CVE Find : surveillez les vulnérabilités en temps réel

CVE-2026-103355 - CRITICAL
04/10/2026

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-105135 - CRITICAL
04/10/2026

A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agent/graph.py of the component Planner Agent. The manipulation of the argument inputs leads to code injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure...

codeinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-105134 - CRITICAL
04/10/2026

A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Upgrading to version 10.3.4 is able to resolve...

commandinjectionoscommandinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-88779 - HIGH
04/10/2026

Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.

Plus d'informations avec CVE Find

CVE-2026-105123 - HIGH
04/10/2026

W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary files by abusing the unvalidated path in POST /api/v0/media/upload/[*:path]. Attackers can upload .php files executed by the web server, use encoded ../ sequences to write outside the media directory, and delete arbitrary files via DELETE /api/v0/media/[*:path...

fileinclusionOWSAP: A04

Plus d'informations avec CVE Find

CVE-2026-96451 - HIGH
03/10/2026

Authorization Bypass Through User-Controlled Key vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affects Ultimate Member: from n/a through 2.13.1.

authorisationproblemOWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-103065 - HIGH
03/10/2026

Improper Validation of Specified Quantity in Input vulnerability in Themeum Kirki kirki allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Kirki: from n/a through 6.3.1.

inputvalidation

Plus d'informations avec CVE Find

CVE-2026-105115 - HIGH
03/10/2026

OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allows remote attackers to load classes without authentication. Attackers can send SOAP requests to /jaxrpc/* with an unverified session identifier and a chosen class name, crashing the server, probing the classpath, or potentially reaching code execution via gadge...

authorisationproblemOWSAP: A07

Plus d'informations avec CVE Find

CVE-2026-105105 - CRITICAL
03/10/2026

CWE-306: Missing Authentication for Critical Function in the ait.core.server telemetry and command broker (ait-server) in NASA-AMMOS AIT-Core through 3.1.1 allows an unauthenticated remote attacker with network access to the ZeroMQ message bus to inject spacecraft command data, exfiltrate command and telemetry traffic, inject forged telemetry, or disrupt the command and telemetry bus. The ait-serv...

authorisationproblemOWSAP: A07

Plus d'informations avec CVE Find

CVE-2026-92084 - CRITICAL
03/10/2026

The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.11.0.5. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortco...

codeinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-87115 - CRITICAL
03/10/2026

The VikAppointments Services Booking Calendar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the extract function in all versions up to, and including, 1.2.21. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as ...

directorytraversalOWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-18443 - HIGH
03/10/2026

The Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management plugin for WordPress is vulnerable to generic SQL Injection via the 'access_privileges' parameter in all versions up to, and including, 8.97.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with su...

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-91078 - HIGH
03/10/2026

The TillKit WordPress plugin before 1.0.5 does not require the hard-coded, publicly known PIN of the privileged POS account it creates on activation to be changed before use, and it authenticates its public POS login endpoint on that PIN alone with no identity or capability check, allowing unauthenticated attackers to obtain a privileged POS session and thereby read customer and site-user personal...

authorisationproblemOWSAP: A07

Plus d'informations avec CVE Find

CVE-2026-89236 - HIGH
03/10/2026

The SaveTo Wishlist Lite WordPress plugin before 1.1.5 does not sanitise and escape parameters before using them in the ORDER BY clause of a SQL query, allowing unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-88783 - HIGH
03/10/2026

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder WordPress plugin before 2.9.3's own script later executes in the browser of any visitor, or of an administr...

crosssitescriptingOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-92536 - HIGH
03/10/2026

The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.17.4 via the get_user_profile_structure. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract other users' email addr...

codeinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-97644 - HIGH
03/10/2026

The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the `create_contact` function in the v3 REST endpoint (`POST /gh/v3/contacts`) is gated solely by the `add_contacts` capability and forwards the full request payload — inc...

priviliegemanagementOWSAP: A04

Plus d'informations avec CVE Find

CVE-2026-105080 - CRITICAL
03/10/2026

In ConvertX before 0.19.0, converters/calibre.ts does not block recipe files, and instead passes them to the ebook-convert program from Calibre. This affects executable code in a .recipe or .downloaded_recipe file.

OWSAP: A08

Plus d'informations avec CVE Find

CVE-2026-95102 - CRITICAL
02/10/2026

WebSocket endpoints lack proper authentication mechanisms, enabling attackers to impersonate charging stations. As a result, attackers can exploit this weakness to gain unauthorized access to sensitive data or perform unauthorized actions. Given that no authentication is required, this can lead to privilege escalation and potentially compromise the security of the entire system.

authorisationproblemOWSAP: A07

Plus d'informations avec CVE Find

CVE-2026-94592 - HIGH
02/10/2026

Armatura One's database initialization routine assigns a fixed, vendor-defined password to the database superuser account at creation time, rather than generating a unique password per installation. An individual with access to the server operating system and knowledge of this value can authenticate as the database superuser on a deployment where it has not been changed.

OWSAP: A07

Plus d'informations avec CVE Find