Veille CVE

Samedi 10 octobre 2026

30 CVE

Critique 10 Élevée 12 Moyenne 7 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2026-84272 9.8 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.1 and 12.2.2 are vulnerable to missing authentication in the edge-controller component. An unauthenticated remote attacker could exploit this vulnerability to execute arbitrary container images and gain control of managed edge clusters.

  2. CVE-2026-78401 9.8 Critique

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

  3. CVE-2026-19494 6.5 Moyenne

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to bypass security restrictions due to improper authentication.

  4. CVE-2026-19491 7.5 Élevée

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass authentication due to improper authentication.

  5. CVE-2026-16916 8.8 Élevée

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary code due to a protection mechanism failure.

  6. CVE-2026-12109 7.2 Élevée

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow an attacker with administrative privileges and access to the local management interface to execute arbitrary code due to an unbounded write to a fixed-size stack buffer.

  7. CVE-2026-11888 7.5 Élevée

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to an information disclosure attack.

  8. CVE-2026-94510 9.9 Critique

    Microsoft Bookings

    Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network.

  9. CVE-2026-84250 7.8 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 is vulnerable due to weak cryptographic protection and a hard-coded recovery key in the pkcrypto passkey component. A local attacker could exploit this vulnerability to recover the root password and gain root privileges.

  10. CVE-2026-84245 7.8 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 is vulnerable to a local privilege escalation in the cp_wrapper component. A low-privileged local user could exploit this vulnerability to gain root privileges and access or modify sensitive system files.

  11. CVE-2026-84278 7.2 Élevée

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.2 is affected by a command injection vulnerability in the SUID-root ssh_config_wrapper component. An authenticated high-privileged user can inject arbitrary commands through attacker-controlled arguments, resulting in command execution with root privileges.

  12. CVE-2026-79842 9.1 Critique

    Hewlett Packard Enterprise HPE Intelligent Management Center (iMC)

    An authentication bypass vulnerability exists in HPE Intelligent Management Center (iMC) prior to v7.3 E0713

  13. CVE-2026-82344 9.8 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.0, 12.1 is vulnerable to a heap-based buffer overflow in the S-TAP TrafficTap TDS login reassembly functionality. An unauthenticated remote attacker can send crafted TDS login fragments that exceed the fixed-size reassembly buffer, potentially resulting in denial of service or arbitrary code execution on the affected system.

  14. CVE-2026-82335 9.8 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based buffer overflow in the MongoDB protocol parser. A remote attacker could send a specially crafted MongoDB SCRAM username containing an excessive length and cause memory corruption, potentially resulting in denial of service or arbitrary code execution.

  15. CVE-2026-82334 9.1 Critique

    IBM Guardium Data Protection

    IBM Guardium Data Protection 12.0, 12.1, 12.2 is vulnerable to a heap-based out-of-bounds read in the TDS7 LOGIN7 protocol parser. A remote attacker could send a specially crafted TDS LOGIN7 packet containing invalid offset or length values, potentially causing information disclosure or denial of service.

  16. CVE-2026-78406 9.8 Critique

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote unauthenticated attacker to execute arbitrary code on the system due to the deserialization of untrusted data.

  17. CVE-2026-77900 9.8 Critique

    Microsoft Azure App Service for Linux

    Missing authentication for critical function in Azure App Service allows an unauthorized attacker to execute code over a network.

  18. CVE-2026-62128 5.3 Moyenne

    Creator LMS

    Missing Authorization vulnerability in Creator LMS Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Creator LMS: from n/a through 1.2.21.

  19. CVE-2026-19482 8.8 Élevée

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to execute arbitrary commands due to improper neutralization of command arguments.

  20. CVE-2026-18740 8.8 Élevée

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote authenticated attacker to perform unauthorized actions due to argument injection.

  21. CVE-2026-16823 7.5 Élevée

    IBM Security Verify Access · IBM Verify Identity Access · IBM Security Verify Access Container · IBM Verify Identity Access Container

    IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to bypass security restrictions due to improper authentication.

