Aujourd’hui

• 100Connect SecureCVE-2026-104935Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.En retard de 17 jCISAUrgenteExploitéeConnect Secure Toutes les versionsCERT-FRCVSS 8,6EPSS 87 %il y a 20 j
• 88BrotliCVE-2026-111497Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.Dans 8 jCISAUrgenteExploitéeMicrosoftCVSS –EPSS 83 %il y a 7 j
• 82Commerce And MagentoCVE-2026-48356Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.Dans 8 jCISAUrgenteExploitéePoC ×2CISACVSS –EPSS 45 %il y a 7 j
• 78Community Edition And Enterprise EditionCVE-2026-97229GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.En retard d’1 jCISAUrgenteExploitéeCISACVSS –EPSS 27 %il y a 5 j
• 75KernelCVE-2026-46300Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.En retard de 2 jCISAUrgenteExploitéePoC ×8CISACVSS –EPSS 16 %il y a 6 j
• 67Connect SecureCVE-2026-111357Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.Aujourd’huiCISAUrgenteExploitéeCISACVSS –EPSS 0,53 %il y a 4 j
• 67Secure Firewall Asa Software And Cisco Secure Ftd SoftwareCVE-2026-76418Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.En retard d’1 jCISAUrgenteExploitéeCISACVSS –EPSS 0,82 %il y a 5 j
• 67Vmware EsxCVE-2026-41709Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.Dans 9 jCISAUrgenteExploitéeCISACVSS –EPSS 0,69 %il y a 6 j
• 65Connect SecureCVE-2026-118527Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.Dans 11 jCISAUrgenteExploitéeCISACVSS –EPSS –il y a 4 j
• 60Produit non préciséCVE-2026-120345A vulnerability was found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This impacts the function sub_41a430 of the file /bin/ioos of the component DNS Resolution Handler. Performing a manipulation of the argument data results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.Dans 7 jrecommandéeHauteCVSS 10,0EPSS –il y a 9 h
• 60Produit non préciséCVE-2026-120344A vulnerability has been found in WAVLINK WN551X3-A M51X3_V251020-WO-182e965. This affects the function system of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.Dans 7 jrecommandéeHauteCVSS 10,0EPSS –il y a 10 h
• 60E8450CVE-2026-120283A vulnerability was identified in Linksys E8450 1.2.00.360516. Affected is the function strcpy of the file /www/cgi-bin/portal.cgi. Such manipulation of the argument hidden_timezone leads to stack-based buffer overflow. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.Dans 7 jrecommandéeHauteE8450 1.2.00.360516CVSS 10,0EPSS –il y a 14 h
• 60WN536AX6-ACVE-2026-120281A vulnerability was found in WAVLINK WN536AX6-A V260507. This affects the function strcpy of the file /protocol.csp of the component OpenVPN Handler. The manipulation of the argument openvpn_ip results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.Dans 7 jrecommandéeHauteWN536AX6-A V260507CVSS 10,0EPSS –il y a 14 h
• 60WN536AX6-ACVE-2026-120280A vulnerability has been found in WAVLINK WN536AX6-A V260507. The impacted element is the function wireguard_cli_group handler of the file /protocol.csp of the component WireGuard. The manipulation of the argument group_id/group_name leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.Dans 7 jrecommandéeHauteWN536AX6-A V260507CVSS 10,0EPSS –il y a 14 h
• 60WN536AX6-ACVE-2026-120279A flaw has been found in WAVLINK WN536AX6-A V260507. The affected element is an unknown function of the file /protocol.csp of the component openvpn_cli Handler. Executing a manipulation of the argument file_id can lead to os command injection. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure.Dans 7 jrecommandéeHauteWN536AX6-A V260507CVSS 10,0EPSS –il y a 14 h
• 60WN536AX6-ACVE-2026-120277A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.0. This issue affects the function sub_41a1d8 of the file /bin/ioos of the component WireGuard CLI Group Handler. Such manipulation of the argument group_name leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure.Dans 7 jrecommandéeHauteWN536AX6-A V260507_2.0.0CVSS 10,0EPSS –il y a 15 h
• 60WN536AX6-ACVE-2026-120276A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.0. This vulnerability affects the function sub_416760 of the file /bin/ioos of the component Web Management Interface. This manipulation of the argument group_name causes os command injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure.Dans 7 jrecommandéeHauteWN536AX6-A V260507_2.0.0CVSS 10,0EPSS –il y a 15 h
• 60prefab-uiCVE-2026-120338Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno subprocess. The feature is documented as isolation for untrusted code, including LLM-written UI. From prefab-ui 0.14.0 through 0.20.2 the launcher starts Deno with unrestricted --allow-read, --allow-write, and --allow-net, and the runner leaves the Deno API on the JavaScript global object. Pyodide's js module proxies that global, so the Python can call Deno.readTextFileSync and Deno.writeTextFileSync. A caller who can supply the code can read and write files as the server OS user, and can persist code execution by writing a .pth file into the server virtualenv's site-packages. The usual remote path is FastMCP's GenerativeUI provider, which registers the MCP tool generate_prefab_ui and forwards that tool's code argument into this sandbox. On a FastMCP server with no authentication configured, any client who can reach the server can call the tool. With authentication, any client allowed to call tools can. Generative UI is opt-in, and the host must have Deno installed. Confirmed on prefab-ui 0.20.2. Fixed in 0.21.0: after the runtime and Prefab sources load, the runner revokes Deno read, write, and network permission before it accepts code, the process is started with --no-prompt so a permission request cannot grant them again, and bootstrap network access is limited to cdn.jsdelivr.net. The fix is commit 030f074 (pull request 538).Dans 6 jrecommandéeHauteprefab-ui 0.14.0 → < 0.21.0CVSS 10,0EPSS –il y a 23 h
• 59TermixCVE-2026-120322A vulnerability was identified in Termix-SSH Termix up to 2.9.2. This issue affects some unknown processing of the file /plugin-api/file-manager/transferToHost. The manipulation of the argument destPath leads to path traversal. The attack may be initiated remotely. The exploit is publicly available and might be used. The shortcut was removed in the standalone File Manager plugin v1.0.0 (transfer engine now always writes over SFTP) and in core v26.10.0. The vendor was contacted early about this disclosure but did not respond in any way.Dans 7 jrecommandéeHauteTermix 2.9.0, 2.9.1…CVSS 9,9EPSS –il y a 13 h
• 59WN536AX6-ACVE-2026-120282A vulnerability was determined in WAVLINK WN536AX6-A V260507. This impacts the function host_black of the file /protocol.csp. This manipulation of the argument mac causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.Dans 7 jrecommandéeHauteWN536AX6-A V260507CVSS 9,9EPSS –il y a 14 h
• 59WN553X1-BCVE-2026-120240A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. This issue affects the function sub_41A748 of the file /bin/ioos of the component WireGuard CLI Group Handler. Executing a manipulation of the argument group_id/group_name can lead to os command injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.Dans 6 jrecommandéeHauteWN553X1-B V260403_2.0.0CVSS 9,9EPSS –il y a 20 h
• 59WN553X1-BCVE-2026-120239A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_419DA8 of the file /bin/ioos of the component WireGuard CLI Handler. Performing a manipulation of the argument file_id results in os command injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.Dans 6 jrecommandéeHauteWN553X1-B V260403_2.0.0CVSS 9,9EPSS –il y a 21 h
• 59WN553X1-BCVE-2026-120238A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This affects the function sub_4162A8 of the file /bin/ioos of the component ovpn_file Handler. Such manipulation of the argument file_id leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure.Dans 6 jrecommandéeHauteWN553X1-B 260403_2.0.0CVSS 9,9EPSS –il y a 21 h
• 59WN553X1-BCVE-2026-120231A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. The affected element is the function sub_416568 of the file /bin/ioos of the component OpenVPN CLI Handler. This manipulation of the argument file_id causes os command injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure.Dans 6 jrecommandéeHauteWN553X1-B V260403_2.0.0CVSS 9,9EPSS –il y a 1 j
• 59WN701AECVE-2026-120230A vulnerability was found in WAVLINK WN701AE 260105. Impacted is the function del_vlan_group of the component ioos Web Backend. The manipulation of the argument vlan_name results in os command injection. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure.Dans 6 jrecommandéeHauteWN701AE 260105CVSS 9,9EPSS –il y a 1 j
• 59ChromeCVE-2026-118312Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)DemainrecommandéeHauteChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 9,6EPSS 0,31 %il y a 6 j
• 59ChromeCVE-2026-118308Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)DemainrecommandéeHauteChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 9,6EPSS 0,31 %il y a 6 j
• 59ChromeCVE-2026-118310Improper input validation in Views in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)DemainrecommandéeHauteChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 9,6EPSS 0,31 %il y a 6 j
• 59ChromeCVE-2026-118342Out of bounds write in Editing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)DemainrecommandéeHauteChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 9,6EPSS 0,29 %il y a 6 j
• 59ChromeCVE-2026-118316Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)DemainrecommandéeHauteChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 9,6EPSS 0,29 %il y a 6 j
• 59ChromeCVE-2026-118332Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)DemainrecommandéeHauteChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 9,6EPSS 0,29 %il y a 6 j
• 59ChromeCVE-2026-118340Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)DemainrecommandéeHauteChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 9,6EPSS 0,35 %il y a 6 j
• 59ChromeCVE-2026-118305Memory corruption in Turbolev in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)DemainrecommandéeHauteChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 9,6EPSS 0,37 %il y a 6 j
• 59ChromeCVE-2026-118306Memory corruption in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)DemainrecommandéeHauteChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 9,6EPSS 0,37 %il y a 6 j
• 56Produit non préciséCVE-2026-116606An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.Dans 7 jrecommandéeHauteCVSS 9,3EPSS –il y a 2 h
• 56Produit non préciséCVE-2025-11969The System REST APIs do not correctly enforce access control mechanisms, allowing users with lower privilege roles to execute administrative actions that should be restricted. This weakness permits unauthorized operations on the affected product. Successful exploitation could enable a malicious actor to perform unauthorized administrative operations, including executing administrative functions. APIs exposed through the WSO2 API Manager's API Gateway are not affected by this vulnerability.Dans 7 jrecommandéeHauteCVSS 9,4EPSS –il y a 9 h
• 56BookItCVE-2026-62048Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6.Dans 6 jrecommandéeHauteBookIt ≤ 2.6.0.6CVSS 9,3EPSS –il y a 23 h
• 55Produit non préciséCVE-2026-120213@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 9.0.0 through 11.6.5, when an application uses parameterized prefix and rewritePrefix options to pin clients to a fixed upstream path, the plugin substitutes URL-decoded route parameters into rewritePrefix without re-encoding them. A parameter value that encodes a path separator together with a fragment or query delimiter therefore decodes into real separators and delimiters that inject extra upstream path segments and strip the mandatory suffix the rewritePrefix was meant to enforce, without using any dot-dot traversal. An unauthenticated remote attacker can use this to reach upstream locations outside the intended prefix, leading to path-restriction bypass and, depending on the upstream, server-side request forgery or authorization bypass in the proxied service. The issue is fixed in @fastify/http-proxy 11.6.6, and users should upgrade to 11.6.6 or later. There is no workaround other than upgrading.Dans 7 jrecommandéeHautecvefeed.ioCVSS 9,1EPSS –il y a 4 h
• 54ChromeCVE-2026-118338Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)MoyenneChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 8,8EPSS 0,26 %il y a 6 j
• 54ChromeCVE-2026-118315Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)MoyenneChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 8,8EPSS 0,26 %il y a 6 j
• 54ChromeCVE-2026-118330Use after free in Browser in Google Chrome on on Windows prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)MoyenneChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 8,8EPSS 0,33 %il y a 6 j
• 54ChromeCVE-2026-118341Use after free in Modularization in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)MoyenneChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 8,8EPSS 0,26 %il y a 6 j
• 54ChromeCVE-2026-118347Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)MoyenneChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 8,8EPSS 0,26 %il y a 6 j
• 54ChromeCVE-2026-118335Improper input validation in Metrics in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)MoyenneChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 8,8EPSS 0,26 %il y a 6 j
• 54ChromeCVE-2026-118346Use after free in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)MoyenneChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 8,8EPSS 0,26 %il y a 6 j
• 54ChromeCVE-2026-118304Improper input validation in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)MoyenneChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 8,8EPSS 0,27 %il y a 6 j
• 54ChromeCVE-2026-118345Use after free in PDFium in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)MoyenneChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 8,8EPSS 0,26 %il y a 6 j
• 54ChromeCVE-2026-118313Use after free in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)MoyenneChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 8,8EPSS 0,27 %il y a 6 j
• 54ChromeCVE-2026-118334Use after free in ImageCapture in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)MoyenneChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 8,8EPSS 0,26 %il y a 6 j
• 54ChromeCVE-2026-118311Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)MoyenneChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 8,8EPSS 0,27 %il y a 6 j
• 54ChromeCVE-2026-118343Improper input validation in ReadingList in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)MoyenneChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 8,8EPSS 0,26 %il y a 6 j
