Veille CVE

Toutes les dates

61 729 CVE

Critique 7188 Élevée 25671 Moyenne 22611 Faible 2254 Non évaluée 4005 Exploitées (KEV) Tri : plus récentes
  1. CVE-2026-19678 8.7 Élevée

    onPhase Forms

    A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase Forms allows an unauthenticated remote attacker to access sensitive internal Apache Solr data via an attacker-controlled URL supplied to a publicly accessible form.

  2. CVE-2026-19677 9.3 Critique

    onPhase Forms

    An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an unauthenticated remote attacker to authenticate as an arbitrary tenant user, obtain TenantAdmin and Designer privileges, and execute arbitrary operating system commands via manipulation of registration parameters containing a valid tenant name and existing user identifier.

  3. CVE-2026-115537 4.3 Moyenne

    gedelumbung HospitalManagement

    A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This affects the function simpan of the file application/modules/admin/controllers/routing_pages.php of the component URL Validation. This manipulation of the argument url_route causes open redirect. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

  4. CVE-2026-115536 4.3 Moyenne

    gedelumbung HospitalManagement

    A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The impacted element is the function simpan of the file application/modules/admin/controllers/routing_pages.php of the component Admin Routing Page. The manipulation of the argument content results in cross site scripting. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

  5. CVE-2026-113722 7.8 Élevée

    pypa virtualenv

    virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, virtualenv's ScriptMakerCustom and pip pass an incompletely quoted interpreter path to distlib ScriptMaker when generating POSIX console scripts. When the path contains a space or produces a shebang longer than 127 bytes, distlib emits a /bin/sh wrapper whose double-quoted interpreter path still expands command substitutions and backticks. An attacker who influences the environment destination can therefore execute commands with the user's privileges when the user later runs a generated launcher; environment creation and activation do not trigger the command. Existing launchers are not repaired by upgrading virtualenv alone and must be regenerated, while a later independent pip installation or upgrade can reintroduce an affected launcher because pip's vendored distlib is unchanged. The virtualenv fix is released in version 21.14.9.

  6. CVE-2026-113715 2.0 Faible

    pypa virtualenv

    virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, the stdlib venv creator reads generated pyvenv.cfg with str.splitlines() and merges parsed keys over virtualenv's selected configuration. An untrusted caller who influences the destination pathname can include a line-boundary character such as U+2028 to inject keys including home and include-system-site-packages, causing path data to change configuration structure before final output. Setting include-system-site-packages to true weakens environment isolation, while an altered home can change which standard-library files the interpreter loads if the attacker also controls that location. The builtin creator does not use this readback path. This issue is fixed in version 21.14.9.

  7. CVE-2026-113712 4.8 Moyenne

    cachethq cachet

    Cachet is an open-source status page system. Versions 2.4.1 and earlier have a stored Cross-Site Scripting (XSS) vulnerability in the incident creation form, allowing an authenticated attacker to inject malicious HTML/JavaScript that executes in the browser of any user who views the status page, potentially leading to session token theft and account takeover. Commits 57b44a8bac0b250b0d5751e93e0349070d14606e and 23adbb88ffa819f92be4a905ff1d812670d980a2 in `cachethq/core` patch the issue.

  8. CVE-2026-113669 5.3 Moyenne

    apostrophecms apostrophe · @apostrophecms passport-bridge

    ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0 of ApostropheCMS and 1.6.1 of passport-bridge, cross-host or cross-locale session migration places a single-use bearer session token in a redirect URL. A client that obtains and redeems a still-valid, unconsumed token before its first use can adopt the associated session, including through the passport-bridge cross-locale flow. This issue is fixed in ApostropheCMS 4.33.0 and passport-bridge 1.6.1.

  9. CVE-2026-113664 5.3 Moyenne

    apostrophecms apostrophe · @apostrophecms import-export

    ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a write stream emits an unhandled filesystem error that can terminate the Node.js process; the source establishes this static primitive but not an end-to-end exploit or controlled arbitrary file read or write. This issue is fixed in version 3.7.0.

  10. CVE-2026-113658 7.5 Élevée

    apostrophecms apostrophe

    ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the unauthenticated Rich Text CSV conversion route writes a multipart upload to the system temporary directory before checking its extension and does not remove the staged file when that validation rejects it. Repeated large rejected uploads, using the normal public CSRF cookie, can persistently consume temporary-disk capacity and may disrupt ApostropheCMS and other services that depend on the same partition. This issue is fixed in version 4.33.0.

