Pourquoi la veille des vulnérabilités est critique pour votre entreprise
En 2025, 48 185 nouvelles vulnérabilités (CVE) ont été publiées, soit une hausse de 20 % par rapport à 2024. Chaque jour, plus de 130 failles sont rendues publiques, dont certaines concernent les logiciels que votre entreprise utilise au quotidien.
Selon le Verizon Data Breach Investigations Report, 60 % des violations de données exploitent des vulnérabilités pour lesquelles un correctif existait déjà au moment de l'attaque. Aucune équipe IT ne peut suivre manuellement 130 CVE par jour.
Avec CVE Find, explorez la plus grande base de données de vulnérabilités au monde.
Le CVE (Common Vulnerabilities and Exposures) est une liste de failles de sécurité informatique divulguées publiquement. Le programme CVE a pour objectif de faciliter le partage des données entre les différentes capacités de détection des vulnérabilités, qu'il s'agisse d'outils, de bases de données ou de services. Il fournit également une norme pour évaluer la couverture de ces outils et services.
Accédez à CVE Find
Ce que CVE Find fait pour vous
Comment être alerté en temps réel ?
CVE Find vous notifie par email et SMS dès qu'une vulnérabilité concerne vos produits. Fréquence configurable : de l'alerte instantanée au résumé mensuel.
Mes logiciels sont-ils vulnérables ?
Configurez vos produits (CMS, serveurs, librairies) via le catalogue CPE. CVE Find surveille la base MITRE en continu et vous alerte automatiquement. 338 000+ CVE indexés.
Comment prioriser les correctifs ?
Le scoring CVSS (gravité) et EPSS (probabilité d'exploitation réelle) vous indiquent quoi corriger en premier, sans faux positifs.
Quelles failles sont activement exploitées ?
Le catalogue CISA KEV intégré identifie les vulnérabilités déjà exploitées dans la nature. Ce sont les failles à corriger en priorité absolue.
La plateforme est-elle disponible en français ?
Oui. CVE Find est disponible en français, anglais et allemand. La plateforme est développée en Suisse par Bexxo.
Les données sont-elles fiables et à jour ?
Synchronisation en temps réel avec MITRE, NVD, CISA et FIRST.org : la base s'enrichit chaque heure.
Restez en avance avec les dernières failles critiques de sécurité.
CVE-2026-85035 - HIGH
03/11/2026
The can_add_rx_filter_msgq() system call installs a CAN RX filter whose callback (can_msgq_put() in drivers/can/can_common.c) is handed the caller's struct k_msgq * as user_data. The controller driver stores that raw pointer in its filter table and dereferences it from the RX path every time a matching frame arrives. The system call verifier z_vrfy_can_add_rx_filter_msgq() in drivers/can/can_handl...
memorycorruption
CVE-2026-76124 - HIGH
03/11/2026
The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content inspection or extension validation. This makes it possible for authenticated attackers, with subscriber-lev...
fileinclusionOWSAP: A04
CVE-2026-105978 - HIGH
03/11/2026
Improper input validation in management control functions may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges.
oscommandinjectionOWSAP: A03
CVE-2026-4052 - CRITICAL
03/11/2026
This issue only impacts deployments where WSO2 Identity Server is configured as a Resident Key Manager with database sharing. In such environments, a self-registered user may gain access to the System REST APIs of WSO2 API Manager by obtaining a token from the WSO2 Identity Server token endpoint.
authorisationproblemOWSAP: A01
CVE-2026-13594 - CRITICAL
03/11/2026
Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.
OWSAP: A01
CVE-2026-120534 - CRITICAL
03/11/2026
The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited Code Injection in all versions up to, and including, 0.9.2.6 via the render_field function. This is due to insufficient validation of form configuration parameters before merging into field settings and passing to call_user_func_array in the render_field method. This makes it possible for unauthenticated attacke...
fileinclusionOWSAP: A04
CVE-2026-120518 - CRITICAL
03/11/2026
The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxp_image_field_update_on_user_activation() calling unlink() on a path built from visitor-supplied signup metadata with no realpath() resolution, no containment check against the profile-image directory and no extension allow-list. Submittin...
directorytraversalOWSAP: A01
CVE-2026-76955 - HIGH
03/11/2026
A buffer overflow vulnerability in the zdp_wtp binary in Zyxel NWA110AX firmware versions through 7.12(ABTG.0)C0 could allow a LAN-based attacker to escalate privileges on an affected device.
overflow
CVE-2026-107441 - HIGH
03/11/2026
An out-of-bounds write vulnerability in the CGI program of Zyxel GS1900-24E firmware versions through 2.90(AAHK.2)C0 could allow an unauthenticated adjacent attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.
overflow
CVE-2026-71450 - HIGH
02/11/2026
Authentication bypass using an alternate path or channel vulnerability in Johnson Controls EasyIO Neo EC and CW Edge Controller allows Authentication Bypass. This issue affects EasyIO Neo EC and CW Edge Controller: from EC 3.3b62 through EC 3.3b63 and from CW 3.3b24 through CW 3.3b25.
OWSAP: A07
CVE-2026-86596 - CRITICAL
02/11/2026
The s2Member plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, <= 260927 via the 'item_name' parameter parameter. This is due to insufficient sanitization in strip_php_tags_deep(), which only strips literal '
codeinjectionOWSAP: A03
CVE-2026-115215 - HIGH
02/11/2026
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its fixed session pool for the first datagram from any unrecognised address and port, before the cookie exchange, and never releases a session whose handshake stalls. A remote, unauthenticated attacker can exhaust the pool with one spoofed datagram per source and deny DTLS service t...
CVE-2026-115403 - HIGH
02/11/2026
In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw send path uses the destination-table entry it adds without checking that the add succeeded. When the destination table is full and an off-link destination is reached through a default router whose neighbour cache entry is unknown, sending on an IPv6 raw socket with header inclus...
memorycorruption
CVE-2026-58873 - HIGH
02/11/2026
In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
authorisationproblemOWSAP: A01
CVE-2026-29508 - HIGH
02/11/2026
ReadyMedia (formerly MiniDLNA) versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length stack array and read file data into it. Attackers can place a crafted DFF file in a directory monitor...
CVE-2026-105476 - HIGH
02/11/2026
Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges.
OWSAP: A01
CVE-2026-59044 - HIGH
02/11/2026
In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
memorycorruption
CVE-2026-59028 - HIGH
02/11/2026
In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
OWSAP: A01
CVE-2026-59000 - HIGH
02/11/2026
In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
OWSAP: A01
CVE-2026-58984 - HIGH
02/11/2026
In multiple locations, there is a possible memory corruption due to a use-after-free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
memorycorruption