• 54ChromeCVE-2026-118327Memory corruption in Media in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)MoyenneChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 8,8EPSS 0,27 %il y a 6 j
• 54ChromeCVE-2026-118349Memory corruption in Payments in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)MoyenneChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 8,8EPSS 0,26 %il y a 6 j
• 54ChromeCVE-2026-118336Improper input validation in Headless in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)MoyenneChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 8,8EPSS 0,32 %il y a 6 j
• 54ChromeCVE-2026-118328Improper input validation in WebRTC in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)MoyenneChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 8,8EPSS 0,40 %il y a 6 j
• 54ChromeCVE-2026-118307Use after free in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)MoyenneChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 8,8EPSS 0,33 %il y a 6 j
• 54ChromeCVE-2026-118329Improper input validation in ANGLE in Google Chrome on on Mac prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)MoyenneChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 8,8EPSS 0,39 %il y a 6 j
• 54ChromeCVE-2026-118320Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)MoyenneChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 8,8EPSS 0,32 %il y a 6 j
• 54ChromeCVE-2026-118317Memory corruption in HTML in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)MoyenneChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 8,8EPSS 0,32 %il y a 6 j
• 54ChromeCVE-2026-118339Use after free in Animation in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)MoyenneChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 8,8EPSS 0,32 %il y a 6 j
• 54ChromeCVE-2026-118344Use after free in Layout in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)MoyenneChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 8,8EPSS 0,34 %il y a 6 j
• 54ChromeCVE-2026-118348Improper input validation in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)MoyenneChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 8,8EPSS 0,34 %il y a 6 j
• 54ChromeCVE-2026-118331Improper input validation in FileAPI in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical)MoyenneChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 8,8EPSS 0,34 %il y a 6 j
• 53Produit non préciséCVE-2026-102802Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension < 20.1.1 - Sourcerer can restrict PHP in articles according to article-author trust; the exact creator and last-editor rule varies by release. Articles Anywhere can insert the text or full layout of one article into another. In the affected combination, when Articles Anywhere processes an inclusion before Sourcerer and Force Content Triggers is off, the included article's Sourcerer code can be evaluated using the enclosing article's trusted identity rather than the included article's own identity. The resulting gap is between the authority of the article supplying the code and the authority used to decide whether to run it. Ordinary Articles Anywhere output is not itself the issue.MoyenneCVSS 8,9EPSS –il y a 40 min
• 53Produit non préciséCVE-2026-18199Zohocorp ManageEngine Password Manager Pro versions before 13236 and PAM360 versions before 8601 are vulnerable to an authenticated Remote Code Execution vulnerability.MoyenneCVSS 8,8EPSS –il y a 7 h
• 53chatCVE-2026-120315LobeHub Chat from 1.84.26 before 2.1.49 contains a path traversal vulnerability that allows authenticated users to write arbitrary files by supplying unsanitized file names to writeTempFile(). Attackers can create a file record via file.createFile with a traversal name, then trigger document parsing to overwrite application files like startServer.js for code execution or denial of service.Moyennechat 1.84.26 → < 2.1.49CVSS 8,8EPSS –il y a 12 h
• 53Network-AICVE-2026-120312Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in AgentVCR that allows attackers controlling the cassette name to read or write arbitrary .json files. Attackers can pass traversal sequences to load() or save() to disclose sensitive JSON data or overwrite policy files such as AuthGuardian trust-level configuration.MoyenneNetwork-AI 5.13.4 → < 5.15.5CVSS 8,8EPSS –il y a 12 h
• 53Network-AICVE-2026-120311Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in FileJobStore that allows attackers to read or delete arbitrary .json files by supplying traversal sequences in the job id. Attackers controlling the id passed to FileJobStore.get(), FileJobStore.delete(), or JobQueue.getJob() can disclose credentials and grant tokens or delete configuration files to weaken AuthGuardian authorization.MoyenneNetwork-AI 5.13.4 → < 5.15.5CVSS 8,8EPSS –il y a 12 h
• 53Reboot Restore StandardCVE-2026-120232A vulnerability was identified in Horizon DataSys Reboot Restore Standard up to 13.2. The impacted element is the function sub_23908 in the library shield.sys of the component Kernel Driver. Such manipulation leads to memory corruption. The attack can only be performed from a local environment. The exploit is publicly available and might be used. A fix is planned for the upcoming release.MoyenneReboot Restore Standard 13.0, 13.1…CVSS 8,8EPSS –il y a 1 j
• 52Produit non préciséCVE-2026-105602Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate < 2.2.11.MoyenneCVSS 8,6EPSS –il y a 40 min
• 52Produit non préciséCVE-2026-105600Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5MoyenneCVSS 8,6EPSS –il y a 40 min
• 52Produit non préciséCVE-2026-103419Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11.MoyenneCVSS 8,6EPSS –il y a 40 min
• 52Produit non préciséCVE-2026-111560Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.MoyenneCVSS 8,6EPSS –il y a 2 h
• 52Produit non préciséCVE-2026-8923Zohocorp ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 are vulnerable to Authenticated Remote Code Execution in Log Forward option.Moyennecvefeed.ioCVSS 8,7EPSS –il y a 4 h
• 52Produit non préciséCVE-2026-2613The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the structure of SQL statements. A user with administrator privileges can exploit this by influencing the structure of executed SQL statements, enabling blind SQL injection to infer database information and potentially impact the availability of the database service.Moyennecvefeed.ioCVSS 8,7EPSS –il y a 4 h
• 50ZillaCVE-2026-120324A weakness has been identified in Aklivity Zilla up to 1.3.4/2.4.7/2.5.0-rc2. The affected element is the function Path.resolve of the file FileSystemServerFactory of the component http-filesystem Binding. This manipulation of the argument params causes path traversal. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.5.0-rc3 is sufficient to fix this issue. Patch name: 46a8b15cbea157f7ae8b7cb865809a02fd6b1988. You should upgrade the affected component.MoyenneZilla 1.3.0, 1.3.1…CVSS 8,3EPSS –il y a 12 h
• 50Apache WicketCVE-2026-84170Allocation of resources without limits or throttling in Apache Wicket. org.apache.wicket.markup.html.form.upload.resource.AbstractFileUploadResource is the server side of the form-less upload offered by FileUploadToResourceField, which posts the selected files to a separately mounted resource rather than through a Form. The resource is an application-wide singleton with no component to consult, so newResourceResponse() takes the three limits that bound the upload - the total request size, the maximum size of a single part and the maximum number of parts - from the request parameters maxSize, fileMaxSize and fileCountMax, and hands them to the multipart parser as they arrive. Nothing binds those numbers to the field that is supposed to be uploading. A request naming a very large maxSize is therefore parsed with no effective ceiling on the total size, and omitting fileMaxSize and fileCountMax leaves the per-part and part-count limits unset as well. The values the application configured through FileUploadToResourceField#setMaxSize(), #setFileMaxSize() and #setFileCountMax() are consulted only when the client omits the corresponding parameter, so against a client that supplies one they have no effect at all. Parts above the parser's in-memory threshold are spooled to the container's temporary directory, and the file parts are then copied into the folder the application's IUploadsFileManager owns, under a sub-folder the request names, where they remain. A part that is not a file is read into the heap in full while the request is parsed. One request, repeatable, can therefore consume as much disk or as much heap as the client chooses to send. The resource carries no authorization annotation and the default authorization strategy permits every resource request, so unless the application authorizes the resource itself the request needs no authentication, no session, no prior page view and no user interaction. An application is affected where it uses FileUploadToResourceField, or mounts FileUploadResourceReference itself. This is not the ordinary upload path: the resource is a singleton that has to be created and mounted deliberately. An application that configures no upload limit at all loses nothing, because Wicket applies no total-size limit of its own by default; what the defect removes is a limit the application set. Uploads through Form with FileUploadField, and through AjaxFileDropBehavior, are not affected, because both read their limits from the component rather than from the request. The upload resource does not exist in the 8.x line. This issue affects Apache Wicket: from 9.14.0 through 9.24.0, from 10.0.0 through 10.9.1. Users are recommended to upgrade to version 9.25.0 or 10.12.0, which fix the issue.MoyenneApache Wicket 9.14.0 → 9.24.0, 10.0.0 → 10.9.1CVSS 8,3EPSS –il y a 16 h
• 50Apache WicketCVE-2026-83594Memory allocation with an excessive size value in Apache Wicket. org.apache.wicket.markup.html.form.upload.resource.FileUploadToResourceField uploads files to a separately mounted resource rather than through a form, and is told the outcome afterwards over its own Ajax callback. That callback reads the request parameter filesInfo, a JSON array carrying a client file name, a size and a content type for each file, and turns it into the list of FileUploadToResourceField.UploadInfo that onUploadSuccess() receives. Nothing binds that JSON to an upload the resource performed and nothing re-derives it from the stored files, so the number of entries and every value in them are whatever the request supplied. The callback URL is rendered into the page, no prior upload is required, and both GET and POST reach it, so any client that can load the page can have the component report files that were never uploaded, without authenticating beyond whatever the page itself requires and without any user interaction. UploadInfo#get(), which the class offers as the way to obtain the bytes of an upload, allocates a byte array from UploadInfo#getSize() before it opens the file. The array is therefore sized by the number the request supplied, and the allocation happens even for a file that was never stored. One small request can cost the server close to two gigabytes of heap, and the request is trivially repeatable, so a few of them exhaust the heap for every request the Java virtual machine is serving. A size that the conversion to int turns negative instead throws NegativeArraySizeException, which the exception handler inside that method does not cover, so it escapes into the application. An application is affected where it uses FileUploadToResourceField, which is not the ordinary upload path through FileUploadField and Form and has to be extended and mounted deliberately. The allocation additionally requires the application to call UploadInfo#get() rather than reading UploadInfo#getFile() itself. Where the application denies the ENABLE action on the field through its authorization strategy, the callback is refused like any other listener. The 8.x line does not contain this component and is not affected. This issue affects Apache Wicket: from 9.14.0 through 9.24.0, from 10.0.0 through 10.11.0. Users are recommended to upgrade to version 9.25.0 or 10.12.0, which fix the issue.MoyenneApache Wicket 9.14.0 → 9.24.0, 10.0.0 → 10.11.0CVSS 8,3EPSS –il y a 16 h
• 49Produit non préciséCVE-2026-117518@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server. In versions up to and including 12.8.0, the plugin validated proxy paths against forward-slash dot-segments only and then built the target with the WHATWG URL parser, which normalizes a backslash and its percent-encoded form to a forward slash on the http, https, ws, and wss schemes. A path that uses backslash dot-segments therefore bypasses the traversal check and resolves to a different upstream path, so an application that scopes proxying to an upstream prefix, or relies on route guards in front of the forwarding call, can have an unauthenticated request escape the intended prefix and reach other upstream endpoints. The resulting access to unintended upstream resources is primarily a confidentiality impact with limited integrity impact. The issue is fixed in @fastify/reply-from 12.8.1, where the path is normalized and any segment resolving to a single or double dot, along with control characters and ambiguous whitespace, is rejected before the URL is constructed, and users should upgrade to 12.8.1 or later. There is no workaround other than upgrading.Moyennecvefeed.ioCVSS 8,2EPSS –il y a 4 h
• 48Produit non préciséCVE-2026-94349Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Command execution.Moyennecvefeed.ioCVSS 8,0EPSS –il y a 2 h
• 47Produit non préciséCVE-2026-92886Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-register allows Privilege Escalation. This issue affects eta-register: from 2.0.8 before 2.0.9.Moyennecvefeed.ioCVSS 7,8EPSS –il y a 2 h