  11. CVE-2026-113649 6.5 Moyenne

    apostrophecms apostrophe · @apostrophecms import-export

    ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module and 4.34.0 of core ApostropheCMS, an editor who can import an enabled content type but lacks its stronger publication role can cause import write helpers to create, replace, or remove published variants without the normal publish permission and lifecycle checks. This issue is fixed in import-export 3.7.1 and ApostropheCMS 4.34.0.

  12. CVE-2026-113683 6.1 Moyenne

    jcrodriguez-dis moodle-mod_vpl

    VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject script via unencoded filename1/filename2 parameters in similarity/diff.php. Attackers can craft a diff.php link with a JavaScript payload that runs when a user holding mod/vpl:similarity opens it, performing actions or disclosing data under their session.

  13. CVE-2026-113678 9.9 Critique

    froxlor

    Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows authenticated customers to take ownership of arbitrary host directories by abusing the root-run traffic cron. Attackers can replace the goaccess statistics directory in their document root with a symlink, causing chown -R to hand root-owned trees to them and enabling root escalation.

  14. CVE-2026-113507 5.3 Moyenne

    aaPanel

    A vulnerability was found in aaPanel up to 8.25.0. The impacted element is the function GetClientIp of the file class/public/common.py. The manipulation of the argument X-Real-Ip results in improper access controls. The attack may be performed from remote. The exploit has been made public and could be used. The vendor confirms: "The reported X-Real-Ip IP-bypass vulnerability has already been fixed".

  15. CVE-2026-113648 3.1 Faible

    apostrophecms apostrophe · @apostrophecms import-export

    ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and authorization checks. Any client—including unauthenticated anonymous users who have obtained the standard CSRF cookie from visiting the site—can directly invoke this route and trigger the underlying self.cleanExport(req) method. This issue is fixed in version 3.7.1.

  16. CVE-2026-113611 4.9 Moyenne

    outline

    Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep receiving document contents because UserDeletedProcessor never disables their WebhookSubscription rows. Former admins who registered webhooks before deletion continue receiving full document bodies, including Markdown and Yjs data, via DeliverWebhookTask for every matching workspace event.

  17. CVE-2026-113606 7.1 Élevée

    Stirling-Tools Stirling-PDF

    Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to access other users' stored files by pointing a processing folder at the server storage directory. Attackers can create a folder via POST /api/v1/processing-folders targeting storage/<victimUserId>, list files, and run pipelines to read, modify, or destroy victims' files.

  18. CVE-2026-113601 4.3 Moyenne

    usememos memos

    Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerate sequential activity IDs to obtain creator IDs, timestamps, and memo-comment references, including activity on other users' private memos.

  19. CVE-2026-113596 3.1 Faible

    webstudio-is webstudio

    Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other users' project data via the publishedBuilds and findManyByIds tRPC procedures. Attackers who know another user's project UUID can query the /trpc handler to retrieve publish history, titles, domains, preview images, and latest builds.

  20. CVE-2026-112954 5.3 Moyenne

    apostrophecms apostrophe

    ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a public REST API type that uses publicApiProjection can expose excluded searchable or sortable field information through search membership and sort ordering oracles. Returned fields remain filtered by the projection, so the issue permits targeted inference about hidden values rather than an unrestricted field dump. This issue is fixed in version 4.34.0.

  21. CVE-2026-111756 8.2 Élevée

    follow-redirects

    follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filter. This assumes the headers container is a plain object keyed by header names. Node's underlying http.request, which follow-redirects is a drop-in replacement for, also accepts headers as an alternating array of names and values. For an array, for...in yields the numeric indices "0", "1", "2" and so on, which never match a header-name filter, so nothing is removed. An application that sends array-form headers and follows an attacker-controlled cross-origin redirect therefore forwards its Authorization, Cookie, and Proxy-Authorization headers verbatim to the attacker-controlled destination, with no error or warning. The sensitiveHeaders option added to fix CVE-2026-40895 / GHSA-r4q5-vmmm-2653 is equally ineffective, because it relies on the same helper. This is an unauthenticated confidentiality vulnerability: any remote server the victim application contacts can harvest the victim's credential headers by responding with a cross-origin redirect. This issue has been patched in version 1.16.1.

