background

CVE & CWE, restez informé

Gestion des CVE et CWE : Votre bouclier contre les Menaces Cyber.

Notre plateforme CVE Find, dédiée à la gestion des CVE et CWE, offre une surveillance en temps réel des vulnérabilités et des faiblesses courantes. Cela permet à nos clients de rester constamment informés des dernières évolutions en matière de cybersécurité. Grâce à notre système d'alerte avancé, vous recevrez des notifications immédiates par SMS et email, garantissant ainsi une réactivité maximale face aux nouvelles menaces.

Avec notre service, vous pourrez sécuriser de manière optimale votre infrastructure réseau et web, renforçant ainsi la protection de vos données critiques contre les intrusions et les cyberattaques. Chez BEXXO, nous vous fournissons les outils nécessaires pour une défense robuste et proactive.

icon

Alerte par Email

icon

Alerte sur les produits que vous utilisez

icon

Déterminer l'impact des risques sur vos produits

icon

Mise à jour permanente

Explorez notre solution mondiale

Avec CVE Find, explorez la plus grande base de données de vulnérabilités au monde.

Le CVE (Common Vulnerabilities and Exposures) est une liste de failles de sécurité informatique divulguées publiquement. Le programme CVE a pour objectif de faciliter le partage des données entre les différentes capacités de détection des vulnérabilités, qu'il s'agisse d'outils, de bases de données ou de services. Il fournit également une norme pour évaluer la couverture de ces outils et services.

Accédez à CVE Find
Mise à jour permanente

Restez en avance avec les dernières failles critiques de sécurité.

Précédent
Prochain
9.8

CVE-2025-11749 - CRITICAL
05/11/2025

The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoint that exposes the 'Bearer Token' value when 'No-Auth URL' is enabled. This makes it possible for unauthenticated attackers to extract the bearer token, which can be used to gain access to a valid session and perform many actions like creat...

OWSAP: A01

>> Plus d'informations avec CVE Find

8.6

CVE-2025-12384 - HIGH
05/11/2025

The Document Embedder – Embed PDFs, Word, Excel, and Other Files plugin for WordPress is vulnerable to unauthorized access/modification/loss of data in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action in the "bplde_save_document_library", "bplde_get_all", "bplde_get_single", and "bplde_delete_document_librar...

authorisationproblemOWSAP: A01

>> Plus d'informations avec CVE Find

9.8

CVE-2025-12674 - CRITICAL
05/11/2025

The KiotViet Sync plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the create_media() function in all versions up to, and including, 1.8.5. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

fileinclusionOWSAP: A04

>> Plus d'informations avec CVE Find

8.8

CVE-2025-21078 - HIGH
05/11/2025

Use of insufficiently random value of secretKey in Smart Switch prior to version 3.7.68.6 allows adjacent attackers to access backup data from applications.

>> Plus d'informations avec CVE Find
8.8

CVE-2025-64106 - HIGH
04/11/2025

Cursor is a code editor built for programming with AI. In versions 1.7.28 and below, an input validation flaw in Cursor's MCP server installation enables specially crafted deep-links to bypass the standard security warnings and conceal executed commands from users if they choose to accept the server. If an attacker is able to convince a victim to navigate to a malicious deeplink, the victim will n...

oscommandinjectionOWSAP: A03

>> Plus d'informations avec CVE Find

8.8

CVE-2025-64107 - HIGH
04/11/2025

Cursor is a code editor built for programming with AI. In versions 1.7.52 and below, manipulating internal settings may lead to RCE. Cursor detects path manipulation via forward slashes (./.cursor/./././././mcp.json etc.), and requires human approval to complete the operation. However, the same kind of manipulation using backslashes was not correctly detected, allowing an attacker who had already ...

directorytraversalOWSAP: A01

>> Plus d'informations avec CVE Find

8.8

CVE-2025-64108 - HIGH
04/11/2025

Cursor is a code editor built for programming with AI. In versions 1.7.44 and below, various NTFS path quirks allow a prompt injection attacker to circumvent sensitive file protections and overwrite files which Cursor requires human approval to overwrite. Modification of some of the protected files can lead to RCE. Must be chained with a prompt injection or malicious model attach. Only affects sys...

directorytraversalcodeinjectionOWSAP: A01OWSAP: A03

>> Plus d'informations avec CVE Find

8.8

CVE-2025-64109 - HIGH
04/11/2025

Cursor is a code editor built for programming with AI. In versions and below, a vulnerability in the Cursor CLI Beta allowed an attacker to achieve remote code execution through the MCP (Model Context Protocol) server mechanism by uploading a malicious MCP configuration in .cursor/mcp.json file in a GitHub repository. Once a victim clones the project and opens it using Cursor CLI, the command to r...

oscommandinjectionOWSAP: A03

>> Plus d'informations avec CVE Find

8.2

CVE-2025-23358 - HIGH
04/11/2025

NVIDIA NVApp for Windows contains a vulnerability in the installer, where a local attacker can cause a search path element issue. A successful exploit of this vulnerability might lead to code execution and escalation of privileges.