• 46Apache WicketCVE-2026-95863Improper neutralization of input during web page generation in Apache Wicket. Apache Wicket generates JavaScript that refers to the elements it renders, and writes into that JavaScript two values it derives itself: a component's markup id, and the input name of a form component, which is built from component ids. Both are placed inside single-quoted JavaScript string literals without being escaped for that context, so a value containing a single quote or a backslash ends the literal, and what follows is parsed as script and runs in the application's origin when the page loads. A markup id is the value passed to org.apache.wicket.Component#setMarkupId(String), or the id attribute written in the component's markup, or an id Wicket generates, in that order. The first two are supplied by the application in an HTML context, where both characters are legal and where Wicket escapes them correctly when it writes the same value into the id attribute of the element; a generated id cannot contain either. An input name is derived from the ids of the components between the form and the form component, and a component id was rejected only for ':' and '~'. In org.apache.wicket:wicket-core on 9.x and 10.x, org.apache.wicket.markup.head.OnEventHeaderItem#forMarkupId(String, String, CharSequence) quotes the id it is given into a Wicket.Event.add call, and components in both wicket-core and wicket-extensions reach it through #forComponent(Component, String, CharSequence). On every affected version, org.apache.wicket.markup.html.form.Form writes its markup id and the id of its hidden-fields container into such literals, org.apache.wicket.markup.html.form.FormComponentUpdatingBehavior writes an input name, and org.apache.wicket.markup.html.form.upload.MultiFileUploadField writes two markup ids and an input name. On 8.x, Form also writes an input name into the action of a submitting link, and on 8.x and 9.x Form#appendDefaultButtonField writes an input name into a name attribute with no escaping at all, so a value containing a double quote escapes the attribute into markup. org.apache.wicket:wicket-extensions is affected in its own right and not only through wicket-core: AjaxEditableLabel, AjaxIndicatorAppender, AjaxDisableComponentListener, UploadProgressBar, KittenCaptchaPanel, Palette, FilterForm and, on 9.x and 10.x, TrapFocusBehavior and AjaxListPanel each build their own JavaScript containing a markup id. An application is affected where a markup id or a component id carries one of those characters. Wicket does not put one there itself, so the value comes from the application: an id set on a component, an id attribute in a template, or a component id derived from data. None of those is a JavaScript context from the application's point of view. The Content-Security-Policy that Apache Wicket 9.x and 10.x send by default does not prevent this. The generated script is written into a script element carrying the per-response nonce, so the injected code is part of a script the policy admits. The fixed versions check an id where it enters instead of escaping each place it is written. A component id and a markup id may no longer contain a quote, a backquote, a backslash, braces, angle brackets, a semicolon, an ampersand or a control character, and a markup id may not contain parentheses or square brackets either; a component constructed with such an id, or given such a markup id, fails with an exception. This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.MoyenneApache Wicket 8.0.0 → 8.19.0, 9.0.0 → 9.24.0…CVSS 7,6EPSS –il y a 16 h
• 46Apache WicketCVE-2026-82956Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.ajax.AjaxNewWindowNotifyingBehavior notices that a page instance has been opened in a second browser window or tab. It asks the browser for the value of window.name, which reaches the server as the request parameter windowName, and remembers what the browser reported in a field of the behaviour. That field is part of the page's serialized state, so the remembered value stays in the page store for as long as the page instance does. On every later render of that page instance the behaviour builds the precondition of its Ajax call by substituting the remembered value into a single-quoted JavaScript string literal, and Wicket writes that precondition into the page as raw JavaScript, because the precondition of an Ajax call listener is script supplied by the caller and is emitted without quoting or escaping. Nothing on that path escapes the value. The window name is client-supplied and Wicket applies no validation to it, so a remembered name containing a single quote ends the literal and the rest of it runs as script in the application's origin, every time that page instance is rendered. An application is affected only where it has explicitly added AjaxNewWindowNotifyingBehavior to a component. No part of the framework installs the behaviour, so an application that does not use it is not affected. The name the behaviour generates for itself, when the browser reports no name at all, is a random UUID and is not client-supplied. This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.MoyenneApache Wicket 8.0.0 → 8.19.0, 9.0.0 → 9.24.0…CVSS 7,6EPSS –il y a 16 h
• 46Apache WicketCVE-2026-111089Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes some of them into the JavaScript and the markup it generates for a component. Those texts are placed inside single-quoted JavaScript string literals and inside quoted attribute values without being escaped for that context, so a text containing a quote ends the literal or the attribute, and what follows is parsed as script or as markup in the application's origin when the page loads. A resource bundle entry is authored for the application and does not say where the framework will write it. The same key is read by the framework into element text, where Wicket escapes it, and into the contexts below, where it did not. A text containing an apostrophe, which is ordinary in several languages, is enough to break the page; a text under the influence of another party is enough to run script. In org.apache.wicket:wicket-core, org.apache.wicket.markup.html.form.upload.MultiFileUploadField writes the org.apache.wicket.mfu.delete message into a JavaScript string literal, and org.apache.wicket.markup.html.form.Form writes the hidden-fields css class into the class attribute of the container it renders for its hidden fields; on 8.0.0 through 8.19.0 and 9.0.0 through 9.24.0 Form#appendDefaultButtonField writes the same css class into a second container. In org.apache.wicket:wicket-extensions, UploadProgressBar writes its UploadProgressBar.starting text into a JavaScript string literal, FilterForm writes the hidden-fields css class into the class attribute of its hidden input markup, and on 9.0.0 through 9.24.0 and 10.0.0 through 10.11.0 TrapFocusBehavior writes its current css class into a JavaScript string literal. The Content-Security-Policy that Apache Wicket 9.x and 10.x send by default does not prevent the JavaScript cases: the generated script is written into a script element carrying the per-response nonce, so the injected code is part of a script the policy admits. It does prevent an inline event handler injected through the attribute cases. This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.MoyenneApache Wicket 8.0.0 → 8.19.0, 9.0.0 → 9.24.0…CVSS 7,6EPSS –il y a 16 h
• 45Produit non préciséCVE-2026-74993Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Starnet Computer and Network Systems Inventory Tracking Application allows SQL Injection. This issue affects Inventory Tracking Application: through 2026-10-16.MoyenneCVSS 7,5EPSS –il y a 40 min
• 45Produit non préciséCVE-2026-101186DoS vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect availability.MoyenneCVSS 7,5EPSS –il y a 8 h
• 45Network-AICVE-2026-120313Network-AI before 5.15.5 contains a path traversal vulnerability in InputSanitizer.sanitizePath() that allows attackers to escape the base directory using sibling-directory paths. Attackers can supply paths whose directory name shares a string prefix with the base, bypassing the unanchored startsWith check to read, list, or write files outside the sandbox.MoyenneNetwork-AI < 5.15.5CVSS 7,5EPSS –il y a 12 h
• 45RG-ES205GCCVE-2026-120241A vulnerability was identified in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. Impacted is an unknown function of the file httpupg.cgi of the component Local Firmware Upgrade Interface. The manipulation leads to buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.MoyenneRG-ES205GC ESW_1.0(1)B1P48CVSS 7,5EPSS –il y a 20 h
• 44Produit non préciséCVE-2026-120349A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.4. Affected by this issue is the function str_replace of the file /var/www/html/zzmob/index.php of the component Mobile Site Directory. The manipulation of the argument dirname results in code injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.MoyenneCVSS 7,3EPSS –il y a 8 h
• 44Produit non préciséCVE-2026-120348A vulnerability was identified in dayrui XunRuiCMS up to 4.7.4. Affected by this vulnerability is the function _get_tpl_content of the file dayrui/Fcms/Library/Notice.php of the component Email Template Rendering. The manipulation leads to code injection. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.MoyenneCVSS 7,3EPSS –il y a 9 h
• 44Produit non préciséCVE-2026-120347A vulnerability was determined in dayrui XunRuiCMS up to 4.7.4. Affected is the function View of the file dayrui/Fcms/Core/View.php of the component Member Module. Executing a manipulation of the argument catid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 9b6ea0cf9c6e8cdc9a5260c38b95da5fed4c4231. The affected component should be upgraded.MoyenneCVSS 7,3EPSS –il y a 9 h
• 44Produit non préciséCVE-2026-120342A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project. The affected element is an unknown function of the file viewquery.php. The manipulation of the argument eid results in sql injection. The attack can be executed remotely. The exploit is now public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.MoyenneCVSS 7,3EPSS –il y a 10 h
• 44Produit non préciséCVE-2026-120341A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project. Impacted is an unknown function of the file studentdetails.php. The manipulation leads to execution after redirect. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.MoyenneCVSS 7,3EPSS –il y a 10 h
• 44Produit non préciséCVE-2026-120337A vulnerability was determined in VStarcam O-KAM SuperIPCam 1.3.3.32. Affected by this issue is the function FUN_005a2d44 of the file SuperIPCam.exe of the component P2P Session Teardown. This manipulation causes use after free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.MoyenneCVSS 7,3EPSS –il y a 11 h
• 44Produit non préciséCVE-2026-120336A vulnerability was found in VStarcam O-KAM Client 1.3.3.32. Affected by this vulnerability is the function FUN_10003EA0 in the library DevDll_925.dll. The manipulation results in stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.MoyenneCVSS 7,3EPSS –il y a 11 h
• 44Network-AICVE-2026-120314Network-AI from 5.14.0 before 5.15.5 contains a missing authentication vulnerability in the A2AServer class that allows unauthenticated attackers to access task operations when no secret is configured. Attackers can send JSON-RPC requests to tasks/send, tasks/get, and tasks/cancel without a Bearer token to execute tasks, read results, and cancel tasks.MoyenneNetwork-AI 5.14.0 → < 5.15.5CVSS 7,3EPSS –il y a 12 h
• 44Apache WicketCVE-2026-84231Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.link.ExternalLink builds a JavaScript click handler and writes it into the tag's onclick attribute whenever the markup tag the component is bound to is not an a, link or area element. The URL held in the component's model is concatenated into a single-quoted JavaScript string literal in that handler without being escaped for that context. The same happens on the neighbouring branch, taken when popup settings are attached, where the value is concatenated into the window.open() call built by org.apache.wicket.markup.html.link.PopupSettings#getPopupJavaScript(). The only escaping applied is the markup escaping that every attribute value receives as the tag is written, which replaces an apostrophe with a character reference. A browser decodes character references in an attribute value before it compiles the event handler, so the apostrophe is restored, closes the string literal, and the rest of the model value is executed as script in the application's origin. An application is affected where it binds an ExternalLink to a markup tag that is not an anchor, such as a button or a span, and the URL in the model holds data an attacker can influence, which is the ordinary use of the component rather than a misuse of it. Nothing runs until a user activates the element. This issue affects Apache Wicket: from 8.0.0 through 8.19.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. Users are recommended to upgrade to version 8.20.0, which fixes the issue.MoyenneApache Wicket 8.0.0 → 8.19.0CVSS 7,4EPSS –il y a 16 h
• 44Apache WicketCVE-2026-83559Improper encoding or escaping of output in Apache Wicket. org.apache.wicket.core.util.string.JavaScriptUtils#escapeQuotes() replaces each single quote in its input with a backslash and a single quote, and each double quote with a backslash and a double quote, so that the value can be placed inside a JavaScript string literal. It does not escape the backslash, which is the character that has to be escaped, and escaped first, for the rest of that escaping to hold. A value that already holds a backslash immediately before a quote therefore ends up with two backslashes in front of that quote: the first escapes the second, the quote itself is left unescaped, and it closes the literal. Whatever the value carries after that point is no longer text but JavaScript, and it runs in the application's origin and in the session of the user looking at the page. The method is public, is not deprecated, and its documentation states that its result can be part of a JavaScript call such as an alert; the only limitation it notes concerns JSON values, which need different escaping. An application is affected wherever it calls the method itself and places the result inside a JavaScript string literal, from its own code or from a component of its own or of a third party, and the value it escapes holds data an attacker can influence. There is no further condition, and no component of Wicket has to be involved: the application is using the method for what its documentation offers, and the method does not deliver it. Two components shipped with Wicket Extensions pass a value through the method. org.apache.wicket.extensions.ajax.markup.html.AjaxEditableLabel writes the editor's first error feedback message into a single-quoted JavaScript string literal in the Ajax response, so an application is affected through that component where the message shown for a failed edit holds data an attacker can influence, whether that is the submitted value itself or another variable the application sets on the validation error. A validation message can carry the submitted value, because input is a message variable that every form component supplies for its own validation errors, and the documentation shows overriding a validator's message to include it; none of the message bundles shipped with Wicket interpolates it, so an application that has not written such a message is not affected through this component. org.apache.wicket.extensions.ajax.markup.html.repeater.AjaxListPanel passes the serialized markup tag of an appended component through the method and is not affected: the tag comes from the panel's own markup file, and a quote in any of its attribute values, the component's markup id included, is written as a character reference by the tag serialization and cannot close the literal. This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.MoyenneApache Wicket 8.0.0 → 8.19.0, 9.0.0 → 9.24.0…CVSS 7,4EPSS –il y a 16 h