  22. CVE-2026-112949 4.7 Moyenne

    vitest-dev vitest · @vitest mocker

    Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url createManualModuleSource inserts unescaped into generated module source. When the developer browser loads the affected module, attacker-controlled JavaScript executes on the development-server origin. This issue is fixed in versions 4.1.12 and 5.0.3.

  23. CVE-2026-115535 2.4 Faible

    gedelumbung HospitalManagement

    A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. The affected element is the function sistem.php::simpan of the file application/modules/admin/controllers/sistem.php of the component Settings Handler. The manipulation of the argument Title leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

  24. CVE-2026-23705 7.2 Élevée

    Fortinet FortiAnalyzer · Fortinet FortiManager

    An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.2, FortiAnalyzer 7.4.0 through 7.4.6, FortiAnalyzer 7.2.0 through 7.2.12, FortiManager 7.4.0 through 7.4.6, FortiManager 7.2 all versions may allow a low privileged user to execute arbitrary commands via crafted requests.

  25. CVE-2026-115486 7.1 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 8

    A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.

  26. CVE-2026-115485 6.3 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 8

    A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.

  27. CVE-2026-115484 7.6 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 8

    A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.

  28. CVE-2026-114583 6.9 Moyenne

    Python Software Foundation CPython

    tarfile.tar_filter could be bypassed using crafted link entries, including symlinks with empty or directory-like names, to redirect later archive members outside the intended extraction directory. This allowed a malicious tar archive to cause tarfile.extractall() with filter="tar" to write files outside the destination directory, subject to the permissions of the extracting process. This is the tarfile.tar_filter counterpart of CVE-2026-7774, which covered tarfile.data_filter.

  29. CVE-2026-114406 6.8 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 9 · Red Hat Hardened Images · Red Hat Advanced Cluster Security 4

    The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites. Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.

  30. CVE-2019-5645 7.5 Élevée

    Rapid7 Metasploit Framework · Rapid7 metasploit

    By sending a specially crafted HTTP GET request to a listening Rapid7 Metasploit HTTP handler, an attacker can register an arbitrary regular expression. When evaluated, this malicious handler can either prevent new HTTP handler sessions from being established, or cause a resource exhaustion on the Metasploit server.

  31. CVE-2026-115534 4.3 Moyenne

    gedelumbung HospitalManagement

    A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function kirim of the file application/modules/web/controllers/contact.php of the component Contact Form. Executing a manipulation of the argument nama/email/alamat/telepon/pesan can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

  32. CVE-2026-96303 6.5 Moyenne

    Microsoft PowerShell 7.4 · Microsoft PowerShell 7.5 · Microsoft PowerShell 7.6 · Microsoft powershell

    Improperly implemented security check for standard in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature over a network.

  33. CVE-2026-96251 8.8 Élevée

    Microsoft PowerShell 7.4 · Microsoft PowerShell 7.5 · Microsoft PowerShell 7.6 · Microsoft powershell

    Reliance on untrusted inputs in a security decision in Microsoft PowerShell allows an unauthorized attacker to execute code over a network.

  34. CVE-2026-96185 7.5 Élevée

    Microsoft Exchange Online

    Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.

  35. CVE-2026-94300 8.1 Élevée

    ISC BIND 9

    Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`". An attacker who can capture a previously signed UDP message can replay it while the negotiated TSIG key is still valid. By also sending crafted queries to a zone the attacker controls, the attacker may potentially achieve remote code execution. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.

  36. CVE-2026-92450 7.5 Élevée

    Kiloview E3 Firmware

    The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an HMAC-SHA256 secret hardcoded as a static string within the firmware image, identical across all deployed devices. An attacker with access to the publicly distributed firmware can recover this secret and forge arbitrary session tokens, including administrative tokens, without valid credentials, enabling unauthenticated access to privileged device functions.

  37. CVE-2026-92209 7.8 Élevée

    NoMachine

    NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the authentication mechanism controlling access to the Redis database. The issue results from using insufficient entropy in the generation of credentials. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-30984.

  38. CVE-2026-92208 8.8 Élevée

    NoMachine

    NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of mDNS resource records. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-30982.

  39. CVE-2026-92183 7.8 Élevée

    GIMP

    GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of APNG files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-29400.

  40. CVE-2026-93888 7.8 Élevée

    IBM Sterling Connect Direct for Unix

    IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 apnotify utility is vulnerable to a code injection due to insufficient validation of user input.

  41. CVE-2026-92559 9.8 Critique

    IBM App Connect Enterprise

    IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2 could allow a remote attacker to obtain sensitive information due to binding to an unrestricted IP address.