>> Plus d'informations avec CVE Find
10

CVE-2025-54863 - CRITICAL
04/11/2025

Radiometrics VizAir is vulnerable to exposure of the system's REST API key through a publicly accessible configuration file. This allows attackers to remotely alter weather data and configurations, automate attacks against multiple instances, and extract sensitive meteorological data, which could potentially compromise airport operations. Additionally, attackers could flood the system with false a...

OWSAP: A04

>> Plus d'informations avec CVE Find

10

CVE-2025-61945 - CRITICAL
04/11/2025

Radiometrics VizAir is vulnerable to any remote attacker via access to the admin panel of the VizAir system without authentication. Once inside, the attacker can modify critical weather parameters such as wind shear alerts, inversion depth, and CAPE values, which are essential for accurate weather forecasting and flight safety. This unauthorized access could result in the disabling of vital alerts...

authorisationproblemOWSAP: A07

>> Plus d'informations avec CVE Find

10

CVE-2025-61956 - CRITICAL
04/11/2025

Radiometrics VizAir is vulnerable to a lack of authentication mechanisms for critical functions, such as admin access and API requests. Attackers can modify configurations without authentication, potentially manipulating active runway settings and misleading air traffic control (ATC) and pilots. Additionally, manipulated meteorological data could mislead forecasters and ATC, causing inaccurate fli...

authorisationproblemOWSAP: A07

>> Plus d'informations avec CVE Find

9.8

CVE-2025-12682 - CRITICAL
04/11/2025

The Easy Upload Files During Checkout plugin for WordPress is vulnerable to arbitrary JavaScript file uploads due to missing file type validation in the 'file_during_checkout' function in all versions up to, and including, 2.9.8. This makes it possible for unauthenticated attackers to upload arbitrary JavaScript files on the affected site's server which may make remote code execution possible.

fileinclusionOWSAP: A04

>> Plus d'informations avec CVE Find

8.5

CVE-2025-11690 - HIGH
04/11/2025

An Insecure Direct Object Reference (IDOR) vulnerability exists in the vehicleId parameter, allowing unauthorized access to sensitive information of other users’ vehicles. Exploiting this issue enables an attacker to retrieve data such as GPS coordinates, encryption keys, initialization vectors, model numbers, and fuel statistics belonging to other users, instead of being limited to their own ve...

authorisationproblemOWSAP: A01

>> Plus d'informations avec CVE Find

9.8

CVE-2025-12493 - CRITICAL
04/11/2025

The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.2.5 via the 'load_template' function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any...

directorytraversalOWSAP: A01

>> Plus d'informations avec CVE Find

8.8

CVE-2025-10896 - HIGH
04/11/2025

Multiple plugins for WordPress with the Jewel Theme Recommended Plugins Library are vulnerable to Unrestricted Upload of File with Dangerous Type via arbitrary plugin installation in all versions up to, and including, 1.0.2.3. This is due to missing capability checks on the '*_recommended_upgrade_plugin' function which allows arbitrary plugin URLs to be installed. This makes it possible for authen...

authorisationproblemOWSAP: A01

>> Plus d'informations avec CVE Find

9.8

CVE-2025-11007 - CRITICAL
04/11/2025

The CE21 Suite plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the wp_ajax_nopriv_ce21_single_sign_on_save_api_settings AJAX action in versions 2.2.1 to 2.3.1. This makes it possible for unauthenticated attackers to update the plugin's API settings including a secret key used for authentication. This allows unauthenticated attackers to...

authorisationproblemOWSAP: A07

>> Plus d'informations avec CVE Find

9.8

CVE-2025-11008 - CRITICAL
04/11/2025

The CE21 Suite plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.3.1 via the log file. This makes it possible for unauthenticated attackers to extract sensitive data including authentication credentials, which can be used to log in as other users as long as they have used the plugin's custom authentication feature before. This may include ...

OWSAP: A09

>> Plus d'informations avec CVE Find

8.8

CVE-2025-11724 - HIGH
04/11/2025

The EM Beer Manager plugin for WordPress is vulnerable to arbitrary file upload leading to remote code execution in all versions up to, and including, 3.2.3. This is due to missing file type validation in the EMBM_Admin_Untappd_Import_image() function and missing authorization checks on the wp_ajax_embm-untappd-import action. This makes it possible for authenticated attackers, with subscriber-leve...

fileinclusionOWSAP: A04

>> Plus d'informations avec CVE Find

9.8

CVE-2025-12158 - CRITICAL
04/11/2025

The Simple User Capabilities plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the suc_submit_capabilities() function in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to elevate the role of any user account to administrator.

authorisationproblemOWSAP: A01

>> Plus d'informations avec CVE Find

Découvrez comment bexxo peut sécuriser votre entreprise. N'hésitez pas à nous contacter pour une consultation personnalisée dès aujourd'hui !
Contactez-nous Chat avec un expert
829+ CVE
Ces 7 Derniers Jours
Dernière mise à jour : 2025-11-05 10:10

Gestion des CVE et CWE : Votre bouclier contre les Menaces Cyber.

16292+ CVE - Authorization problems

8298+ CVE - Cross-Site Request Forgery

16883+ CVE - SQL Injection

39598+ CVE - Cross-site Scripting