• 44Apache WicketCVE-2026-83539Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html.basic.SmartLinkLabel and org.apache.wicket.extensions.markup.html.basic.SmartLinkMultiLineLabel display a text value and turn any URL they find in it into a hyperlink. Both escape the model value and then hand the escaped text to org.apache.wicket.extensions.markup.html.basic.DefaultLinkParser, which searches it for anything of the form scheme://rest and wraps each match in an anchor whose href is the matched text, copied in as it is. The pattern accepts any scheme, and there is no list of permitted schemes anywhere on the path. A text value naming a scheme that executes script therefore becomes an anchor that executes it, in the application's origin and in the reader's own session, when the reader clicks the link. Rendering the page is not enough on its own; the link has to be activated. Escaping does not prevent this and is not the issue: the characters the payload needs are all valid in a URL and are ones that org.apache.wicket.util.string.Strings#escapeMarkup() leaves alone, and the value ends up in a URL rather than in element text, which is a context that escaping model data does not make safe. An application is affected where it renders text it received through either of these two components. That is what they are for: they exist to linkify email addresses and web URLs found in the data an application is displaying, so untrusted input is the purpose of the feature rather than a misuse of it, and no unusual configuration is involved. No other component uses this parser, and an application that uses neither SmartLinkLabel nor SmartLinkMultiLineLabel is not affected. On 9.x and 10.x the Content-Security-Policy Wicket sends by default admits script only from a source carrying a per-response nonce, and a URL whose scheme executes script cannot carry one, so that default policy stops the script from running. This is a property of the default policy and not of these components. An application that has weakened or disabled its Content-Security-Policy, for this or for any unrelated reason, is affected in full. Wicket 8.x has no Content-Security-Policy support at all and is affected as it stands. This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.MoyenneApache Wicket 8.0.0 → 8.19.0, 9.0.0 → 9.24.0…CVSS 7,4EPSS –il y a 16 h
• 43Produit non préciséCVE-2026-103420Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5MoyenneCVSS 7,2EPSS –il y a 40 min
• 43Produit non préciséCVE-2026-101176Permission control vulnerability in the event notification management module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.MoyenneCVSS 7,1EPSS –il y a 8 h
• 43Apache WicketCVE-2026-82840Session fixation in Apache Wicket. org.apache.wicket.authroles.authentication.AuthenticatedWebSession is the authentication base class of Wicket's role-based security module, and its signIn(String, String) method is the entry point through which an application authenticates a session. Renewing the container session id at that point is the standard defence against an attacker who has fixed a session id in a victim's browser, and Wicket provides that renewal as org.apache.wicket.Session#changeSessionId(), whose documentation directs callers to invoke it on login for exactly that reason. AuthenticatedWebSession#signIn(String, String) calls it inside a guard that succeeds only on the first transition of the session's signed-in flag. The session id is therefore renewed when a session first signs in, and is not renewed when a session that is already signed in authenticates again. signIn(String, String) returns true either way, so neither the caller nor the application can tell that the renewal did not happen. An application is affected where it authenticates through AuthenticatedWebSession, which AuthenticatedWebApplication requires and which the shipped UsernamePasswordPanel uses, and where a session that is already signed in can authenticate again: a step-up prompt before a sensitive action, an account switch, or simply a sign-in form that stays reachable once the user is signed in. Nothing in the module hides that form from a signed-in session. Reaching the defect also requires an attacker to place a session id of their choosing in the victim's browser. JSESSIONID is set by the servlet container rather than by Wicket, so that needs a position Wicket does not grant, such as control of a host under the same registrable domain or a container configured to carry the session id in the URL, and the planted session has to be one the attacker has already signed in on, because a session that is not yet signed in does have its id renewed by the victim's authentication. An authentication attempt that fails signs the session out and closes the window. Applications that renew the session id in their own code after a successful authentication are not affected. As a workaround, renew the session id from the application's own code on every successful authentication, by calling Session#changeSessionId() at the end of the authenticate(String, String) implementation. This issue affects Apache Wicket: from 8.18.0 through 8.19.0, from 9.23.0 through 9.24.0, from 10.9.0 through 10.11.0. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.MoyenneApache Wicket 8.18.0 → 8.19.0, 9.23.0 → 9.24.0…CVSS 7,2EPSS –il y a 17 h
• 43WordPress File UploadCVE-2026-66570Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.1.MoyenneWordPress File Upload ≤ 5.2.1CVSS 7,1EPSS –il y a 23 h
• 41Produit non préciséCVE-2026-91907Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information tamperingMoyennecvefeed.ioCVSS 6,8EPSS –il y a 2 h
• 41Apache WicketCVE-2026-82704Missing authorization in Apache Wicket. org.apache.wicket.core.request.handler.ListenerRequestHandler invokes an IRequestListener only when org.apache.wicket.Component#canCallListener() allows it, and that method is isEnabledInHierarchy() && isVisibleInHierarchy(). The visibility half reads a flag that carries the outcome of IAuthorizationStrategy#isActionAuthorized() for the Component.RENDER action, and that flag is written in one place only, Component#configure(), during the render phase. A listener URL built by a subclass of org.apache.wicket.core.request.mapper.AbstractBookmarkableMapper carries the page identifier and the component path in a single parameter, and the page identifier may be empty. When it is, a new page instance is constructed, PageProvider#wasExpired() is false because no identifier was supplied, and PageAndComponentProvider#getComponent() finds the component directly on the new instance, so neither a render pass nor Component#configure() runs before the listener is invoked. The flag therefore still holds its constructor default, the component counts as visible, and the listener of a component the authorization strategy denied RENDER for is executed. The same request also skips Component#onConfigure(), so visibility and enablement an application sets there are not applied either. There are two ways to reach this, and neither requires anything but a request. On a page that is stateful, the caller omits the page identifier from a listener URL that would otherwise carry it. On a page that Wicket considers stateless, nothing has to be altered at all: Wicket itself writes listener URLs without a page identifier for such pages, and a component the strategy denies RENDER for is treated as stateless and therefore does not keep the page stateful, so denying RENDER can itself produce the page-id-less form. The second route has never been refused. The ENABLE decision of IAuthorizationStrategy is consulted on every invocation and still refuses, as does a request that supplies the real identifier of a page instance that has already been rendered; a component the application disabled in Component#onConfigure() is protected by neither, because that callback has not run. An application is affected where it withholds an individual component from the caller, either by denying the RENDER action through IAuthorizationStrategy, including through the MetaDataRoleAuthorizationStrategy and AuthorizeAction facilities of wicket-auth-roles, or by setting the component's visibility or enabled flag in Component#onConfigure(), the callback Wicket's own documentation directs applications to use for both. The page carrying such a component has to be constructible from a bookmarkable or mounted URL, which requires a public constructor taking either no arguments or a PageParameters argument. Behaviours pass through the same gate, so an AJAX behaviour attached to such a component is equally exposed. Separately, and whether or not any component is withheld, a listener on a page Wicket considers stateful is invoked on an instance the request itself constructed, so it acts on models built from page parameters the caller supplied rather than on the state the application last rendered. Instantiation authorization is unaffected: IAuthorizationStrategy#isInstantiationAuthorized() is still consulted when the new page instance is created, so a guard placed on the page rather than on the individual component continues to hold. This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.MoyenneApache Wicket 8.0.0 → 8.19.0, 9.0.0 → 9.24.0…CVSS 6,9EPSS –il y a 17 h
• 41Apache WicketCVE-2026-82557Missing authorization in Apache Wicket. org.apache.wicket.markup.html.form.Form resolves the component that submitted a form from the request parameters in Form#onRequest() and passes the result directly to Form#onFormSubmitted(IFormSubmitter). The check that the submitting component is visible and enabled in its hierarchy runs only when onFormSubmitted() is given no submitter, so it no longer runs for an ordinary form submission, and it is the only point at which Wicket verifies that the application actually offered the named control to the caller. Form#findSubmitter() matches on the request parameter name alone and applies no visibility or enablement filter, and the request handler checks only the form itself, which is visible and enabled. A request that names a submit button the application withheld therefore reaches that button's onSubmit() and onAfterSubmit(), and its onError() when form validation fails; where the button sets setDefaultFormProcessing(false) it reaches onSubmit() and onAfterSubmit() without any form validation. An application is affected where a form submitting component, such as a Button or a SubmitLink, is unavailable to the caller while the enclosing form remains available. How the component was made unavailable does not matter: the component's own setVisible(false), setEnabled(false) or setVisibilityAllowed(false), an overridden isVisible() or isEnabled(), an invisible or disabled parent container anywhere above it, and a RENDER or ENABLE denial from IAuthorizationStrategy — for example through MetaDataRoleAuthorizationStrategy or the AuthorizeAction annotation — are all enforced by that one check, and all of them are bypassed. A component that renders as disabled carries its own input name in the markup the caller already holds. Submissions made through AjaxFormSubmitBehavior, and therefore through AjaxButton and AjaxSubmitLink, are not affected: those are invoked as a behaviour on the button itself, the behaviour's invocation is authorized against that button, and the non-Ajax callbacks of those two classes do nothing. Restrictions applied to the form or to the page rather than to the submitting component are unaffected. The 9.x and 8.x release lines, and the unsupported lines before them, are not affected; the behaviour was introduced in 10.3.0. This issue affects Apache Wicket: from 10.3.0 through 10.11.0. Users are recommended to upgrade to version 10.12.0, which fixes the issue.MoyenneApache Wicket 10.3.0 → 10.11.0CVSS 6,9EPSS –il y a 17 h
• 40Produit non préciséCVE-2026-101178Permission control vulnerability in the autofill service module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.MoyenneCVSS 6,6EPSS –il y a 7 h
• 39Produit non préciséCVE-2026-120463Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an authenticated, non-administrative user to bypass document ownership restrictions by searching for and linking another user's private document ID to a warranty they own using the `other` document type. Attackers can exploit insufficient authorization checks in the `paperless_search_and_link()` and `serve_paperless_document()` route handlers in file_routes.py to retrieve and disclose private documents belonging to another user via the shared Paperless-ngx API credential, resulting in unauthorized read access and confidentiality loss.MoyenneCVSS 6,5EPSS –il y a 40 min
• 39Produit non préciséCVE-2026-118871SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL injection while logged in.MoyenneCVSS 6,5EPSS –il y a 5 h
• 39Produit non préciséCVE-2026-101173DoS vulnerability in the DSoftBus module. Impact: Successful exploitation of this vulnerability may affect availability.MoyenneCVSS 6,5EPSS –il y a 8 h
• 39JetFormBuilderCVE-2026-119480Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Path Traversal.This issue affects JetFormBuilder: from n/a through 3.6.7.1.MoyenneJetFormBuilder ≤ 3.6.7.1CVSS 6,5EPSS –il y a 23 h
• 38Produit non préciséCVE-2026-91905Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Filesystem access for attacker.Moyennecvefeed.ioCVSS 6,4EPSS –il y a 2 h
• 38KnipCVE-2026-120325A security vulnerability has been detected in Webpro-nl Knip up to 6.44.0. The impacted element is the function writeFile of the file packages/knip/src/IssueFixer.ts of the component Workspace Handler. Such manipulation of the argument workspaces leads to path traversal. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.MoyenneKnip 6.0, 6.1…CVSS 6,3EPSS –il y a 12 h
• 38PublicCMSCVE-2026-120319A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x. This affects the function TradeRefundService.updateAmound of the file publiccms-parent/publiccms-trade/src/main/java/com/publiccms/logic/service/trade/TradeRefundService.java of the component publiccms-trade. Performing a manipulation of the argument refundId results in authorization bypass. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.MoyennePublicCMS 4.*, 5.*…CVSS 6,3EPSS –il y a 13 h