  42. CVE-2026-91665 9.8 Critique

    Oracle Corporation Oracle Essbase · Oracle essbase

    Vulnerability in Oracle Essbase (component: Security). The supported version that is affected is 21.8.3.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Essbase. Successful attacks of this vulnerability can result in takeover of Oracle Essbase. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

  43. CVE-2026-91305 9.1 Critique

    Oracle Corporation JD Edwards EnterpriseOne Tools

    Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

  44. CVE-2026-91299 10.0 Critique

    Oracle Corporation JD Edwards EnterpriseOne Orchestrator

    Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Orchestrator. While the vulnerability is in JD Edwards EnterpriseOne Orchestrator, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of JD Edwards EnterpriseOne Orchestrator. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

  45. CVE-2026-91265 9.1 Critique

    Oracle Corporation JD Edwards EnterpriseOne Tools

    Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). Supported versions that are affected are 9.2.0.0-9.2.26.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all JD Edwards EnterpriseOne Tools accessible data as well as unauthorized access to critical data or complete access to all JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

  46. CVE-2026-82891 8.1 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of a hard-coded cryptographic key.

  47. CVE-2026-76496 7.0 Élevée

    Cisco TelePresence Video Communication Server (VCS) Expressway

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp; The vulnerabilities tracked by CVE-2026-76496 are related to issues concerning improper link resolutions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-59.

  48. CVE-2026-76495 7.8 Élevée

    Cisco TelePresence Video Communication Server (VCS) Expressway

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp; The vulnerabilities tracked by CVE-2026-76495 are related to issues concerning incorrect permission assignments that are grouped under the Common Weakness Enumeration (CWE) Variant CWE-732.

  49. CVE-2026-76494 7.8 Élevée

    Cisco TelePresence Video Communication Server (VCS) Expressway

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp; The vulnerabilities tracked by CVE-2026-76494 are related to issues concerning code injections that are grouped under the Common Weakness Enumeration (CWE) Base CWE-94.

  50. CVE-2026-76479 7.8 Élevée

    Cisco Emergency Responder · Cisco Unified Communications Manager · Cisco Unified Communications Manager IM and Presence Service · Cisco Unity Connection

    As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76479 are related to issues concerning improper limitation of a pathname to a restricted directory that are grouped under the Common Weakness Enumeration (CWE) Base CWE-22.

  51. CVE-2026-76478 8.8 Élevée

    Cisco Emergency Responder · Cisco Unified Communications Manager · Cisco Unified Communications Manager IM and Presence Service · Cisco Unity Connection

    As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76478 are related to improper access control issues that are grouped under the Common Weakness Enumeration (CWE) Pillar CWE-284.

  52. CVE-2026-76587 8.8 Élevée

    IBM Planning Analytics

    IBM Planning Analytics 2.0 and 2.1 are vulnerable to a stack-based buffer overflow, caused by improper bounds checking. An attacker could overflow the buffer and execute arbitrary code on the system.

  53. CVE-2026-76477 8.8 Élevée

    Cisco Emergency Responder · Cisco Unified Communications Manager · Cisco Unified Communications Manager IM and Presence Service · Cisco Unity Connection

    As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76477 are related to issues concerning improper neutralization of special elements used in an SQL command that are grouped under the Common Weakness Enumeration (CWE) Base CWE-89.

  54. CVE-2026-76476 8.8 Élevée

    Cisco Emergency Responder · Cisco Unified Communications Manager · Cisco Unified Communications Manager IM and Presence Service · Cisco Unity Connection

    As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. &nbsp; The vulnerabilities tracked by CVE-2026-76476 are related to issues concerning improper input validation that are grouped under the Common Weakness Enumeration (CWE) Class CWE-20.

  55. CVE-2026-76474 9.8 Critique

    Cisco Emergency Responder · Cisco Unified Communications Manager · Cisco Unified Communications Manager IM and Presence Service · Cisco Unity Connection

    As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76474 are related to issues concerning improper authentication that are grouped under the Common Weakness Enumeration (CWE) Class CWE-287.

