Restez informés

Deux sections pour maintenir une veille efficace et rapide en cybersécurité. Une section de news pour avoir un aperçu des articles récents en rapport avec la cybersécurité et une section qui référence les CVE à haut score les plus récentes afin de comprendre du premier coup d'oeil ce qu'elles concernent sans avoir besoin de consulter de pages supplémentaires.

Actualité
Vulnérabilités

9.1

CVE-2026-101187 - Ziroom ZHOME A0101 USB Device Management API zrUsb.lua pop_usb_device command injection

Il y a 1 mois

8.7

CVE-2026-100371 - InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recovery

Il y a 1 mois

8.1

CVE-2026-93355 - LiteLLM Weak JWT Authentication via Email-Based User Lookup

Il y a 1 mois

8.8

CVE-2026-87741 - ConvertPlus <= 3.6.3 - Authenticated (Subscriber+) PHP Object Injection via 'style' Parameter

Il y a 1 mois

8.8

CVE-2026-86950 - Apple Kernel Out-of-Bounds Write Vulnerability

Il y a 1 mois

9.3

CVE-2026-101110 - Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6

Il y a 1 mois

9.3

CVE-2026-101108 - Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8

Il y a 1 mois

9.3

CVE-2026-100752 - Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9

Il y a 1 mois

8.6

CVE-2026-75600 - FreePBX: Authenticated API generatedocs Host Command Injection

Il y a 1 mois

8.4

CVE-2026-55157 - Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

Il y a 1 mois

8.6

CVE-2026-54710 - FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)

Il y a 1 mois

8.6

CVE-2026-54708 - Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module

Il y a 1 mois

8.7

CVE-2026-54675 - FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module

Il y a 1 mois

8.6

CVE-2026-54674 - Authenticated Command Injection in FreePBX UCP Interface

Il y a 1 mois

9.1

CVE-2026-49994 - Bluehood: Missing authentication on Bluehood API routes when web auth is enabled

Il y a 1 mois

8.3

CVE-2026-101909 - Axios: Prototype Pollution Gadget in axios toFormData Options

Il y a 1 mois

8.2

CVE-2026-101906 - Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization, reachable via untrusted redirect Location

Il y a 1 mois

8.2

CVE-2026-101903 - Axios: ReDoS in fromDataURI data: URL parser freezes the Node event loop (DoS)

Il y a 1 mois

8.2

CVE-2026-101901 - Axios: Denial of Service via Unhandled 'error' Event in HTTP/2 ClientHttp2Session Initialization

Il y a 1 mois

8.6

CVE-2026-87969 - WatchGuard AP Authenticated Command Injection in Diagnostic CLI

Il y a 1 mois

9.3

CVE-2026-86102 - WatchGuard AP Command Injection in Internal Management API Allows Command Execution

Il y a 1 mois

9.8

CVE-2026-101090 - Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri

Il y a 1 mois

9.6

CVE-2026-101084 - obot before v0.21.1 Authorization Bypass via /mcp-connect

Il y a 1 mois

9.8

CVE-2026-101065 - Obot Quickstart Docker Deployment Unauthenticated Admin Access

Il y a 1 mois

8.3

CVE-2026-101064 - Obot before v0.23.0 Server-Side Request Forgery via MCP

Il y a 1 mois