• 38Apache WicketCVE-2026-84177Incorrect behavior order in Apache Wicket: a file path is validated before the framework appends the attributes that complete it. org.apache.wicket.request.resource.PackageResource asks the configured package resource guard about a path built from the scope class' package and the file name in the request URL, and then hands that same path to the resource stream locator together with a style, a variation and a locale. Those three attributes are decoded from the name of the first query parameter and never appear in the string the guard was given. org.apache.wicket.core.util.resource.locator.ResourceNameIterator appends them to that path, each preceded by an underscore, in the order variation, style, locale, before the file extension, so the file that is opened is not the file the guard approved. org.apache.wicket.markup.html.PackageResourceGuard decides whether an HTML file is a component's markup template by looking for a class file of the same name beside it, stripping one underscore-delimited suffix at a time as it goes. HTML is on the default allow list, so that check is the only thing separating a static HTML file, which may be served, from a markup template, which may not. Asked about the name of a template, the guard refuses it correctly. Asked about a shorter name for which no class exists, it accepts, and a style supplied in the URL then completes that name into the markup template of a component class, which is written to the response. An application is affected if the simple name of any of its component classes contains an underscore and no shorter part of that name is itself a class, such as Report_v2 or Wizard_Step1; an application with no such class name is not affected. No unusual deployment, packaging or configuration is required, and running in deployment rather than development mode does not prevent it. Java naming conventions discourage underscores in class names and no module Wicket ships has one, so no framework markup is exposed; what an application exposes this way is its own. A component whose class name has no underscore is not reachable, and neither is its localized or styled markup, because the guard finds the class file under the base name and refuses the request. The attributes cannot change the file extension and cannot leave the component's package, so nothing beyond HTML files in that package is reachable. Access is read-only, and what is disclosed is developer-authored template content: component structure, developer comments, markup that is rendered only under some conditions, inline script, and the endpoints a template names. No user data, credential or session material is reachable this way. An attacker has to name a class in the target package and the component itself, and Wicket writes fully qualified class names into the URL of every package resource it renders. This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.MoyenneApache Wicket 8.0.0 → 8.19.0, 9.0.0 → 9.24.0…CVSS 6,3EPSS –il y a 16 h
• 38Apache WicketCVE-2026-84172Files accessible to external parties in Apache Wicket. org.apache.wicket.markup.html.PackageResourceGuard decides whether a file on the classpath may be streamed to a client as a package resource. HTML is on the default allow list, so the only thing that separates a static HTML file, which may be served, from a component's markup template, which may not, is a check for a class file of the same name beside it. That check calls getResource() on the class loader that loaded wicket-core. The resource itself is reached through different class loaders: the scope class is resolved through the application's IClassResolver, which uses the thread context class loader, and org.apache.wicket.core.util.resource.ClassPathResourceFinder#find() then tries the scope class' own loader, the context class loader, and the wicket-core loader last. Where wicket-core is loaded by a class loader that cannot see the application's classes, the check finds no class file, concludes the file is not a component markup template, and serves it. A request for the package resource URL of a component class then returns that component's markup template with status 200. What is disclosed is developer-authored template content: component structure, developer comments, markup that is rendered only under some conditions, inline script, and the endpoints a template names. Access is read-only, and no user data, credential or session material is reachable this way. Such a deployment is rare. The ordinary packaging, a web archive with wicket-core in WEB-INF/lib, puts the framework and the application in one class loader, so the check finds the class file and the template is refused; those deployments are not affected. The exposure is confined to deployments that give wicket-core a class loader which cannot see the application's component classes: wicket-core placed in a servlet container's shared library directory, in an enterprise archive library directory with the application in the web archive, as an application server global module, or as an OSGi bundle, where wicket-core's bundle cannot resolve a class held by an application bundle. Markup shipped by Wicket's own modules, and by any other code sharing a class loader with wicket-core, remains protected. An attacker has to name a component class, and Wicket writes fully qualified class names into the URL of every package resource it renders. This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users of Apache Wicket 7.x or older, which are no longer supported, should upgrade to a supported version. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.MoyenneApache Wicket 8.0.0 → 8.19.0, 9.0.0 → 9.24.0…CVSS 6,3EPSS –il y a 16 h
• 38Apache WicketCVE-2026-82705Missing authorization in Apache Wicket. org.apache.wicket.authorization.IAuthorizationStrategy declares isResourceAuthorized(), and that method has a single enforcement point in the framework: org.apache.wicket.request.handler.resource.ResourceRequestHandler, the handler that serves a resource reached through a mounted or shared ResourceReference. Components that are handed an org.apache.wicket.request.resource.IResource instance instead call IResource#respond() themselves from their own request listener and never construct that handler. In wicket-core these are org.apache.wicket.markup.html.link.ResourceLink, org.apache.wicket.markup.html.image.Image and org.apache.wicket.markup.html.form.ImageButton; in wicket-extensions it is org.apache.wicket.extensions.ajax.AjaxDownloadBehavior. A resource restricted by a custom isResourceAuthorized() implementation, or by an @AuthorizeResource annotation from wicket-auth-roles, is therefore enforced when it is requested through its own resource URL and is not enforced when the same instance is served through the component that holds it. Which of the two happens is decided by the constructor the application used, and not by anything the application can see in the rendered page. ResourceLink(String, ResourceReference) renders a resource URL and the request is authorized; ResourceLink(String, IResource) renders a component listener URL and it is not. Image, ImageButton and AjaxDownloadBehavior each offer the same pair of constructors and behave the same way. Image and ImageButton write that listener URL into the src attribute of the tag they render, so a browser requests it without any action by the user, and the resource an Image serves may also come from the component's model. An application is affected where it restricts a resource through IAuthorizationStrategy#isResourceAuthorized() or an @AuthorizeResource annotation and then hands that same resource to one of those components as an IResource. An application that does not restrict resources at all is not affected, and neither is a resource that is only mounted or registered as a shared resource. The pattern does not have to be written by the application itself: org.apache.wicket.extensions.markup.html.repeater.data.table.export.ExportToolbar builds each of its export links from an IResource instance, so the exported contents of a data table are served without the resource check in any application that adds that toolbar. As a workaround, register the resource in the application's shared resources and pass the resulting ResourceReference to the component instead of the IResource, so that the request is routed through the handler that consults the authorization strategy. This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.MoyenneApache Wicket 8.0.0 → 8.19.0, 9.0.0 → 9.24.0…CVSS 6,3EPSS –il y a 17 h
• 38Apache WicketCVE-2026-82115Missing authorization in Apache Wicket. org.apache.wicket.protocol.ws.api.WebSocketMessageBroadcastHandler, the request handler Wicket's native WebSocket support uses to deliver an incoming frame, resolves the shared resource named by the client's handshake parameter and calls WebSocketResource#onPayload() on it directly, without consulting IAuthorizationStrategy#isResourceAuthorized(). That method has a single enforcement point in the framework, org.apache.wicket.request.handler.resource.ResourceRequestHandler, which the WebSocket transport does not pass through, and WebSocketResource#respond() is final and empty. No route to a WebSocketResource therefore asks the configured authorization strategy whether the caller may use it, and an @AuthorizeResource annotation on such a class has no effect. A caller needs a bound Wicket session and the name of the resource. The name is not a secret: Wicket writes it into the page that opens the connection. No page of the application is otherwise involved, because a request naming a resource is served with a throwaway page. All of the resource's callbacks are reached this way, including onConnect() and both onMessage() overloads, and what a callback pushes back through WebSocketRequestHandler goes to the caller's own connection. An application is affected where it registers a WebSocketResource as a shared resource and relies on the authorization strategy to restrict it. What the caller gains is whatever that resource's callbacks do with a text or binary message of the caller's choosing. The connection is registered under the caller's own session, so it gives no access to another user's connection. As a workaround, reject unauthorized connections with an IWebSocketConnectionFilter registered through WebSocketSettings#setConnectionFilter(), or repeat the authorization check at the start of each callback. This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Older, unsupported releases from 7.0.0 onwards are also affected. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.MoyenneApache Wicket 8.0.0 → 8.19.0, 9.0.0 → 9.24.0…CVSS 6,3EPSS –il y a 17 h
• 38ag-uiCVE-2026-120236A vulnerability was detected in ag-ui-protocol ag-ui up to 0.0.58. Affected by this vulnerability is an unknown functionality of the component Transport Decoder Handler. The manipulation results in improper input validation. The attack may be launched remotely. The exploit is now public and may be used. The patch is identified as 660182b973a44b8eda5484b14b88eb9cc251edc4. It is suggested to upgrade the affected component.Moyenneag-ui 0.0.1, 0.0.2…CVSS 6,3EPSS –il y a 22 h
• 37Produit non préciséCVE-2026-91911Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Filesystem access for attacker.Moyennecvefeed.ioCVSS 6,1EPSS –il y a 2 h
• 37Produit non préciséCVE-2026-91903Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Filesystem access for attacker.Moyennecvefeed.ioCVSS 6,1EPSS –il y a 2 h
• 37Produit non préciséCVE-2026-101172Permission control vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect confidentiality.MoyenneCVSS 6,2EPSS –il y a 8 h
• 35Produit non préciséCVE-2026-120216fastify is a web framework for Node.js. In versions 5.8.0 through 5.12.7, when the server is configured with a nonzero handlerTimeout and a route returns a streaming response, a request whose stream has already sent its headers but stays open past the timeout crashes the server. When the timeout fires, Fastify tries to send a new error response on a response that has already started, raising an uncaught ERR_HTTP_HEADERS_SENT that terminates the Node.js process and interrupts any other in-flight requests. An unauthenticated remote client can trigger this with a single request to an affected streaming endpoint, so the impact is availability only, and exploitation requires the non-default handlerTimeout to be set. The default handlerTimeout of 0 is not affected. The issue is fixed in fastify 5.12.8, and users should upgrade to 5.12.8 or later. As a workaround, set handlerTimeout to 0, which disables the affected timeout path.Moyennecvefeed.ioCVSS 5,9EPSS –il y a 4 h
• 35Produit non préciséCVE-2026-120214@fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a path that encodes its backslashes and dot-segments survives the dot-segment check and is only turned into backslash and double-dot sequences after that check has passed. When the upstream resolves on a platform that treats a backslash as a path separator, the forwarded request walks out of the configured proxy prefix and reaches a sibling location on the upstream. An unauthenticated remote attacker can use this to retrieve upstream resources outside the intended prefix, so the impact is confidentiality only, and exploitation depends on the upstream's path handling. The issue is fixed in @fastify/http-proxy 11.6.3, and users should upgrade to 11.6.3 or later. This is a follow-up to the earlier prefix-escape fix, which did not account for the encoded-backslash form.Moyennecvefeed.ioCVSS 5,9EPSS –il y a 4 h
• 35Produit non préciséCVE-2026-117531@fastify/multipart is the multipart form-data and file upload plugin for the Fastify web framework. In versions 5.3.0 through 10.1.6, the plugin does not propagate a parser error to the file stream when a request body ends inside a file part with no closing boundary, even though the Content-Length is complete, the client does not abort, and no file size limit is exceeded. The plugin destroys the in-progress file stream without an error, so a handler that iterates the request parts and performs asynchronous work before consuming the file attaches to a stream that never emits an error or end event, and the request never responds while the connection stays open. An unauthenticated remote client can repeat these malformed uploads against such a route to accumulate pending connections and exhaust server resources, so the impact is availability only and exploitation depends on the application using a delayed file consumer. The issue is fixed in @fastify/multipart 10.1.7, where the parser error is propagated to the file stream so a delayed consumer settles with an error instead of hanging, and users should upgrade to 10.1.7 or later. There is no workaround other than upgrading.Moyennecvefeed.ioCVSS 5,9EPSS –il y a 4 h
• 35Produit non préciséCVE-2025-13647The affected component fails to enforce expected validation constraints on the `content-type` header when processing certain requests. This allows an attacker to submit a crafted request with a manipulated `content-type` header. Successful exploitation can lead to the unintended exposure of the file paths for certificate files. This information disclosure could potentially be leveraged in subsequent attacks or compromise the confidentiality of the system.MoyenneCVSS 5,8EPSS –il y a 5 h
