Dernières vulnérabilités critiques
CVE publiées dont le score CVSS de référence — celui du CNA ou celui de la NVD — atteint 9,0 ou plus, les plus récentes d’abord.
Mise à jour : CVE List (cvelistV5) : NVD (fkie-cad mirror) :
| CVE | Bibliothèque / produit — versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2023-22793 | Veeam Management Pack for Microsoft System Center 9.0 – < 13.1.0.334 | A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Exte | CRITICAL 9.3 | |||
| CVE-2026-61707 | socfortress CoPilot < 0.1.76 | SOCFortress CoPilot: Stored case-report template injection permits backend code execution | CRITICAL 9.0 | |||
| CVE-2026-61645 | docat-org docat < 1.6.0 | Docat has Arbitrary File Upload exists in Upload API | CRITICAL 9.1 | |||
| CVE-2026-103093 | ServiceNow ServiceNow AI Platform < Yokohama Patch 13 Hot Fix 4a ; < Zurich Patch 10 Hot Fix 3b ; < Zurich Patch 12 ; … | Sandbox Escape via Table Rotation in ServiceNow AI Platform | CRITICAL 9.4 | |||
| CVE-2026-118769 | randombit botan >= 2.1.0, < 3.13.0 | Botan: Integer overflow when reporting block size in FFI can cause memory corruption | CRITICAL 9.2 | |||
| CVE-2026-118762 | monkeytypegame monkeytype < 26.43.0 | Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN | CRITICAL 9.3 | |||
| CVE-2026-119145 | frappe frappe 16.0.0 – < 16.34.0frappe frappe < 15.121.0 | Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload | CRITICAL 9.4 | |||
| CVE-2026-119128 | zitadel zitadel 4.0.0 – < 4.19.5 | ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie | CRITICAL 9.1 | |||
| CVE-2026-90868 | Progress Software WS_FTP Server < 2024.0.7 ; < 2025.0.4 | OS Command Injection in Progress WS_FTP Server | CRITICAL 9.9 | |||
| CVE-2026-90866 | Progress Software WS_FTP Server < 2024.0.7 ; < 2025.0.4 | Virtual Folder Path Confinement Bypass in Progress WS_FTP Server | CRITICAL 9.1 | |||
| CVE-2026-90865 | Progress Software WS_FTP Server < 2024.0.7 ; < 2025.0.4 | Command Injection via FTP Notification Variables in Progress WS_FTP Server | CRITICAL 9.0 | |||
| CVE-2026-90864 | Progress Software WS_FTP Server < 2024.0.7 ; < 2025.0.4 | Host Administrator Path Containment Bypass in Progress WS_FTP Server | CRITICAL 9.1 | |||
| CVE-2026-90863 | Progress Software WS_FTP Server < 2024.0.7 ; < 2025.0.4 | Privilege Escalation via Missing Authorization in WS_FTP Manager | CRITICAL 9.1 | |||
| CVE-2026-84295 | Progress Software WS_FTP Server < 2024.0.6 ; < 2025.0.3 | Improper Authentication in Progress WS_FTP Server | CRITICAL 10.0 | |||
| CVE-2026-111732 | RT-Labs P-Net < 1.0.3 | Out-of-bounds write when parsing AR Vendor Block requests | CRITICAL 9.3 | |||
| CVE-2026-112256 | OpenText Advanced Authentication Server 6.4.0.0 – 6.4.3.8 ; 6.5.0.0 – 6.5.0.10 ; 6.6.0.0 – 6.6.1.0 | Logon bypass (trust of attacker-controlled completed-methods list) | CRITICAL 9.2 | |||
| CVE-2026-62131 | Zoho Flow Zoho Flow n/a – 2.14.5 | WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-62018 | ThemeREX Gunslinger n/a – 1.11 | WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-62017 | ThemeREX Good Homes n/a – 1.3.13 | WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-62016 | ThemeREX Gamic n/a – 1.19 | WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-62015 | ThemeREX Gamezone n/a – 1.1.11 | WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-62014 | ThemeREX EmojiNation n/a – 1.0.12 | WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-62013 | ThemeREX Edge Decor n/a – 2.9 | WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-62012 | ThemeREX Coinpress n/a – 1.0.15 | WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-62011 | ThemeREX Bonbon n/a – 1.11 | WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-62010 | ThemeREX