  56. CVE-2026-76473 9.8 Critique

    Cisco Emergency Responder · Cisco Unified Communications Manager · Cisco Unified Communications Manager IM and Presence Service · Cisco Unity Connection

    As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco Prime Collaboration Deployment, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager IM &amp; Presence Service (Unified CM IM&amp;P), Cisco Unified Communications Manager Session Management Edition (Unified CM SME), and Cisco Unity Connection have conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-76473 are related to issues concerning improper control of a resource through its lifetime that are grouped under the Common Weakness Enumeration (CWE) Class CWE-74. &nbsp;

  57. CVE-2026-76466 9.8 Critique

    Cisco TelePresence Video Communication Server (VCS) Expressway

    A vulnerability in the database service feature of Cisco Expressway Series could allow an unauthenticated, remote attacker with network access to a Cisco Expressway device to execute arbitrary operating system commands as&nbsp;root. This vulnerability is due to the use of persistent cookies. Additionally, there is insufficient validation of client certificates when the TLS Verify Mode is set to Enabled for clustering, which means that client certificates are not validated. An attacker with possession of the cookies could exploit this vulnerability by connecting to the database service and invoking specific remote procedure call (RPC) commands. A successful exploit could allow the attacker to execute arbitrary commands as root on the underlying operating system of an affected device. Note: Cisco Expressway Series refers to Cisco Expressway Core (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.

  58. CVE-2026-76462 5.5 Moyenne

    Cisco Secure Client

    A vulnerability in the interprocess communication (IPC) channel of the Secure Firewall Posture module in Cisco Secure Client could allow an authenticated, local attacker to elevate privileges on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a series of crafted IPC messages to a local socket. A successful exploit could allow the attacker to perform limited file write operations on the filesystem with SYSTEM or root privileges. Although this vulnerability affects the Secure Firewall Posture module in Cisco Secure Client on Windows, macOS, and Linux operating systems, this vulnerability could be used to obtain full root privileges on macOS and Linux. For that reason Cisco has assigned this security advisory a Security Impact Rating (SIR) of High rather than Medium as the score indicates.

  59. CVE-2026-20291 7.8 Élevée

    Cisco Cyber Vision · Cisco Open Source Snort3 · Cisco Secure Firewall Threat Defense (FTD) Software · Cisco UTD SNORT IPS Engine Software

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20291 are related to issues concerning improper privilege management that are grouped under the Common Weakness Enumeration (CWE) Base CWE-269.

  60. CVE-2026-20043 9.0 Critique

    Cisco Cyber Vision · Cisco Open Source Snort3 · Cisco Secure Firewall Threat Defense (FTD) Software · Cisco UTD SNORT IPS Engine Software

    As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco owned Open Source Snort 3 Software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities. The vulnerabilities tracked by CVE-2026-20043 are related to issues concerning out-of-bounds writes that are grouped under the Common Weakness Enumeration (CWE) Base CWE-787.

  61. CVE-2026-114625 9.9 Critique

    Arista Networks VeloCloud Orchestrator

    VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator. On an affected system, any authenticated user can gain operator privileges and masquerade as a local "superuser operator" user. This includes access to functionality that is intended for internal use only and which is not intended to be remotely accessible. Hosted, including Dedicated, versions of VCO were impacted and have already been patched.

  62. CVE-2026-113461 5.2 Moyenne

    Checkmk GmbH Checkmk

    Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself to execute code as root if an agent has the 'mk-oracle' plugin enabled.

  63. CVE-2026-15561 7.5 Élevée

    Red Hat JBoss Enterprise Application Platform 7.4.25 · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 8 · Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 9

    A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service.

  64. CVE-2026-113342 9.6 Critique

    Google Chrome

    Memory corruption in Network in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  65. CVE-2026-113336 9.6 Critique

    Google Chrome

    Memory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

  66. CVE-2026-113331 8.8 Élevée

    Google Chrome

    Memory corruption in Controls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

  67. CVE-2026-113328 9.6 Critique

    Google Chrome

    Improper input validation in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  68. CVE-2026-113300 9.6 Critique

    Google Chrome

    Out of bounds write in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

  69. CVE-2026-113283 9.6 Critique

    Google Chrome

    Memory corruption in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  70. CVE-2026-113270 9.6 Critique

    Google Chrome

    Use after free in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  71. CVE-2026-113263 9.6 Critique

    Google Chrome

    Use after free in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  72. CVE-2026-113261 9.6 Critique

    Google Chrome

    Use after free in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  73. CVE-2026-113252 9.6 Critique

    Google Chrome

    Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

  74. CVE-2026-113235 9.6 Critique

    Google Chrome

    Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  75. CVE-2026-113222 9.6 Critique