  22. CVE-2026-107406 9.5 Critique

    NetScaler ADC · NetScaler Gateway

    Memory overflow vulnerability leading to Remote Code Execution or Denial of Service Vulnerability in NetScaler ADC. NetScaler ADC or NetScaler Gateway must be configured as a SAML SP or SAML IdP, subject to the following version-specific requirements:   * For the following versions: Applicable only when configured as a SAML IdP: * NetScaler ADC and NetScaler Gateway between 14.1-73.37 and 14.1-73.41, inclusive * NetScaler ADC 14.1-FIPS between 14.1-73.37 FIPS and 14.1-73.41 FIPS, inclusive * NetScaler ADC and NetScaler Gateway between 13.1-64.23 and 13.1-64.28, inclusive * NetScaler ADC 13.1-FIPS between 13.1-NDcPP 13.1-37.279 and 13.1- 37.282, inclusive   For the following versions: Applicable only when configured as a SAML SP or SAML IdP: * NetScaler ADC and NetScaler Gateway before 14.1-73.37  * NetScaler ADC 14.1-FIPS before 14.1-73.37 FIPS  * NetScaler ADC and NetScaler Gateway before 13.1-64.23 * NetScaler ADC 13.1-FIPS before13.1-NDcPP 13.1-37.279

  23. CVE-2026-107639 8.8 Élevée

    ILIAS-eLearning e.V. ILIAS

    ILIAS before 9.24, 10.x before 10.12 and 11.x before 11.5 contains an argument injection vulnerability in assImagemapQuestionGUI that allows question authors to inject ImageMagick convert options via uploaded image filenames. Attackers can embed tab-separated options, which escapeshellcmd() does not neutralise, to write a PHP file under the web root and achieve remote code execution.

  24. CVE-2026-107634 6.1 Moyenne

    Aorimn dislocker

    Dislocker through 0.7.3 contains a heap out-of-bounds read vulnerability in get_dataset() and get_next_datum() that never validate dataset and datum sizes against the metadata allocation. Attackers can craft a BitLocker volume image with inflated dataset or datum sizes that, when opened or mounted, crashes dislocker or discloses adjacent heap memory.

  25. CVE-2026-105829 6.1 Moyenne

    thephpleague commonmark

    League CommonMark from 1.3.0 before 2.10.2 contains a cross-site scripting vulnerability that allows users posting Markdown to bypass the DisallowedRawHtml extension by ending raw HTML with a bare disallowed tag name. Attackers can place a lone <script or <iframe line followed by a block supplying attributes like src or onload, executing stored scripts in viewers' browsers under default GFM settings.

  26. CVE-2026-105891 4.3 Moyenne

    Liquid Web / StellarWP Event Tickets

    Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1.

  27. CVE-2026-105079 6.5 Moyenne

    StylemixThemes MasterStudy LMS

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Stored XSS.This issue affects MasterStudy LMS: from n/a through 3.7.52.

  28. CVE-2026-95116 7.5 Élevée

    An issue in libming through 0.4.8 allows a remote attacker to cause a denial of service via the readtag_file() in src/blocks/fromswf.c.

  29. CVE-2026-107570 2.5 Faible

    mutt

    heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is used as a template.

  30. CVE-2026-102916 6.8 Moyenne

    illumos-gate · OmniOS

    A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses guest MMIO, vie_emulate_movs() and vie_emulate_stos() in usr/src/uts/intel/io/vmm/vmm_instruction_emul.c do not clear the VIES_REPEAT status flag on the final iteration. For MMIO regions emulated in the kernel (the local APIC, I/O APIC and HPET), the stale flag causes a VERIFY assertion in vie_advance_pc() to fail, and the host panics. A privileged user within a guest VM can issue a REP MOVS or REP STOS instruction against the local APIC page to cause a denial of service of the host and every other guest running on it. The flaw has existed since 2020 (illumos-gate commit e0c0d44e), and affects any illumos distribution prior to illumos-gate commit 696ecf8d.