• 35Produit non préciséCVE-2026-101185OOB read vulnerability in the peripheral module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.MoyenneCVSS 5,9EPSS –il y a 8 h
• 35Produit non préciséCVE-2026-101183UAF vulnerability in the location service module. Impact: Successful exploitation of this vulnerability may affect availability.MoyenneCVSS 5,9EPSS –il y a 8 h
• 35Produit non préciséCVE-2026-101182Race condition vulnerability in the location service module. Impact: Successful exploitation of this vulnerability may affect availability.MoyenneCVSS 5,9EPSS –il y a 8 h
• 35http4kCVE-2026-120317http4k from 4.9.10.0 before 6.60.0.0 contains a missing integrity check vulnerability because DigestEncoder computes the auth-int digest without hashing the request entity body. On-path attackers on non-TLS channels can rewrite the body of authenticated requests while keeping the Authorization header valid, executing state-changing actions as the victim.Moyennehttp4k 4.9.10.0 → < 6.60.0.0CVSS 5,9EPSS –il y a 12 h
• 35http4kCVE-2026-120316http4k before 6.62.0.0-ee contains a path traversal vulnerability in ThymeleafTemplates Caching and HotReload that allows unauthenticated attackers to read files outside baseTemplateDir by supplying ../ segments in ViewModel.template() values. Attackers can influence request-driven template selection so Thymeleaf's FileTemplateResolver resolves escaped paths without containment checks, disclosing any file readable by the server process.Moyennehttp4k < 6.62.0.0-eeCVSS 5,9EPSS –il y a 12 h
• 34Produit non préciséCVE-2026-91910Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Information exposure.Bassecvefeed.ioCVSS 5,7EPSS –il y a 2 h
• 34Produit non préciséCVE-2026-91908Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution.Bassecvefeed.ioCVSS 5,7EPSS –il y a 2 h
• 34Produit non préciséCVE-2026-101174DoS vulnerability in the DSoftBus module. Impact: Successful exploitation of this vulnerability may affect availability.BasseCVSS 5,7EPSS –il y a 8 h
• 34ChromeCVE-2026-118333Missing authorization in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)BasseChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 5,4EPSS 0,20 %il y a 6 j
• 34ChromeCVE-2026-118337Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)BasseChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 5,4EPSS 0,20 %il y a 6 j
• 33Produit non préciséCVE-2026-91906Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.Bassecvefeed.ioCVSS 5,5EPSS –il y a 2 h
• 33Produit non préciséCVE-2026-91904Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.Bassecvefeed.ioCVSS 5,5EPSS –il y a 2 h
• 33Produit non préciséCVE-2026-101184Permission control vulnerability in the Bluetooth module. Impact: Successful exploitation of this vulnerability may affect availability.BasseCVSS 5,5EPSS –il y a 7 h
• 33Produit non préciséCVE-2026-101181Permission control vulnerability in the WLAN module.  Impact: Successful exploitation of this vulnerability may affect service confidentiality.BasseCVSS 5,5EPSS –il y a 8 h
• 33Minimax CodeCVE-2026-120275A security flaw has been discovered in Shanghai Xi Yu Ji Zhi Technology Minimax Code 0.5.8. This affects an unknown part of the component Find Command Handler. The manipulation of the argument -exec results in os command injection. The attack may be performed from remote. The vendor was contacted early about this disclosure but did not respond in any way.BasseMinimax Code 0.5.8CVSS 5,5EPSS –il y a 16 h
• 32Produit non préciséCVE-2026-105601Joomla Extension - php-web-design.com - Reflected XSS in StageIt 1.0-5.7.5, 6.0-6.3.5BasseCVSS 5,3EPSS –il y a 40 min
• 32Produit non préciséCVE-2024-2372The affected components accept user-supplied input for constructing redirection URLs without enforcing expected validation constraints. This allows an attacker to provide a crafted URL that can redirect users to an arbitrary external domain. By leveraging this open redirection vulnerability, an attacker can craft a malicious link that, when clicked by a user, redirects them to an attacker-controlled page. This can be used in conjunction with social engineering techniques to execute phishing attacks, aiming to obtain sensitive information or cause other harm.Bassecvefeed.ioCVSS 5,4EPSS –il y a 4 h
• 32Produit non préciséCVE-2026-103310The PayHere Payment Gateway WordPress plugin from 2.4.0 through 2.4.5 does not verify the authenticity of payment notifications when the merchant secret is unset, which is the default state, allowing unauthenticated attackers to forge a payment confirmation and mark any order as paid without payment.BasseCVSS 5,3EPSS –il y a 7 h
• 32WN536AX6-ACVE-2026-120278A vulnerability was detected in WAVLINK WN536AX6-A V260507_2.0.0. Impacted is the function sub_416d48/sub_41a7c0 of the file /bin/ioos of the component VPN Client List Handler. Performing a manipulation of the argument opt results in missing authentication. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure.BasseWN536AX6-A V260507_2.0.0CVSS 5,3EPSS –il y a 15 h
• 32ag-uiCVE-2026-120233A security flaw has been discovered in ag-ui-protocol ag-ui up to 0.0.58. This affects an unknown function of the file sdks/typescript/packages/client/src/agent/http.ts of the component HttpAgent. Performing a manipulation results in information disclosure. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.Basseag-ui 0.0.1, 0.0.2…CVSS 5,3EPSS –il y a 23 h
• 31Produit non préciséCVE-2026-102801Joomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere extension for Joomla < 3.0.1 - An administrator can disable output of user email addresses or usernames in Users Anywhere. In affected code, attributes supplied inside a {user} or [email] / [username] tag can change those plugin settings for that render. For example, [email allow_output_email="1"] can display an email address even when Allow output of email is set to No. This bypasses the personal-data output setting; it does not bypass a separate policy that disallows Users Anywhere tags from the content source altogether.BasseCVSS 5,1EPSS –il y a 40 min
• 30Produit non préciséCVE-2026-114364Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. This CVE covers an incomplete fix for CVE-2026-77051: an administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized opEvent parameters. Reference: https://cve.org/CVERecord?id=CVE-2026-77051 This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.BasseCVSS –EPSS –il y a 40 min
• 30Produit non préciséCVE-2026-113687Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class running untrusted code on a separate Thread, thus bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.BasseCVSS –EPSS –il y a 40 min
• 30Produit non préciséCVE-2026-113511Authorization bypass through User-Controlled key vulnerability in Apache Syncope. A delegated administrator can relocate a Realm subtree across administrative realm boundaries without permission for the destination This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.BasseCVSS –EPSS –il y a 40 min
• 30Produit non préciséCVE-2026-111959Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1, 58.4.0, 59.3.1 and 60.0.0. Improper validation of RunEndEncoded arrays in the ArrayData interface can allow reading data beyond the bounds of the child values array. Users are recommended to upgrade to versions 60.1.0, 59.3.2, 58.4.1, 57.3.2 which fixes the issue.BasseCVSS –EPSS –il y a 40 min
• 30Produit non préciséCVE-2026-110535Improper Privilege Management vulnerability in Apache Syncope. AuthProfile self-updates allow non-admin users to configure impersonation for WA surrogate authentication. This issue affects Apache Syncope: from 3.0.12 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.BasseCVSS –EPSS –il y a 40 min
• 30Produit non préciséCVE-2026-109083Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a JUEL expression is imported and started, the expression is executed directly on the server, with no sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue by rejecting BPMN definitions including expression attributes.BasseCVSS –EPSS –il y a 40 min
• 30Produit non préciséCVE-2026-68591In Modem, there is a possible escalation of privilege due to a permissions bypass. This could lead to local escalation of privilege (EoP) if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09608864 / ALPS09327759; Issue ID: MSV-2958.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-68590In ip_stack, there is a possible out of bounds read due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01387180; Issue ID: MSV-5152.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-68589In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01320076; Issue ID: MSV-6889.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-68588In Modem, there is a possible way (for XXX) to XXXXX due to an integer overflow. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01334054 / MOLY01312486; Issue ID: MSV-7920.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20600In Modem, there is a possible application crash due to a logic error. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01416152; Issue ID: MSV-7924.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20599In Modem, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01790985; Issue ID: MSV-8148.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20598In Modem, there is a possible out of bounds read due to an integer overflow. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01755742; Issue ID: MSV-8896.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20597In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01758223; Issue ID: MSV-8909.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20596In Modem, there is a possible out of bounds read due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01758225; Issue ID: MSV-8910.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20595In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11263078; Issue ID: MSV-9001.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20594In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01349680 / MOLY01369097; Issue ID: MSV-9364.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20593In Modem, there is a possible application crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01707455; Issue ID: MSV-9503.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20592In Modem, there is a possible information disclosure due to side channel information disclosure. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01744265; Issue ID: MSV-9505.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20591In GPU pdma, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11365075; Issue ID: MSV-9546.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20590In display, there is a possible system crash due to a logic error. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11410704; Issue ID: MSV-9574.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20585In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01338165; Issue ID: MSV-9660.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20584In usb, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411916; Issue ID: MSV-9746.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20583In usb, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411916; Issue ID: MSV-9747.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20582In usb, there is a possible memory corruption due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411924; Issue ID: MSV-9748.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20581In usb, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11411985; Issue ID: MSV-9750.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20580In usb, there is a possible system crash due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11412004; Issue ID: MSV-9752.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20578In Modem, there is a possible information disclosure due to side channel information disclosure. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01879164; Issue ID: MSV-9846.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20577In Modem, there is a possible permission bypass due to a permissions bypass. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: MOLY01880753; Issue ID: MSV-9866.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20576In afe, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431385; Issue ID: MSV-9920.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20575In afe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431394; Issue ID: MSV-9921.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20574In afe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431400; Issue ID: MSV-9922.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20573In afe, there is a possible memory corruption due to double free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431412; Issue ID: MSV-9923.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20572In adsp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431442; Issue ID: MSV-9924.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20571In afe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11434319; Issue ID: MSV-9925.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20570In adsp, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431474; Issue ID: MSV-9926.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20569In adsp, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431474; Issue ID: MSV-9927.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20568In afe, there is a possible system crash due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11439283; Issue ID: MSV-10003.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20567In afe, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11431394; Issue ID: MSV-10004.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20566In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, if a malicious actor has already obtained the System privilege. User interaction is needed for exploitation. Patch ID: MOLY01923663 / ALPS11315955; Issue ID: MSV-10866.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20565In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01778991; Issue ID: MSV-8900.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20564In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01780439; Issue ID: MSV-8901.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20563In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01777997; Issue ID: MSV-8905.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20562In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01775984; Issue ID: MSV-8907.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20561In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01750090; Issue ID: MSV-8908.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20560In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01870543; Issue ID: MSV-9070.BasseCVSS –EPSS –il y a 12 h