Avventure n/a – 1.1.12 | WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-62009 | ThemeREX Filmax n/a – 1.1.11 | WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-62008 | ThemeREX Orpheus n/a – 1.8 | WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-62006 | ThemeREX Nuts n/a – 1.12 | WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-62005 | ThemeREX Muzicon n/a – 1.15 | WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-62004 | ThemeREX Motorix n/a – 1.11 | WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-62003 | ThemeREX Mission n/a – 1.22 | WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-62002 | ThemeREX Meals & Wheels n/a – 1.1.13 | WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-62001 | ThemeREX Marcell n/a – 1.2.14 | WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-61998 | ThemeREX Le Truffe n/a – 1.1.7 | WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-61997 | ThemeREX Legal Stone n/a – 1.2.11 | WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-61992 | Von Eyal Fitoussi GEO my WordPress n/a – 4.5.5.3 | WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-61991 | Ajax Load More AjaxLoadMore Cache n/a – 3.1.1 | WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability | CRITICAL 10.0 | |||
| CVE-2026-54860 | ThemeREX Ozisti n/a – 1.1.10 | WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-54859 | ThemeREX Preservation n/a – 1.15 | WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-54858 | ThemeREX Printy n/a – 1.13.0 | WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-54857 | ThemeREX Quirky n/a – 1.23 | WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-54856 | ThemeREX RexCoin n/a – 1.2.6 | WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-93680 | IBM Langflow OSS 1.0.0 – 1.12.8 | Langflow OSS is affected by multiple vulnerabilities | CRITICAL 9.8 | |||
| CVE-2026-104339 | IBM Langflow OSS 1.0.0 – 1.12.3 | Langflow OSS is affected by multiple vulnerabilities | CRITICAL 9.8 | |||
| CVE-2026-107327 | IBM Langflow OSS 1.0.0 – 1.12.4 | Langflow OSS is affected by multiple vulnerabilities | CRITICAL 9.9 | |||
| CVE-2026-107328 | IBM Langflow OSS 1.0.0 – 1.12.4 | Langflow OSS is affected by multiple vulnerabilities | CRITICAL 9.9 | |||
| CVE-2026-107329 | IBM Langflow OSS 1.0.0 – 1.12.4 | Langflow OSS is affected by multiple vulnerabilities | CRITICAL 9.9 | |||
| CVE-2026-110186 | IBM Langflow OSS 1.0.0 – 1.12.8 | Langflow OSS is affected by multiple vulnerabilities | CRITICAL 9.8 | |||
| CVE-2026-119050 | agno-agi agno ≤ 3.1.11 | Agno through 3.1.11 Code Execution via PandasTools Unsafe Reflection | CRITICAL 9.2 | |||
| CVE-2026-97854 | Yamaha Corporation NWR100 ≤ Rev.26.00.07 | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may b | CRITICAL 9.3 | |||
| CVE-2026-115964 | StylemixThemes Motors ≤ 1.4.126 | WordPress Motors plugin <= 1.4.126 - SQL Injection vulnerability | CRITICAL 9.3 | |||
| CVE-2026-114358 | Radius Synergies Radius Xenia M2M Platform Version | SQL Injection Vulnerability in Radius Xenia M2M Platform | CRITICAL 9.3 | |||
| CVE-2026-115245 | Unknown Chat AI with Dispatcher < 2.4 | Chat AI with Dispatcher < 2.4 - Unauthenticated Arbitrary File Upload | CRITICAL 9.8 | |||
| CVE-2026-113617 | Unknown Automated Import Products to Cart < 1.0.4 | Automated Import Products to Cart < 1.0.4 - Subscriber+ Arbitrary File Read and Deletion via Path Traversal | CRITICAL 9.9 | |||
| CVE-2026-113616 | Unknown LogixFast Auth < 1.0.4 | LogixFast Auth < 1.0.4 - Unauthenticated Account Takeover via Password Reset | CRITICAL 9.8 | |||
| CVE-2026-103693 | Unknown Frontend Dashboard < 3.0.5Unknown ProfileGrid < 6.0.0.5 | Frontend Dashboard < 3.0.5 and ProfileGrid < 6.0.0.5 - Unauthenticated PHP Object Injection | CRITICAL 9.0 | |||
