
Les vulns les plus exploitées
- CVE-2026-109619 CRITICAL 9.2 KEVPHP Group PHP
8.2.* – < 8.2.35 ; 8.3.* – < 8.3.36 ; 8.4.* – < 8.4.27 ; …RCE via stale global state - CVE-2026-109618 CRITICAL 9.2 KEVPHP Group PHP
8.2.* – < 8.2.35 ; 8.3.* – < 8.3.36 ; 8.4.* – < 8.4.27 ; …RCE via OOM corruption - CVE-2025-53770 CRITICAL 9.8 KEVMicrosoft Microsoft SharePoint Enterprise Server 2016
16.0.0 – < 16.0.5513.1001
+2 autresMicrosoft SharePoint Server Remote Code Execution Vulnerability - CVE-2024-7593 CRITICAL 9.8 KEVIvanti vTM
corrigé en 22.7R2, 22.2R1Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 … - CVE-2024-3400 CRITICAL 10.0 KEVPalo Alto Networks PAN-OS
10.2.0 – < 10.2.9-h1 ; 11.0.0 – < 11.0.4-h1 ; 11.1.0 – < 11.1.2-h3
+2 autresPAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect - CVE-2024-23897 CRITICAL 9.8 KEVorg.jenkins-ci.main/jenkins-core Maven
1.606 – < 2.426.3 ; 2.427 – < 2.440.1 ; 2.441 – < 2.442Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser tha… - CVE-2024-21893 HIGH 8.2 KEVIvanti ICS
9.1R18 ; 22.6R2
+1 autresA server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and … - CVE-2024-21887 CRITICAL 9.1 KEVIvanti ICS
9.1R18 ; 22.6R2
+1 autresA command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy … - CVE-2023-4966 CRITICAL 9.4 KEVCitrix NetScaler ADC
14.1 – < 8.50 ; 13.1 – < 49.15 ; 13.0 – < 92.19 ; …
+1 autresUnauthenticated sensitive information disclosure - CVE-2023-44487 HIGH 7.5 KEVgolang.org/x/net Go
< 0.17.0
+10 autresThe HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation c…
Ajouts récents au catalogue CISA KEV
- CVE-2026-46300 HIGH 7.8 KEVLinux Linux
cef401de7be8c4e155c6746bfccf721a4fa5fab9 – < 3599e6b3cc1ada96883d496a50a210d3afbb6987 ; cef401de7be8c4e155c6746bfccf721a4fa5fab9 – < 2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c ; cef401de7be8c4e155c6746bfccf721a4fa5fab9 – < 9d3e5fd19fe1063bf607219e8562fbd567b8e8d5 ; …
+1 autresnet: skbuff: preserve shared-frag marker during coalescing - CVE-2026-41709 LOW 2.7 KEVVMware Cloud Foundation
9.1.x.x ; 9.0.x.x ; 5.x – < 5.2.4
+3 autresESX insufficient logging vulnerability - CVE-2026-48356 CRITICAL 9.3 KEVAdobe Adobe Commerce
≤ 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18
+3 autresAdobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434) - CVE-2026-111497 CRITICAL 9.2 KEVbrotli PyPI
1.0.3 – < 1.2.1
+1 autresOut-of-Bounds Write in Google Brotli Decoder - CVE-2026-109619 CRITICAL 9.2 KEVPHP Group PHP
8.2.* – < 8.2.35 ; 8.3.* – < 8.3.36 ; 8.4.* – < 8.4.27 ; …RCE via stale global state - CVE-2026-109618 CRITICAL 9.2 KEVPHP Group PHP
8.2.* – < 8.2.35 ; 8.3.* – < 8.3.36 ; 8.4.* – < 8.4.27 ; …RCE via OOM corruption - CVE-2026-114625 CRITICAL 9.4 KEVArista Networks VeloCloud Orchestrator
5.2.0 – < 5.2.3.18 ; 6.1.0 – < 6.1.3.10 ; 6.4.0 – < 6.4.2.12Security Advisory 0199 - CVE-2026-110447 CRITICAL 9.2 KEVCollabora Collabora Online - Built-in CODE Server
< 26.4.303Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote c… - CVE-2026-96656 HIGH 8.6 KEVPlex Media Server
< 1.43.3.10861Plex Media Server arbitrary file write - CVE-2026-96655 MEDIUM 5.3 KEVPlex Media Server
< 1.43.3.10861Plex Media Server arbitrary-host SSRF
Des données publiques, des sources traçables
Les fiches CVE et scores NVD, les avis OSV/GHSA sur les paquets et les publications du CERT-FR, réunis en un seul endroit.
CISA KEV, ENISA et EPSS apportent un éclairage sur l’exploitation. Chaque fiche renvoie à ses sources et licences.