Pourquoi la veille des vulnérabilités est critique pour votre entreprise
En 2025, 48 185 nouvelles vulnérabilités (CVE) ont été publiées — soit une hausse de 20 % par rapport à 2024. En 2026, la tendance s'accélère encore. Chaque jour, plus de 130 failles sont rendues publiques, dont certaines concernent les logiciels que votre entreprise utilise au quotidien.
Selon le Verizon Data Breach Investigations Report, 60 % des violations de données exploitent des vulnérabilités pour lesquelles un correctif existait déjà au moment de l'attaque. Le problème n'est pas l'absence de correctifs — c'est l'absence de veille. Aucune équipe IT ne peut suivre manuellement 130 CVE par jour.
Avec CVE Find, explorez la plus grande base de données de vulnérabilités au monde.
Le CVE (Common Vulnerabilities and Exposures) est une liste de failles de sécurité informatique divulguées publiquement. Le programme CVE a pour objectif de faciliter le partage des données entre les différentes capacités de détection des vulnérabilités, qu'il s'agisse d'outils, de bases de données ou de services. Il fournit également une norme pour évaluer la couverture de ces outils et services.
Accédez à CVE Find
Ce que CVE Find fait pour vous
Comment être alerté en temps réel ?
CVE Find vous notifie par email et SMS dès qu'une vulnérabilité concerne vos produits. Fréquence configurable : de l'alerte instantanée au résumé mensuel.
Mes logiciels sont-ils vulnérables ?
Configurez vos produits (CMS, serveurs, librairies) via le catalogue CPE. CVE Find surveille la base MITRE en continu et vous alerte automatiquement. 338 000+ CVE indexés.
Comment prioriser les correctifs ?
Le scoring CVSS (gravité) et EPSS (probabilité d'exploitation réelle) vous indiquent quoi corriger en premier. Fini les faux positifs.
Quelles failles sont activement exploitées ?
Le catalogue CISA KEV intégré identifie les vulnérabilités déjà exploitées dans la nature. Ce sont les failles à corriger en priorité absolue.
La plateforme est-elle disponible en français ?
Oui. CVE Find est disponible en français, anglais et allemand. Développée en Suisse par Bexxo, c'est la seule plateforme CVE francophone complète.
Les données sont-elles fiables et à jour ?
Synchronisation en temps réel avec MITRE, NVD, CISA et FIRST.org. Plus de 48 000 CVE ajoutés en 2025, et la base s'enrichit chaque heure.
Restez en avance avec les dernières failles critiques de sécurité.
CVE-2026-32913 - CRITICAL
23/03/2026
OpenClaw before 2026.3.7 contains an improper header validation vulnerability in fetchWithSsrFGuard that forwards custom authorization headers across cross-origin redirects. Attackers can trigger redirects to different origins to intercept sensitive headers like X-Api-Key and Private-Token intended for the original destination.
OWSAP: A04
CVE-2026-32902 - HIGH
23/03/2026
OpenClaw before 2026.3.1 contains a server-side request forgery vulnerability in web_search citation redirect resolution that allows attackers to target private-network destinations. Attackers who influence citation redirect targets can trigger internal-network requests from the OpenClaw gateway host.
ssrfOWSAP: A10
CVE-2026-32278 - HIGH
23/03/2026
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, a Stored Cross-site Scripting (XSS) issue exists in the file field of the Form Plugin. Versions 1.41.1 and 2.41.1 contain a patch.
fileinclusionOWSAP: A04
CVE-2026-32277 - HIGH
23/03/2026
Connect-CMS is a content management system. In versions 1.35.0 through 1.41.0 and 2.35.0 through 2.41.0, a DOM-based Cross-Site Scripting (XSS) issue exists in the Cabinet Plugin list view. Versions 1.41.1 and 2.41.1 contain a patch.
crosssitescriptingOWSAP: A03
CVE-2025-60949 - CRITICAL
23/03/2026
Census CSWeb 8.0.1 allows "app/config" to be reachable via HTTP in some deployments. A remote, unauthenticated attacker could send requests to configuration files and obtain leaked secrets. Fixed in 8.1.0 alpha.
