Veille CVE

Semaine du 21 septembre au 27 septembre 2026

8 CVE

Critique 3 Élevée 2 Moyenne 3 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2026-88772 8.1 Élevée Exploitée

    Citrix NetScaler ADC · Citrix NetScaler Gateway · Citrix netscaler application delivery controller

    Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to Remote Code Execution or Denial of Service

  2. CVE-2026-88771 9.8 Critique Exploitée

    Citrix NetScaler ADC · Citrix NetScaler Gateway · Citrix netscaler application delivery controller

    Improper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14.1-73.37 FIPS, and before 13.1.37.279 FIPS and NDcPP; Gateway: before 14.1-73.37 and before 13.1-64.23 leading to an unauthenticated attacker to execute arbitrary commands.

  3. CVE-2026-96656 7.2 Élevée Exploitée

    Plex Media Server

    Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without signature, execute bit, or symbol checks.

  4. CVE-2026-96655 4.3 Moyenne Exploitée

    Plex Media Server

    Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter.

  5. CVE-2026-96654 6.5 Moyenne Exploitée

    Plex Media Server

    Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.

  6. CVE-2026-96652 4.3 Moyenne Exploitée

    Plex Media Server

    Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination.

  7. CVE-2026-94127 9.8 Critique Exploitée

    F5 BIG-IP · F5 big-ip access policy manager

    When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution (RCE). This vulnerability is only present when BIG-IP APM is configured as an OAuth Authorization Server. Deployments using APM strictly as an OAuth Client / Resource Server (without OAuth authorization server profiles configured) are not affected by this vulnerability. Impact: This vulnerability allows an unauthenticated attacker to perform remote code execution. The BIG-IP system in Appliance mode is also vulnerable. This is a data plane issue; there is no control plane exposure. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

  8. CVE-2026-93616 9.8 Critique Exploitée

    checkpoint Quantum Security Management · Checkpoint multi-domain security management

    A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server.