• 30Produit non préciséCVE-2026-20559In GPU pdma, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11365081; Issue ID: MSV-9545.BasseCVSS –EPSS –il y a 12 h
• 30MediaTek chipsetCVE-2026-20558In GPU pdma, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11365070; Issue ID: MSV-9547.BasseMediaTek chipset MT6993, MT8910CVSS –EPSS –il y a 12 h
• 30MediaTek chipsetCVE-2026-20557In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01877236; Issue ID: MSV-9804.BasseMediaTek chipset MT2716, MT6813…CVSS –EPSS –il y a 12 h
• 30MediaTek chipsetCVE-2026-20556In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01876662; Issue ID: MSV-9833.BasseMediaTek chipset MT2716, MT2735…CVSS –EPSS –il y a 12 h
• 30MediaTek chipsetCVE-2026-20555In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01876664; Issue ID: MSV-9834.BasseMediaTek chipset MT2716, MT6813…CVSS –EPSS –il y a 12 h
• 30MediaTek chipsetCVE-2026-20554In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: MOLY01911177; Issue ID: MSV-10122.BasseMediaTek chipset MT2716, MT2735…CVSS –EPSS –il y a 12 h
• 30MediaTek chipsetCVE-2026-20553In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS11468968; Issue ID: MSV-10166.BasseMediaTek chipset MT2713, MT2718…CVSS –EPSS –il y a 12 h
• 30MediaTek chipsetCVE-2026-20552In ccci, there is a possible out of bounds write due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11523478 (Note: For MT6880, MT6890) / ALPS11297423 (Note: For MT6813, MT6986, MT6982, MT6980D) / AUTO00864897 (Note: For MT2735, MT2737); Issue ID: MSV-10724.BasseMediaTek chipset MT2735, MT2737…CVSS –EPSS –il y a 12 h
• 30MediaTek chipsetCVE-2026-20551In gnss, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11309305; Issue ID: MSV-10730.BasseMediaTek chipset MT2737, MT6813…CVSS –EPSS –il y a 12 h
• 30MediaTek chipsetCVE-2026-20550In gnss, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS11309816; Issue ID: MSV-10731.BasseMediaTek chipset MT2735, MT2737…CVSS –EPSS –il y a 12 h
• 30MediaTek chipsetCVE-2026-20549In Modem, there is a possible out of bounds write due to improper input validation. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01775865; Issue ID: MSV-8895.BasseMediaTek chipset MT2716, MT2735…CVSS –EPSS –il y a 12 h
• 30MediaTek chipsetCVE-2026-20548In Modem, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01872867 / MOLY01774038; Issue ID: MSV-9801.BasseMediaTek chipset MT2716, MT2735…CVSS –EPSS –il y a 12 h
• 30MediaTek chipsetCVE-2026-20547In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01874018 / MOLY01774038; Issue ID: MSV-9802.BasseMediaTek chipset MT2716, MT2735…CVSS –EPSS –il y a 12 h
• 30MediaTek chipsetCVE-2026-20546In Modem, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01876654 / MOLY01774038; Issue ID: MSV-9803.BasseMediaTek chipset MT2716, MT2735…CVSS –EPSS –il y a 12 h
• 30MediaTek chipsetCVE-2026-20545In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01879158 / MOLY01774038; Issue ID: MSV-9811.BasseMediaTek chipset MT2716, MT2735…CVSS –EPSS –il y a 12 h
• 30MediaTek chipsetCVE-2026-20499In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01857954; Issue ID: MSV-8247.BasseMediaTek chipset MT2716, MT2735…CVSS –EPSS –il y a 12 h
• 30Google-AuthCVE-2026-74760Google::Auth versions from 0.11 through 0.12 for Perl accept an authorization code from any local process because the gcloud-auth login callback does not check the OAuth state. The gcloud-auth login and application-default login commands send a state parameter with the authorization request, then take the code from the first request to reach their loopback listener without comparing the returned state. A local attacker can submit an authorization code for their own Google account. The CLI exchanges it and stores the refresh token as the user's credentials, so the user's tools then act as the attacker's account.BasseGoogle-Auth 0.11 → 0.12CVSS –EPSS –il y a 22 h
• 30Google-AuthCVE-2026-74759Google::Auth versions 0.12 for Perl allow server side request forgery via unvalidated credential_source URLs in AWS external account credentials. An external_account configuration with the AWS subject token type selects Google::Auth::ExternalAccountCredentials::Aws. Its retrieve_subject_token sends requests to the imdsv2_session_token_url, url and region_url fields of credential_source without the host check that the other credential classes apply. Any caller that builds credentials from a configuration it does not fully control issues GET and PUT requests to hosts the configuration names, including internal services and link-local metadata endpoints.BasseGoogle-Auth 0.12CVSS –EPSS –il y a 22 h
• 29Produit non préciséCVE-2024-9517The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens. This weakness allows an attacker to obtain valid access tokens for user accounts even after they have been blocked by the user store, bypassing account lockout mechanisms. This vulnerability can lead to unauthorized access to user accounts and their associated resources. Attackers can leverage this to perform actions on behalf of blocked users, potentially leading to privilege escalation or data exfiltration depending on the permissions of the compromised account.Bassecvefeed.ioCVSS 4,9EPSS –il y a 3 h
• 29Produit non préciséCVE-2025-12544The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to inject malicious scripts. This weakness can be exploited by uploading a crafted SVG file, which is then stored and rendered by the application. The security consequences include the ability for a malicious actor to redirect the victim's browser to an arbitrary website, modify the web page's UI, or retrieve information from the browser. However, the impact is mitigated as session-related sensitive cookies are protected with the httpOnly flag, preventing session hijacking.Bassecvefeed.ioCVSS 4,8EPSS –il y a 4 h
• 29Produit non préciséCVE-2024-5617The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in both primary and secondary user stores. This occurs because the lock condition is only applied to the secondary user store account in such scenarios, allowing continued authentication attempts against the primary user store account. This functional flaw enables brute force attacks. By systematically attempting different passwords against the primary user store account, an attacker can potentially gain unauthorized access to sensitive information or accounts, as the intended account lockout mechanism does not prevent repeated login attempts.BasseCVSS 4,8EPSS –il y a 9 h
• 29farmCVE-2026-120335A vulnerability has been found in deepset-ai farm up to 0.8.0. Affected is the function WordEmbedding_LM.load of the file farm/modeling/language_model.py of the component Model Package Loader. The manipulation of the argument embeddings_filename leads to path traversal. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.Bassefarm 0.1, 0.2…CVSS 4,8EPSS –il y a 12 h
• 28Produit non préciséCVE-2026-91909Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Command execution.Bassecvefeed.ioCVSS 4,6EPSS –il y a 2 h
• 28Produit non préciséCVE-2024-7075The user search function within the management console fails to properly encode user-supplied input before rendering it in the browser. This allows an attacker to inject malicious scripts that are then executed by the user's browser in the context of the management console. Successful exploitation enables an attacker to redirect the user's browser to a malicious website, modify the web page's user interface, or extract information from the browser. However, due to the use of the httpOnly flag on sensitive session cookies, session hijacking or similar attacks are prevented.BasseCVSS 4,6EPSS –il y a 5 h
• 28Produit non préciséCVE-2026-101179Buffer overflow vulnerability in the file preview module. Impact: Successful exploitation of this vulnerability may affect availability.BasseCVSS 4,7EPSS –il y a 8 h
• 28MoviePilotCVE-2026-120320A vulnerability was determined in jxxghp MoviePilot up to 3.1.2. This vulnerability affects the function WorkflowExecutor.restore_context of the file app/chain/workflow.py of the component Workflow Fork Endpoint. Executing a manipulation can lead to deserialization. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.1.3 is able to resolve this issue. This patch is called 6034dcc880c13079aeb398dbe32c346ebcd3a6d2. It is recommended to upgrade the affected component.BasseMoviePilot 3.1.0, 3.1.1…CVSS 4,7EPSS –il y a 13 h
• 28FastBeeCVE-2026-120274A vulnerability was identified in beecue FastBee up to 2.1.0. Affected by this issue is some unknown functionality of the file /iot/script of the component Groovy Script Executor. The manipulation leads to code injection. The attack is possible to be carried out remotely. The identifier of the patch is 890a33846005a937a58cccd738b7fb9821b82ea9. It is suggested to install a patch to address this issue.BasseFastBee 2.0, 2.1.0CVSS 4,7EPSS –il y a 18 h
• 27ChromeCVE-2026-118319Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)BasseChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 4,3EPSS 0,17 %il y a 6 j
• 27ChromeCVE-2026-118322Memory corruption in ANGLE in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)BasseChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 4,3EPSS 0,21 %il y a 6 j
• 27ChromeCVE-2026-118318Improper access control in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to read memory via a crafted HTML page. (Chromium security severity: High)BasseChrome 156.0.8078.73 → < 156.0.8078.73MicrosoftCVSS 4,3EPSS 0,20 %il y a 6 j
• 26Produit non préciséCVE-2024-12141The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when processed through a weak regular expression or when validation is omitted. An attacker can exploit this by crafting a link that appears legitimate but redirects users to an attacker-controlled page. This redirection facilitates phishing attacks, enabling the harvesting of sensitive user information, potentially leading to unauthorized access or data theft.Bassecvefeed.ioCVSS 4,3EPSS –il y a 2 h
• 26Produit non préciséCVE-2026-18800When an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected products log these irrelevant properties. This can inadvertently include sensitive user credentials or other confidential information depending on the nature of the misconfigured property. A malicious actor with access to the 'wso2carbon' log files could retrieve sensitive information logged by the system. This may potentially lead to unauthorized access if the logged data contains credentials or other critical secrets.BasseCVSS 4,4EPSS –il y a 5 h
• 26Produit non préciséCVE-2026-101180DoS vulnerability in the file parsing module. Impact: Successful exploitation of this vulnerability may affect availability.BasseCVSS 4,3EPSS –il y a 8 h
• 26Produit non préciséCVE-2026-101175Null pointer dereference vulnerability in the ArkWeb module. Impact: Successful exploitation of this vulnerability may affect availability.BasseCVSS 4,3EPSS –il y a 8 h
• 26Produit non préciséCVE-2026-120343A flaw has been found in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the file manageassessment2.php. This manipulation of the argument ExamName/Q1/Q2/Q3/Q4/Q5 causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The vendor was contacted early about this disclosure but did not respond in any way.BasseCVSS 4,3EPSS –il y a 10 h
• 26Produit non préciséCVE-2026-120339A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project. This vulnerability affects unknown code of the file updatedetailsfromfaculty.php. Performing a manipulation of the argument fname results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The vendor was contacted early about this disclosure but did not respond in any way.BasseCVSS 4,3EPSS –il y a 11 h
• 26farmCVE-2026-120334A flaw has been found in deepset-ai farm up to 0.8.0. This impacts the function EmbeddingTokenizer.from_pretrained of the file farm/modeling/tokenization.py of the component Tokenizer Loader. Executing a manipulation of the argument vocab_filename can lead to path traversal. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.Bassefarm 0.1, 0.2…CVSS 4,3EPSS –il y a 12 h
• 26MCPHubCVE-2026-120323A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.7. Impacted is an unknown function of the file src/utils/passthroughHeaders.ts. The manipulation of the argument passthroughHeaders results in information disclosure. The attack may be launched remotely. Upgrading to version 1.1.8 is recommended to address this issue. The patch is identified as 040f7b9ae004070bdfe5084cde6bc2c609f78e76. It is advisable to upgrade the affected component.BasseMCPHub 1.0.0, 1.0.1…CVSS 4,3EPSS –il y a 13 h
• 26ag-uiCVE-2026-120237A flaw has been found in ag-ui-protocol ag-ui up to 0.0.58. Affected by this issue is the function isInterruptExpired of the file sdks/typescript/packages/client/src/interrupts/index.ts of the component Interrupt expiry. This manipulation causes resource consumption. Remote exploitation of the attack is possible. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.Basseag-ui 0.0.1, 0.0.2…CVSS 4,3EPSS –il y a 21 h
• 26ag-uiCVE-2026-120235A security vulnerability has been detected in ag-ui-protocol ag-ui up to 0.0.58. Affected is the function parseSSEStream of the file sdks/typescript/packages/client/src/transform/sse.ts of the component SSE Parser. The manipulation leads to resource consumption. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is 9e7b2b00bce215bbf731f1e6094f63812527c432. The affected component should be upgraded.Basseag-ui 0.0.1, 0.0.2…CVSS 4,3EPSS –il y a 23 h
• 26ag-uiCVE-2026-120234A weakness has been identified in ag-ui-protocol ag-ui up to 0.0.58. This impacts the function e.text of the component HTTP Transport. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.Basseag-ui 0.0.1, 0.0.2…CVSS 4,3EPSS –il y a 23 h
• 25Produit non préciséCVE-2026-117549@fastify/secure-session is a session plugin for Fastify that stores an encrypted session in a cookie. In versions 7.5.0 through 8.4.1, when the plugin is configured with the signed cookie option, it calls the cookie unsign routine but, when the signature check reports the value as invalid, still passes the original cookie value to the session decoder, so a session whose signature did not validate is decrypted anyway. The practical effect appears when an application supplies the cookie signing secret independently of the session encryption key and rotates only the signing secret to retire existing sessions while keeping the encryption key active, because a holder of an old session cookie can strip the now obsolete signature and keep using the session. The attacker must already possess an unexpired encrypted session cookie and needs neither secret, and cannot forge session data, extend expiry, or survive rotation of the encryption key. The issue is fixed in @fastify/secure-session 8.4.2, which no longer decodes the session when the signed cookie option is set and the signature check fails, and users should upgrade to 8.4.2 or later. As a workaround, rotate the session encryption key rather than relying on rotation of the cookie signing secret alone.Bassecvefeed.ioCVSS 4,2EPSS –il y a 4 h
