Pourquoi la veille des vulnérabilités est critique pour votre entreprise
En 2025, 48 185 nouvelles vulnérabilités (CVE) ont été publiées — soit une hausse de 20 % par rapport à 2024. En 2026, la tendance s'accélère encore. Chaque jour, plus de 130 failles sont rendues publiques, dont certaines concernent les logiciels que votre entreprise utilise au quotidien.
Selon le Verizon Data Breach Investigations Report, 60 % des violations de données exploitent des vulnérabilités pour lesquelles un correctif existait déjà au moment de l'attaque. Le problème n'est pas l'absence de correctifs — c'est l'absence de veille. Aucune équipe IT ne peut suivre manuellement 130 CVE par jour.
Avec CVE Find, explorez la plus grande base de données de vulnérabilités au monde.
Le CVE (Common Vulnerabilities and Exposures) est une liste de failles de sécurité informatique divulguées publiquement. Le programme CVE a pour objectif de faciliter le partage des données entre les différentes capacités de détection des vulnérabilités, qu'il s'agisse d'outils, de bases de données ou de services. Il fournit également une norme pour évaluer la couverture de ces outils et services.
Accédez à CVE Find
Ce que CVE Find fait pour vous
Comment être alerté en temps réel ?
CVE Find vous notifie par email et SMS dès qu'une vulnérabilité concerne vos produits. Fréquence configurable : de l'alerte instantanée au résumé mensuel.
Mes logiciels sont-ils vulnérables ?
Configurez vos produits (CMS, serveurs, librairies) via le catalogue CPE. CVE Find surveille la base MITRE en continu et vous alerte automatiquement. 338 000+ CVE indexés.
Comment prioriser les correctifs ?
Le scoring CVSS (gravité) et EPSS (probabilité d'exploitation réelle) vous indiquent quoi corriger en premier. Fini les faux positifs.
Quelles failles sont activement exploitées ?
Le catalogue CISA KEV intégré identifie les vulnérabilités déjà exploitées dans la nature. Ce sont les failles à corriger en priorité absolue.
La plateforme est-elle disponible en français ?
Oui. CVE Find est disponible en français, anglais et allemand. Développée en Suisse par Bexxo, c'est la seule plateforme CVE francophone complète.
Les données sont-elles fiables et à jour ?
Synchronisation en temps réel avec MITRE, NVD, CISA et FIRST.org. Plus de 48 000 CVE ajoutés en 2025, et la base s'enrichit chaque heure.
Restez en avance avec les dernières failles critiques de sécurité.
CVE-2026-73649 - CRITICAL
13/08/2026
Velocity.js is a JavaScript implementation of the Apache Velocity template engine. Prior to 2.1.7, the earlier fix for CVE-2026-44966 filtered constructor, __proto__, and prototype only in the #set assignment handler in src/compile/set.ts, while property-read expressions in src/compile/references.ts remained unfiltered. The getReferences() flow called getAttributes(), whose property access allowed...
codeinjectionOWSAP: A03
CVE-2026-73644 - CRITICAL
13/08/2026
OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-server-legacy/src/main/java/org/opends/server/extensions/PlainSASLMechanismHandler.java checked the PROXIED_AUTH privilege but did not evaluate the mayProxy proxy ACI scope when an authzid resolved to a different user. Both dn: and u: or bare authzid forms could therefore let an au...
authorisationproblemOWSAP: A01
CVE-2026-73567 - CRITICAL
13/08/2026
sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. Prior to 0.5.0, the default no-argument sm2.generateKeyPairHex() path in Node.js uses the module-wide SecureRandom instance in src/sm2/utils.js, supplied by jsbn@1.1.0, which seeds an ARC4 stream from Math.random() and new Date().getTime() because window.crypto.getRandomValues is unavailable ev...