    Google Chrome

    Use after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

  76. CVE-2026-113211 9.6 Critique

    Google Chrome

    Memory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  77. CVE-2026-113189 9.6 Critique

    Google Chrome

    Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  78. CVE-2026-113186 9.6 Critique

    Google Chrome

    Memory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

  79. CVE-2026-113171 9.6 Critique

    Google Chrome

    Memory corruption in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  80. CVE-2026-113169 9.6 Critique

    Google Chrome

    Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

  81. CVE-2026-113147 8.8 Élevée

    Google Chrome

    Improper input validation in WebShare in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  82. CVE-2026-113146 8.8 Élevée

    Google Chrome

    Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  83. CVE-2026-113141 8.8 Élevée

    Google Chrome

    Use after free in Transactions Platform in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

  84. CVE-2026-113138 9.6 Critique

    Google Chrome

    Memory corruption in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  85. CVE-2026-113126 9.6 Critique

    Google Chrome

    Memory corruption in PolicyContainer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  86. CVE-2026-113118 8.8 Élevée

    Google Chrome

    Memory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  87. CVE-2026-113116 9.6 Critique

    Google Chrome

    Use after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

  88. CVE-2026-113089 9.6 Critique

    Google Chrome

    Improper input validation in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  89. CVE-2026-113084 9.6 Critique

    Google Chrome

    Improper input validation in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  90. CVE-2026-113078 9.6 Critique

    Google Chrome

    Improper input validation in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  91. CVE-2026-113072 9.6 Critique

    Google Chrome

    Memory corruption in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

  92. CVE-2026-113056 9.6 Critique

    Google Chrome

    Memory corruption in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

  93. CVE-2026-113023 9.6 Critique

    Google Chrome

    Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

  94. CVE-2026-113022 8.8 Élevée

    Google Chrome

    Memory corruption in PDFium in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  95. CVE-2026-113019 8.8 Élevée

    Google Chrome

    Use after free in Turbolev in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

  96. CVE-2026-113018 8.8 Élevée

    Google Chrome

    Memory corruption in IME in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  97. CVE-2026-113014 9.6 Critique

    Google Chrome

    Use after free in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  98. CVE-2026-113009 8.8 Élevée

    Google Chrome

    Use after free in WindowControlsOverlay in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  99. CVE-2026-113007 9.6 Critique

    Google Chrome

    Memory corruption in Permissions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  100. CVE-2026-112995 8.8 Élevée

    Google Chrome

    Use after free in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  101. CVE-2026-112994 8.8 Élevée

    Google Chrome

    Memory corruption in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)

  102. CVE-2026-111815 10.0 Critique

    Apache Software Foundation Apache Traffic Server

    Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

  103. CVE-2026-111814 10.0 Critique

    Apache Software Foundation Apache Traffic Server

    Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

  104. CVE-2026-111812 10.0 Critique

    Apache Software Foundation Apache Traffic Server

    Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

  105. CVE-2026-111811 9.0 Critique

    Apache Software Foundation Apache Traffic Server

    Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

  106. CVE-2026-111813 10.0 Critique

    Apache Software Foundation Apache Traffic Server

    Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned) configuration. This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

  107. CVE-2026-111184 7.8 Élevée

    NoMachine

    NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the NoMachine Device Service. The issue results from incorrect permissions on a named pipe. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-31213.

  108. CVE-2026-111183 9.8 Critique

    GStreamer

    GStreamer rtpL16depay Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the processing of RTP payload elements. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-31143.

  109. CVE-2026-112992 9.6 Critique

    Google Chrome

    Memory corruption in Canvas in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  110. CVE-2026-110825 7.5 Élevée

    Kiloview E3 Firmware

    The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration write operations without requiring authentication, regardless of the device's configured authentication setting for this service. A remote, unauthenticated attacker can alter the device hostname, redirect DNS resolution, or modify the configured time source, enabling follow on attacks such as traffic interception or certificate validation bypass.

  111. CVE-2026-110491 7.5 Élevée

    Kiloview E3 Firmware

    The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain operations. The affected service stops accepting new connections while the rest of the device continues operating normally, and will recover automatically after a period. This can be triggered repeatedly by any unauthenticated party with network access to the device.

  112. CVE-2026-110243 9.9 Critique

    Kiloview E3 Firmware

    The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface name accepted by its link maintenance address configuration endpoint before passing it to a shell command, unlike sibling handlers that perform the same validation. An authenticated web user with permission to configure network settings can exploit this to execute arbitrary operating system commands as root.