| CVE-2026-109516 | guruteam Bot for Telegram on WooCommerce ≤ 1.3.0 | Bot for Telegram on WooCommerce <= 1.3.0 - Unauthenticated Authentication Bypass to Account Takeover via Fake Telegram Webhook + Brute-Fo… | CRITICAL 9.8 | |||
| CVE-2026-42922 | frangoteam Frangoteam 1.3.2-2809 | A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request | CRITICAL 9.8 | |||
| CVE-2026-66088 | Apereo Foundation openEQUELLA < 2026.1 | Unrestricted Command Execution via system.execute | CRITICAL 9.4 | |||
| CVE-2026-107058 | — | An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service | CRITICAL 9.8 | |||
| CVE-2026-107032 | — | Insecure permissions in Bulk Share : Location Sender v2.1.0 (versionCode 5) allows unauthorized attackers to invoke an exported component, l | CRITICAL 9.1 | |||
| CVE-2026-107015 | — | Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note dat | CRITICAL 9.1 | |||
| CVE-2026-118579 | D-Link DIR-505 1.10B02 | D-Link DIR-505 Web Management CGI secmark1524.cgi main backdoor | CRITICAL 9.3 | |||
| CVE-2026-61567 | WWBN AVideo-Encoder < 8.1.0 | AVideo-Encoder: unauthenticated command execution through streamer login trust | CRITICAL 10.0 | |||
| CVE-2026-61564 | WWBN AVideo-Encoder < 8.1.0 | AVideo-Encoder: unauthenticated installer PHP code injection | CRITICAL 10.0 | |||
| CVE-2026-118690 | SignalK signalk-server < 2.33.0 | Signal K Server before 2.33.0 Missing Authentication via /skServer/ziplogs | CRITICAL 9.3 | |||
| CVE-2026-117574 | Red Hat Red Hat OpenShift AI (RHOAI) Red Hat Red Hat OpenShift AI (RHOAI) | Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-proc… | CRITICAL 9.1 | |||
| CVE-2026-63190 | fearlessgeekmedia FearlessCMS < 0.1.4 | FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS | CRITICAL 9.4 | |||
| CVE-2026-118264 | github.com/labstack/echo/v4 Go 4.0.0 – < 4.16.1github.com/labstack/echo/v5 Go 5.0.0 – < 5.4.1 | Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls | CRITICAL 9.1 | |||
| CVE-2026-118633 | Sophos SG UTM ≤ 9.724 | A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after | CRITICAL 9.2 | |||
| CVE-2026-103409 | Juniper Networks Session Smart Router < 7.0.5 ; 7.1.0 – < 7.1.7 ; 7.2.0 – < 7.2.3 | Session Smart Router: An attacker obtains administrative privileges when an unauthenticated internal endpoint is accessed | CRITICAL 9.8 | |||
| CVE-2026-103406 | Juniper Networks Session Smart Conductor < 7.0.5 ; 7.1.0 – < 7.1.7 ; 7.2.0 – < 7.2.3 | Session Smart Conductor: An unauthenticated attacker causes arbitrary command execution during key management. | CRITICAL 9.8 | |||
| CVE-2026-44179 | com.xwiki.pro/xwiki-pro-macros Maven 1.13 – < 1.14.5 | XWiki Pro Macros: excerpt-include title and content injection executes code | CRITICAL 9.9 | |||
| CVE-2026-115968 | Ultimate Member Ultimate Member ≤ 2.13.1 | WordPress Ultimate Member plugin <= 2.13.1 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-105420 | Wing Soft Technology Wing FTP Server < 8.2.6 | Path Traversal in Wing WFTP Server leading to Remote Code Execution | CRITICAL 9.4 | |||
| CVE-2026-111411 | Aman FunnelKit Automations ≤ 3.8.5.2 | WordPress FunnelKit Automations plugin <= 3.8.5.2 - SQL Injection vulnerability | CRITICAL 9.3 | |||
| CVE-2026-115607 | Crowd Favorite DXP ToolKit ≤ 2.0.1 | WordPress DXP ToolKit plugin <= 2.0.1 - SQL Injection vulnerability | CRITICAL 9.3 | |||
| CVE-2026-115904 | topluyo App < 2026.9.2410 | Topluyo Desktop for Linux has an OS Command Injection issue | CRITICAL 9.6 | |||
| CVE-2026-67074 | HCL Software BigFix AEX v13.0.0.1 | HCL BigFix AEX is affected by multiple security vulnerabilities. | CRITICAL 9.1 | |||