OWSAP: A02
CVE-2026-67614 - CRITICAL
13/08/2026
CyberPanel before 3.0.0 contains a hard-coded JWT secret vulnerability in the WebTerminal FastAPI SSH service that allows unauthenticated remote attackers to forge valid authentication tokens and obtain an interactive root shell via WebSocket on port 8888. Attackers can craft a forged JWT signed with the hardcoded secret value, specifying ssh_user=root, to authenticate to the terminal service with...
OWSAP: A07
CVE-2026-18428 - HIGH
13/08/2026
A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint.
CVE-2026-73564 - HIGH
13/08/2026
frp is a fast reverse proxy. From 0.53.0 until 0.70.1, frp's optional SSH Tunnel Gateway in pkg/ssh/server.go parses an SSH exec channel request by adding 4 to an attacker-controlled four-byte big-endian length. A length of 0xFFFFFFFF makes the uint32 addition wrap to 3, defeats the payload bounds check, and causes payload[4:3] to panic in TunnelServer.handleNewChannel. When no authorized-keys fil...
CVE-2026-59109 - HIGH
13/08/2026
SQL injection in the Zalktis accounting application via trading-partner-controlled text fields in received electronic invoices. When importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis concatenates partner-controlled values directly into SQL statement text using string concatenation, with neither parameterised queries nor escaping. The application's own escaping helper, D...
sqlinjectionOWSAP: A03
CVE-2026-73570 - HIGH
13/08/2026
A remote code execution vulnerability exists in Zimbra Collaboration (ZCS) before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send specially crafted SMTP requests that may result in execution of arbitrary operating system commands a...
oscommandinjectionOWSAP: A03
CVE-2026-73533 - CRITICAL
13/08/2026
Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (app/Library/updater/NinjaTableDataSync.php) that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administ...
CVE-2026-73532 - CRITICAL
13/08/2026
Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (libs/class-license-sync.php), loaded via a require_once directive added to fluentformpro.php, that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploa...
CVE-2026-73514 - HIGH
13/08/2026
The address_standardizer extension for PostGIS through 3.7.0, fixed in commit 423570b, contains an out-of-bounds write vulnerability that allows a database user with the ability to supply caller-controlled relation names to standardize_address() to trigger memory corruption by providing a rules table with a classification Type value exceeding the fixed class range. Attackers can craft a malicious ...
overflow
CVE-2026-70461 - HIGH
13/08/2026
rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsync daemon module by providing a files-from entry containing both an interior and trailing backslash, ca...
overflow
CVE-2026-70458 - HIGH
13/08/2026
rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing F_SUM field in the file_struct layout to access memory past the end of the allocated structure, corrupting adjacent hea...
overflow
CVE-2026-70456 - HIGH
13/08/2026
rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one slot beyond the allocation boundary, corrupting adjacent heap memory.
overflow
CVE-2026-53791 - CRITICAL
13/08/2026
rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the PROXY protocol header to circumvent hosts allow/deny rules, gaining unauthorized ...
OWSAP: A07
CVE-2026-19293 - HIGH
13/08/2026
SMP security request (from peripheral) does not include the maximum encryption key size supported. Using a key with less than the maximum keysize makes brute-forcing the key easier. See V6 in BLERP paper linked below.
OWSAP: A07
CVE-2026-19292 - HIGH
13/08/2026
Re-pairing with a legitimate device can use a lower security level than previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below.
CVE-2026-19291 - HIGH
13/08/2026
Bluetooth re-pairing with an existing device can use a lower security level. RS9116W and SiWx91x impacted. See V3 in the BLERP paper linked below.
OWSAP: A07
CVE-2026-16101 - HIGH
13/08/2026
Spoofing an already bonded device can force either RS9116W or SiWx917 to re-pair/bond with a rogue device. See V1 in BLERP paper below
OWSAP: A07
CVE-2026-67986 - HIGH
13/08/2026
amazing-print/amazing_print at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArray#grep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a block, resulting in Ruby code execution in the host process. Exploitation requires an application pa...
codeinjectionOWSAP: A03
