Restez informés

Deux sections pour maintenir une veille efficace et rapide en cybersécurité. Une section de news pour avoir un aperçu des articles récents en rapport avec la cybersécurité et une section qui référence les CVE à haut score les plus récentes afin de comprendre du premier coup d'oeil ce qu'elles concernent sans avoir besoin de consulter de pages supplémentaires.

Actualité
Vulnérabilités

8.1

CVE-2026-19091 - GeoDirectory <= 2.8.169 - Authenticated (Subscriber+) Arbitrary File Deletion via 'post_type' Parameter via Query-String Bypass in geodir_save_post + geodir_delete_revision

Il y a 1 mois

8.1

CVE-2026-18844 - Pulsetto Vagus Nerve Stimulator Hidden Functionality

Il y a 1 mois

9.8

CVE-2026-16230 - Formidable Digital Signatures <= 3.0.6 - Unauthenticated Arbitrary File Deletion via Signature Field

Il y a 1 mois

8.1

CVE-2026-73227 - electerm's RDP clipboard file download may parse unsafe file name

Il y a 1 mois

9.6

CVE-2026-5917 - libgit2 v0.27.0-v1.9.0 Shell Command Injection via ssh_libssh2 Backend

Il y a 1 mois

8.8

CVE-2026-66875 - Mira Hormone Monitor, Mira Android App Missing authentication for critical function

Il y a 1 mois

8.7

CVE-2026-29036 - cJSON 1.7.19 Wrong-Key Modification via JSON Pointer Escape Decoding

Il y a 1 mois

8.2

CVE-2026-67558 - Mira Hormone Monitor, Mira Android App Authentication bypass by spoofing

Il y a 1 mois

9.3

CVE-2026-67568 - Mira Hormone Monitor, Mira Android App Use of Hard-coded Credentials

Il y a 1 mois

9.8

CVE-2026-68067 - Mira Hormone Monitor, Mira Android App Weak Authentication

Il y a 1 mois

8.8

CVE-2026-55676 - Malcolm vulnerable to RCE via unrestricted .php upload to the file-upload component

Il y a 1 mois

9.9

CVE-2026-48765 - TypeBot vulnerable to cross-workspace OAuth credential takeover in updateOAuthCredentials via missing object binding

Il y a 1 mois

8.2

CVE-2026-48763 - TypeBot has Arbitrary S3 Object Write in deprecated public upload endpoint via attacker-controlled filePath

Il y a 1 mois

8.3

CVE-2026-29035 - CivetWeb Heap/Stack Buffer Overflow via WebSocket permessage-deflate Decompression

Il y a 1 mois

8.8

CVE-2026-15606 - Frontend Admin by DynamiApps <= 3.29.9 - Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token

Il y a 1 mois

8.8

CVE-2026-14863 - FileRun 2026.2.0 RCE via Thumbnail Generation Command Injection

Il y a 1 mois

8.3

CVE-2026-73242 - FreeRDP: Kerberos GSS Wrap-token `EC` field is unbounded, causing an out-of-bounds decrypt in `kerberos_DecryptMessage`

Il y a 1 mois

8.3

CVE-2026-73241 - FreeRDP: RDSTLS server authentication bypass: a credential-less Capabilities PDU is accepted at the auth step (fail-open `resultCode`)

Il y a 1 mois

8.5

CVE-2026-73233 - FreeCAD: FEM formula incomplete escape

Il y a 1 mois

9.8

CVE-2026-73034 - DB-GPT v0.8.1 Path Traversal Arbitrary File Write via user_id Header

Il y a 1 mois

8.1

CVE-2026-73030 - unearth 0.18.2 Path Traversal via Unnormalized Paths and Symlink Escape

Il y a 1 mois

9.9

CVE-2026-72911 - ERPNext: Possibility of server-side template injection due to missing validation

Il y a 1 mois

9.3

CVE-2026-72904 - Firecrawl: Arbitrary file read via JSON Schema $ref expansion

Il y a 1 mois

8.1

CVE-2026-72903 - Tabby: Windows SFTP path traversal allows a malicious server to write files outside the selected download directory

Il y a 1 mois

9.3

CVE-2026-48160 - react-tracked was vulnerable to malicious code execution via compromised commits

Il y a 1 mois