  113. CVE-2026-110063 10.0 Critique

    Microsoft VM Inspector for Azure Virtual Machines

    Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.

  114. CVE-2026-110264 10.0 Critique

    GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server due to integer overflow when compiling a specially crafted regular expression.

  115. CVE-2026-109619 8.1 Élevée

    PHP Group PHP · Php php

    PHP has various global state that temporarily points into request memory. In some scenarios, global state may not be correctly reset, or may be repopulated after being reset. The global state may then refer to request memory even after it has been freed. Subsequent requests may read or branch on this stale state before it is fully initialized. Multiple strategies can trigger this condition and produce remote code execution (RCE).

  116. CVE-2026-109618 9.8 Critique

    PHP Group PHP · Php php

    PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).

  117. CVE-2026-107861 9.9 Critique

    Kiloview E3 Firmware

    The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary operating system commands as root, resulting in full device compromise.

  118. CVE-2026-105014 9.1 Critique

    Microsoft Azure Pipelines

    Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.

  119. CVE-2026-101590 9.1 Critique

    Oracle Corporation Helidon

    Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-microprofile-security). Supported versions that are affected are 4.0.0-4.5.5. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Helidon. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Helidon accessible data as well as unauthorized access to critical data or complete access to all Helidon accessible data. CVSS 3.1 Base Score 9.1 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).

  120. CVE-2026-101521 9.8 Critique

    Oracle Corporation Oracle APEX

    Vulnerability in Oracle APEX (component: General). Supported versions that are affected are 24.1.0-24.1.21, 24.2.0-24.2.20 and 26.1.0-26.1.4. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTPS to compromise Oracle APEX. Successful attacks of this vulnerability can result in takeover of Oracle APEX. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

  121. CVE-2026-101484 9.8 Critique

    Oracle Corporation Oracle Secure Backup

    Vulnerability in Oracle Secure Backup (component: Backup and Restore). Supported versions that are affected are 19.1.0.0.0 and 19.1.0.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle Secure Backup. Successful attacks of this vulnerability can result in takeover of Oracle Secure Backup. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

  122. CVE-2025-55702 8.7 Élevée

    Apache Software Foundation Apache Traffic Server

    When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smuggle requests past the front end and desynchronize responses for other users. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

  123. CVE-2025-31699 8.9 Élevée

    Apache Software Foundation Apache Traffic Server

    Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body data, which lets an attacker smuggle requests past ATS access controls, disrupt other users' requests, or poison the cache. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

  124. CVE-2026-97785 10.0 Critique

    Microsoft Entra application proxy

    Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.

  125. CVE-2026-96960 7.5 Élevée

    Microsoft .NET Framework 3.5 · Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 · Microsoft .NET Framework 3.5 AND 4.7.2 · Microsoft .NET Framework 3.5 AND 4.8

    Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.

  126. CVE-2026-96959 7.5 Élevée

    Microsoft .NET Framework 3.5 · Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 · Microsoft .NET Framework 3.5 AND 4.7.2 · Microsoft .NET Framework 3.5 AND 4.8

    Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

  127. CVE-2026-96958 7.5 Élevée

    Microsoft .NET Framework 3.5 · Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 · Microsoft .NET Framework 3.5 AND 4.7.2 · Microsoft .NET Framework 3.5 AND 4.8

    Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

  128. CVE-2026-96957 8.8 Élevée

    Microsoft .NET 10.0 runtime · Microsoft .NET 11.0 runtime · Microsoft Visual Studio 2022 version 17.14 · Microsoft Visual Studio 2026 version 18.10

    Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

  129. CVE-2026-96616 6.5 Moyenne

    Kiloview E3 Firmware

    Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any reasonable session lifetime, effectively making them non-expiring. A token obtained through interception or device compromise remains valid for authenticated access for an extended period.

  130. CVE-2026-96238 6.5 Moyenne

    Microsoft .NET 10.0 runtime · Microsoft .NET 11.0 runtime · Microsoft .NET 8.0 runtime · Microsoft .NET 9.0 runtime

    Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.

  131. CVE-2026-96237 7.5 Élevée

    Microsoft .NET 10.0 runtime · Microsoft .NET 8.0 runtime · Microsoft .NET 9.0 runtime · Microsoft Visual Studio 2022 version 17.14

    Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute code over a network.

  132. CVE-2026-96235 8.8 Élevée

    Microsoft .NET 10.0 runtime · Microsoft .NET 11.0 runtime · Microsoft .NET 8.0 runtime · Microsoft .NET 9.0 runtime

    Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.