| CVE-2026-114278 | Eclipse Foundation Eclipse Che 7.0.0 – 7.122.0 | Unauthenticated Command Injection via kubeconfig Username in che-machine-exec | CRITICAL 9.8 | |||
| CVE-2026-103792 | Dell PowerProtect Data Domain Management Center < 8.9.0.0 or later ; < 7.13.1.90 or later ; < 8.3.1.50 or later ; … | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1 | CRITICAL 9.6 | |||
| CVE-2026-103799 | Dell PowerProtect Data Domain Management Center < 8.9.0.0 or later ; < 7.13.1.90 or later ; < 8.3.1.50 or later ; … | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1 | CRITICAL 9.6 | |||
| CVE-2026-112197 | Tactis NoviGest Desktop App NoviGest Desktop App prior to version 8.0.0-300 | Missing Authentication for Critical Function in Tactis' NoviGest Desktop App | CRITICAL 9.4 | |||
| CVE-2026-103780 | Dell PowerProtect Data Domain < 8.9.0.0 or later ; < 7.13.1.90 or later ; < 8.3.1.50 or later ; … | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re | CRITICAL 9.8 | |||
| CVE-2026-86384 | Dell PowerProtect Data Domain < 8.9.0.0 or later ; < 7.13.1.90 or later ; < 8.3.1.50 or later ; … | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-14571 | Futurum Software Futurum Software User Authentication Module < May 2026 | SQL injection (SQLi) in the user authentication module of Futurum Software | CRITICAL 9.1 | 0.4 % | ||
| CVE-2026-86397 | Dell PowerProtect Data Domain < 8.9.0.0 or later ; < 7.13.1.90 or later ; < 8.3.1.50 or later ; … | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re | CRITICAL 9.8 | 0.3 % | ||
| CVE-2026-86400 | Dell PowerProtect Data Domain < 8.9.0.0 or later ; < 7.13.1.90 or later ; < 8.3.1.50 or later ; … | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re | CRITICAL 9.8 | 0.9 % | ||
| CVE-2026-90717 | Dell PowerProtect Data Domain Management Center < 8.9.0.0 or later ; < 7.13.1.90 or later ; < 8.3.1.50 or later ; … | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1 | CRITICAL 9.1 | 0.2 % | ||
| CVE-2026-109218 | kleor Contact Manager ≤ 9.1.2 | Contact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist Bypass | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-103688 | Unknown Checkout Files Upload for WooCommerce < 2.4.0 | Checkout Files Upload for WooCommerce < 2.4.0 - Unauthenticated Arbitrary File Upload | CRITICAL 9.8 | 0.2 % | ||
| CVE-2026-104383 | EagleCloud Aquila ≤ 2.6.7.2 | Code injection in EagleCloud Aquila on-premises version | CRITICAL 9.4 | 0.4 % | ||
| CVE-2026-84999 | Pie Register Pie Register Premium ≤ 3.8.4.0 | Pie Register Premium <= 3.8.4.0 - Unauthenticated Arbitrary File Upload via piereg_file_upload AJAX Handler | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-118375 | ggml-org llama.cpp b8841 – < b11865 | llama.cpp b8841 before b11865 Stack-based Buffer Overflow via ggml-rpc RDMA rdma_recv() | CRITICAL 9.2 | 0.4 % | ||
| CVE-2026-106013 | artbees Jupiter X Core ≤ 4.61.0 | Jupiter X Core <= 4.61.0 - Unauthenticated Authentication Bypass via Twitter/X Social Login oauth_verifier Parameter | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-110879 | FasterXML jackson-databind 2.10.0 – < 2.18.12 ; 2.19.0 – < 2.21.8 ; 2.22.0 – < 2.22.4FasterXML jackson-databind 3.0.0 – < 3.1.8 ; 3.2.0 – < 3.2.4 | jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation… | CRITICAL 9.8 | 1.2 % | ||
| CVE-2026-118312 | Google Chrome 156.0.8078.73 – < 156.0.8078.73 | Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside t | CRITICAL 9.6 | 0.2 % | ||
| CVE-2026-118309 | Google Chrome 156.0.8078.73 – < 156.0.8078.73 | Improper input validation in UI in Google Chrome on on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbit | CRITICAL 9.6 | 0.2 % | ||
| CVE-2026-118342 | Google Chrome 156.0.8078.73 – < 156.0.8078.73 | Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outsi | CRITICAL 9.6 | 0.2 % |