• 24Produit non préciséCVE-2026-101170DoS vulnerability in the file parsing module. Impact: Successful exploitation of this vulnerability may affect availability.BasseCVSS 4,0EPSS –il y a 8 h
• 22Produit non préciséCVE-2026-120215@fastify/cors is the CORS plugin for the Fastify web framework. In versions 8.2.0 through 11.3.x, an application that registers the plugin with the non-default onSend hook option crashes on a CORS preflight. On an OPTIONS request that carries the Origin and Access-Control-Request-Method headers, the plugin calls reply.send from inside the onSend hook and re-enters the send pipeline, so a second write of the response headers throws an uncaught ERR_HTTP_HEADERS_SENT that can terminate the Node.js process when no process-level handler is installed. An unauthenticated remote client can trigger this with a single preflight request, so the impact is availability only, and exploitation requires the non-default onSend configuration. The issue is fixed in @fastify/cors 11.4.0, where onSend is no longer an accepted hook value and registration fails with a clear error instead of crashing at request time, and users should upgrade to 11.4.0 or later. As a workaround, use any other hook such as the default onRequest, or set preflight to false.Bassecvefeed.ioCVSS 3,7EPSS –il y a 4 h
• 22Produit non préciséCVE-2026-101177Permission control vulnerability in the Optimizer module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.BasseCVSS 3,7EPSS –il y a 8 h
• 22Produit non préciséCVE-2026-101171Permission control vulnerability in the background task management module. Impact: Successful exploitation of this vulnerability may affect service integrity.BasseCVSS 3,6EPSS –il y a 8 h
• 22Produit non préciséCVE-2026-120340A weakness has been identified in mathurvishal CloudClassroom-PHP-Project. This issue affects some unknown processing of the component Global Session Handler. Executing a manipulation can lead to session expiration. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit has been made available to the public and could be used for attacks. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The vendor was contacted early about this disclosure but did not respond in any way.BasseCVSS 3,7EPSS –il y a 10 h
• 22nuxtCVE-2026-120309Nuxt from 4.6.0 before 4.6.2 contains a route parameter confusion vulnerability in getRouterParam and getRouterParams that lets attackers return a parameter value different from the one h3 matched by sending paths containing an encoded question mark (%3F). Attackers can craft requests where authorization checks use the Nuxt helper value while resource selection uses event.context.params, allowing access to unauthorized resources.Bassenuxt 4.6.0 → < 4.6.2CVSS 3,7EPSS –il y a 12 h
• 19parse-serverCVE-2026-120310Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 returns stored field values in object update responses without checking read access, so clients whose class-level permissions or object ACLs allow update but not read can see object data. Attackers can update such objects to read atomic operation results (Increment, Add, AddUnique, Remove), Cloud Code trigger-set values, and, for dot notation keys under certain conditions, the whole stored parent field.Basseparse-server 9.0.0 → < 9.10.6-alpha.1CVSS 3,1EPSS –il y a 12 h
• 14Produit non préciséCVE-2026-107457A memory corruption vulnerability in the QMqttClient class of the Qt MQTT module. Under certain MQTT 5 connection settings between client and server, QMqttClient may corrupt memory, which can cause the application to crash.BasseCVSS 2,3EPSS –il y a 6 h
• 14Apache WicketCVE-2026-87718Apache Wicket 10.10.0, 10.11.0 and 9.24.0 do not set the Content-Security-Policy headers on a page whose render request handler is wrapped in more than one IRequestHandlerDelegate. The framework unwraps only a single delegate level when deciding whether a request renders a page, so with a deeper chain, for example an application-provided delegating request mapper combined with CryptoMapper, the page is served without any CSP header even though CSP is enabled, and no error or warning is raised. The nonce-based protection Wicket applies to inline scripts and styles, together with any other CSP directives configured by the application, is thereby lost for those pages, exposing them to content injection the policy was meant to prevent. Applications on stock Wicket that do not wrap request handlers themselves are not affected. Versions before 10.10.0 and 9.24.0 handled nested delegates correctly. Users are recommended to upgrade to version 10.12.0 or 9.25.0, which fix the issue.BasseApache Wicket 9.24.0, 10.10.0 → 10.11.0CVSS 2,3EPSS –il y a 16 h
• 14Apache WicketCVE-2026-82559Insufficient session expiration in Apache Wicket. org.apache.wicket.protocol.ws.WebSocketSettings#newWebSocketRequest() wraps the WebSocket upgrade request in an org.apache.wicket.protocol.ws.api.ServletRequestCopy, which is kept for the life of the connection and used to build the request for every frame that arrives on it. Copying the request is deliberate and is documented as such, because the container recycles the upgrade request once the handshake is over. The container session is copied along with it, into an org.apache.wicket.protocol.ws.api.HttpSessionCopy holding the session attributes as they stood when the connection was opened. That second copy is not necessary, because a session, unlike a request, is not discarded at the end of a request. Every frame afterwards resolves its Wicket session through ISessionStore#lookup(), which reads it out of the copy, so the connection is detached from the live container session for as long as it stays open. Ending the session through the container therefore does not end the connection. After an idle timeout, an HttpSession#invalidate() call made from a filter or from a security framework, a container-managed logout, or a session replacement, the connection goes on resolving the org.apache.wicket.Session instance that existed when it was opened, together with that session's attributes and, for applications built on wicket-auth-roles, the signed-in state held on that same instance, so an authorization decision taken inside a WebSocket callback is taken against an identity that has already been revoked. The copy is also what the connection writes through: a Session#invalidateNow() issued from inside a WebSocket callback invalidates the copy and leaves the container session valid, and session attributes set over the connection are written to the copy rather than to the session. An application is affected where it uses Wicket's native WebSocket support on pages or shared resources that require an authenticated session, and where sessions are ended by the container rather than by Wicket. Session#invalidateNow(), and AuthenticatedWebSession#invalidate() and #signOut() which call it, remain effective for a WebSocketBehavior on a page: they clear the page manager, and the connection can then no longer resolve the page it was opened for. A WebSocketResource is not limited in that way, because a frame naming a resource is served against a throwaway page and never consults the page manager, so such a connection outlives Wicket's own sign-out as well. Some containers close WebSocket connections themselves when the HTTP session they were opened under is destroyed, in which case the connection ends regardless; that is a property of the container rather than of Wicket. Applications that do not use the native WebSocket support are not affected. This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Older, unsupported releases from 6.0.0 onwards are also affected. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.BasseApache Wicket 8.0.0 → 8.19.0, 9.0.0 → 9.24.0…CVSS 2,3EPSS –il y a 17 h
• 14Apache WicketCVE-2026-82558Missing authorization in Apache Wicket. org.apache.wicket.protocol.ws.api.WebSocketBehavior, through which Wicket's native WebSocket support hands a message sent by the client to the application, calls its onMessage() callbacks without checking whether the client may invoke the component the behavior is attached to. Wicket opens a single WebSocket connection per page, and a message received on it is delivered to every WebSocketBehavior of that page. For an Ajax behavior Wicket makes this check before invoking it, through Behavior#canCallListener(Component), which refuses a component that is not visible or not enabled, including one for which the IAuthorizationStrategy denies the RENDER or ENABLE action. A WebSocketBehavior attached to such a component, or to a child of one, therefore receives the client's text and binary messages, together with a WebSocketRequestHandler that writes back to that client, where an Ajax behavior on the same component would be refused. An application is affected where it attaches a WebSocketBehavior that overrides onMessage() to a component that it hides, disables, or restricts through its IAuthorizationStrategy, for example with MetaDataRoleAuthorizationStrategy or the AuthorizeAction annotation. The client needs a session of their own and a page of their own that contains such a component: messages are delivered only to pages in the page store of the client's own session, so this gives no access to another user's session, page or connection. Messages pushed by the server are not affected. This issue affects Apache Wicket: from 8.0.0 through 8.19.0, from 9.0.0 through 9.24.0, from 10.0.0 through 10.11.0. Older, unsupported releases from 6.0.0 onwards are also affected. Users are recommended to upgrade to version 8.20.0, 9.25.0 or 10.12.0, which fix the issue.BasseApache Wicket 8.0.0 → 8.19.0, 9.0.0 → 9.24.0…CVSS 2,3EPSS –il y a 17 h
• 14RG-ES205GCCVE-2026-120242A security flaw has been discovered in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. The affected element is an unknown function of the file set_cloud_serverUrl.cgi of the component Cloud Management. The manipulation of the argument url results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.BasseRG-ES205GC ESW_1.0(1)B1P48CVSS 2,4EPSS –il y a 20 h
• 13Apache WicketCVE-2026-82898Incorrect order of security checks in Apache Wicket. org.apache.wicket.protocol.http.ResourceIsolationRequestCycleListener obtains the page a request targets before it consults its resource isolation policies, because those policies are passed that page. Obtaining the page instantiates it, and instantiating a page runs the configured org.apache.wicket.authorization.IAuthorizationStrategy. An application that refuses an unauthenticated visitor by throwing org.apache.wicket.RestartResponseAtInterceptPageException therefore throws it from inside the isolation listener, before any policy has run. That exception replaces the request handler, so the policies are never consulted and a request that came from another origin is not refused. The exception's constructor stores the URL of the request it interrupted, so that Component#continueToOriginalDestination() can resume it once the visitor has signed in. The stored URL is the one the policies would have refused. On sign in Wicket redirects to it, and that redirect is same-origin, so the policies allow it and the listener runs in the newly authenticated session. The whole URL is stored, its query string included, so an ordinary org.apache.wicket.markup.html.form.Form is resumed with the field values the original request carried in its query string and Form#onSubmit() runs with values another origin chose. A form POST is not needed for this; a plain top-level navigation carries them. An application is affected where it registers ResourceIsolationRequestCycleListener, which is opt-in and is not registered by default, and where it refuses unauthorized access with RestartResponseAtInterceptPageException followed by continueToOriginalDestination(). No application override is involved on that path: IAuthorizationStrategy#isInstantiationAuthorized() documents throwing that exception, org.apache.wicket.authroles.authentication.AuthenticatedWebApplication throws it and org.apache.wicket.authroles.authentication.panel.UsernamePasswordPanel continues to the original destination, and org.apache.wicket.authorization.strategies.page.SimplePageAuthorizationStrategy in wicket-core installs the same pattern. A visitor who is already signed in is not affected, because no interception occurs. Request-body parameters stored alongside the intercepted URL are not applied to the resumed form: the resumption is a redirect, so the resumed request is a GET, and form components read their values from the query string on a GET. As a workaround, refuse unauthorized access with org.apache.wicket.RestartResponseException instead, which does not store the original destination; visitors are then not returned to the page they asked for after signing in. This issue affects Apache Wicket: from 9.1.0 through 9.24.0, from 10.0.0 through 10.11.0. Releases before 9.1.0, which is every 8.x release and 9.0.0, are not affected, because the resource isolation this issue concerns was introduced in 9.1.0. They are not protected either. Their only cross-origin defence is org.apache.wicket.protocol.http.CsrfPreventionRequestCycleListener, which works out where a request came from by reading its Origin header and falling back to its Referer header. Neither header need arrive: a browser does not send Origin on the plain GET a link uses, and the document on the other origin decides through its own referrer policy whether a Referer reaches the application at all. That mechanism therefore never made the guarantee the Fetch Metadata based policy makes, and on those releases a listener invocation from another origin is not reliably refused in the first place. Anyone on a release before 9.1.0 who wants this protection should upgrade to 9.x or 10.x and register ResourceIsolationRequestCycleListener. Users are recommended to upgrade to version 9.25.0 or 10.12.0, which fix the issue.BasseApache Wicket 9.1.0 → 9.24.0, 10.0.0 → 10.11.0CVSS 2,1EPSS –il y a 17 h
• 11Produit non préciséCVE-2026-100140An integer overflow vulnerability in the Qt XML parsing (Qt5Compat / QXmlSimpleReader) functionality of Qt.Bassecvefeed.ioCVSS 1,9EPSS –il y a 3 h

Le score combine gravité (CVSS), probabilité d’exploitation (EPSS), exploitation confirmée (CISA KEV, SSVC) et alertes des CERT. Flux JSON : /api/cves et /api/rss.