  133. CVE-2026-96234 5.3 Moyenne

    Microsoft .NET 10.0 runtime · Microsoft .NET 11.0 runtime · Microsoft .NET 8.0 runtime · Microsoft .NET 9.0 runtime

    Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.

  134. CVE-2026-96233 7.5 Élevée

    Microsoft .NET 10.0 runtime · Microsoft .NET 11.0 runtime · Microsoft .NET 8.0 runtime · Microsoft .NET 9.0 runtime

    Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.

  135. CVE-2026-96232 7.5 Élevée

    Microsoft .NET 10.0 runtime · Microsoft .NET 11.0 runtime · Microsoft .NET 8.0 runtime · Microsoft .NET 9.0 runtime

    Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network.

  136. CVE-2026-96231 7.8 Élevée

    Microsoft .NET 10.0 runtime · Microsoft .NET 11.0 runtime · Microsoft .NET 8.0 runtime · Microsoft .NET 9.0 runtime

    Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

  137. CVE-2026-96230 8.8 Élevée

    Microsoft Visual Studio 2022 version 17.14 · Microsoft Visual Studio 2026 version 18.10 · Microsoft.AspNetCore.Components.WebAssembly.Server

    Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.

  138. CVE-2026-96229 6.5 Moyenne

    Microsoft .NET 10.0 runtime · Microsoft .NET 11.0 runtime · Microsoft .NET 8.0 runtime · Microsoft .NET 9.0 runtime

    Permissive list of allowed inputs in .NET allows an unauthorized attacker to disclose information over a network.

  139. CVE-2026-96225 7.8 Élevée

    Microsoft .NET 10.0 runtime · Microsoft .NET 11.0 runtime · Microsoft .NET 8.0 runtime · Microsoft .NET 9.0 runtime

    Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

  140. CVE-2026-96224 8.8 Élevée

    Microsoft .NET 10.0 runtime · Microsoft .NET 11.0 runtime · Microsoft .NET 8.0 runtime · Microsoft .NET 9.0 runtime

    Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.

  141. CVE-2026-96222 7.4 Élevée

    Microsoft .NET Framework 3.5 · Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 · Microsoft .NET Framework 3.5 AND 4.7.2 · Microsoft .NET Framework 3.5 AND 4.8

    Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

  142. CVE-2026-87697 8.8 Élevée

    Microsoft .NET 10.0 runtime · Microsoft .NET 11.0 runtime · Microsoft .NET 8.0 runtime · Microsoft .NET 9.0 runtime

    Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.

  143. CVE-2026-85790 5.9 Moyenne

    Microsoft Visual Studio 2022 version 17.14 · Microsoft Visual Studio 2026 version 18.10 · Microsoft.Native.Quic.MsQuic.Schannel · Microsoft Windows 11 Version 23H2

    Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.

  144. CVE-2026-85363 8.8 Élevée

    Microsoft .NET 10.0 runtime · Microsoft .NET 11.0 runtime · Microsoft .NET 8.0 runtime · Microsoft .NET 9.0 runtime

    Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a network.

  145. CVE-2026-83938 10.0 Critique

    Microsoft Azure Kubernetes Configuration Service

    Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.

  146. CVE-2026-84008 7.5 Élevée

    Microsoft .NET Framework 3.5 · Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 · Microsoft .NET Framework 3.5 AND 4.7.2 · Microsoft .NET Framework 3.5 AND 4.8

    Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

  147. CVE-2026-83681 5.5 Moyenne

    Microsoft PowerToys

    Weak authentication in Microsoft PowerToys allows an authorized attacker to perform tampering locally.

  148. CVE-2026-83520 8.8 Élevée

    Microsoft .NET 10.0 runtime · Microsoft .NET 11.0 runtime · Microsoft .NET 8.0 runtime · Microsoft .NET 9.0 runtime

    Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.

  149. CVE-2026-77930 9.8 Critique

    EvoScientist

    EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating them to async sub-agents lacking an interrupt_on gate. Attackers can plant instructions in ingested content such as fetched web pages, so the agent calls start_async_task and runs commands with user privileges and environment secrets.

  150. CVE-2026-70197 8.1 Élevée

    Microsoft .NET 10.0 runtime · Microsoft .NET 11.0 runtime · Microsoft .NET 8.0 runtime · Microsoft .NET 9.0 runtime

    Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.