OWSAP: A01
CVE-2025-60947 - HIGH
23/03/2026
Census CSWeb 8.0.1 allows arbitrary file upload. A remote, authenticated attacker could upload a malicious file, possibly leading to remote code execution. Fixed in 8.1.0 alpha.
fileinclusionOWSAP: A04
CVE-2025-60946 - HIGH
23/03/2026
Census CSWeb 8.0.1 allows arbitrary file path input. A remote, authenticated attacker could access unintended file directories. Fixed in 8.1.0 alpha.
directorytraversalOWSAP: A01
CVE-2026-4681 - CRITICAL
23/03/2026
A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data. This issue affects Windchill PDMLink: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.2.0, 12.1.2.0, 13.0.2.0, 13.1.0.0, 13.1.1.0, 13.1.2.0, 13.1.3.0; FlexPLM: 11.0 M030, 11.1 M020, 11.2.1.0, 12.0.0.0, 12.0.2.0, 12.0.3.0, 1...
codeinjectionOWSAP: A03
CVE-2026-32276 - HIGH
23/03/2026
Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to and including 2.41.0, an authenticated user may be able to execute arbitrary code in the Code Study Plugin. Versions 1.41.1 and 2.41.1 contain a patch.
codeinjectionOWSAP: A03
CVE-2026-23882 - HIGH
23/03/2026
Blinko is an AI-powered card note-taking project. Prior to version 1.8.4, the MCP (Model Context Protocol) server creation function allows specifying arbitrary commands and arguments, which are executed when testing the connection. This issue has been patched in version 1.8.4.
oscommandinjectionOWSAP: A03
CVE-2026-33719 - HIGH
23/03/2026
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the CDN plugin endpoints `plugin/CDN/status.json.php` and `plugin/CDN/disable.json.php` use key-based authentication with an empty string default key. When the CDN plugin is enabled but the key has not been configured (the default state), the key validation check is completely bypassed, allowing any unauthenticated...
authorisationproblemOWSAP: A07
CVE-2026-33717 - HIGH
23/03/2026
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `downloadVideoFromDownloadURL()` function in `objects/aVideoEncoder.json.php` saves remote content to a web-accessible temporary directory using the original URL's filename and extension (including `.php`). By providing an invalid `resolution` parameter, an attacker triggers an early `die()` via `forbiddenPage(...
fileinclusionOWSAP: A04
CVE-2026-33716 - CRITICAL
23/03/2026
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the standalone live stream control endpoint at `plugin/Live/standAloneFiles/control.json.php` accepts a user-supplied `streamerURL` parameter that overrides where the server sends token verification requests. An attacker can redirect token verification to a server they control that always returns `{"error": false}`...
authorisationproblemOWSAP: A07
CVE-2026-33648 - HIGH
23/03/2026
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the restreamer endpoint constructs a log file path by embedding user-controlled `users_id` and `liveTransmitionHistory_id` values from the JSON request body without any sanitization. This log file path is then concatenated directly into shell commands passed to `exec()`, allowing an authenticated user to achieve ar...
oscommandinjectionOWSAP: A03
CVE-2026-33647 - HIGH
23/03/2026
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `ImageGallery::saveFile()` method validates uploaded file content using `finfo` MIME type detection but derives the saved filename extension from the user-supplied original filename without an allowlist check. An attacker can upload a polyglot file (valid JPEG magic bytes followed by PHP code) with a `.php` ext...
fileinclusionOWSAP: A04
CVE-2026-33513 - HIGH
23/03/2026
WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated API endpoint (`APIName=locale`) concatenates user input into an `include` path with no canonicalization or whitelist. Path traversal is accepted, so arbitrary PHP files under the web root can be included. In our test this yielded confirmed file disclosure and code execution of existing PHP conten...
directorytraversalOWSAP: A01OWSAP: A03
CVE-2026-33507 - HIGH
23/03/2026
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/pluginImport.json.php` endpoint allows admin users to upload and install plugin ZIP files containing executable PHP code, but lacks any CSRF protection. Combined with the application explicitly setting `session.cookie_samesite = 'None'` for HTTPS connections, an unauthenticated attacker can craft a pag...
csrfOWSAP: A01
CVE-2026-33502 - CRITICAL
23/03/2026
WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated server-side request forgery vulnerability in `plugin/Live/test.php` allows any remote user to make the AVideo server send HTTP requests to arbitrary URLs. This can be used to probe localhost/internal services and, when reachable, access internal HTTP resources or cloud metadata endpoints. Commit ...
ssrfOWSAP: A10
CVE-2026-32845 - HIGH
23/03/2026
cgltf version 1.15 and prior contain an integer overflow vulnerability in the cgltf_validate() function when validating sparse accessors that allows attackers to trigger out-of-bounds reads by supplying crafted glTF/GLB input files with attacker-controlled size values. Attackers can exploit unchecked arithmetic operations in sparse accessor validation to cause heap buffer over-reads in cgltf_calc_...
CVE-2026-4404 - CRITICAL
23/03/2026
Use of hard coded credentials in GoHarbor Harbor version 2.15.0 and below, allows attackers to use the default password and gain access to the web UI.
OWSAP: A07
