Protégez vos données, renforcez Votre Cybersécurité

CVE-2026-31874 - CRITICAL
11/03/2026

Taskosaur is an open source project management platform with conversational AI for task execution in-app. In 1.0.0, the application does not properly validate or restrict the role parameter during the user registration process. An attacker can manually modify the request payload and assign themselves elevated privileges. Because the backend does not enforce role assignment restrictions or ignore c...

authorisationproblemOWSAP: A01

Plus d'informations avec CVE Find

CVE-2019-25487 - CRITICAL
11/03/2026

SAPIDO RB-1732 V2.0.43 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands by submitting malicious input to the formSysCmd endpoint. Attackers can send POST requests with the sysCmd parameter containing shell commands to execute code on the device with router privileges.

authorisationproblemOWSAP: A01

Plus d'informations avec CVE Find

CVE-2019-25486 - HIGH
11/03/2026

Varient 1.6.1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the user_id parameter. Attackers can submit POST requests with crafted SQL payloads in the user_id field to bypass authentication and extract sensitive database information.

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2019-25483 - HIGH
11/03/2026

Comtrend AR-5310 GE31-412SSG-C01_R10.A2pG039u.d24k contains a restricted shell escape vulnerability that allows local users to bypass command restrictions by using the command substitution operator $( ). Attackers can inject arbitrary commands through the $( ) syntax when passed as arguments to allowed commands like ping to execute unrestricted shell access.

authorisationproblemOWSAP: A07

Plus d'informations avec CVE Find

CVE-2019-25471 - CRITICAL
11/03/2026

FileThingie 2.5.7 contains an arbitrary file upload vulnerability that allows attackers to upload malicious files by sending ZIP archives through the ft2.php endpoint. Attackers can upload ZIP files containing PHP shells, use the unzip functionality to extract them into accessible directories, and execute arbitrary commands through the extracted PHP files.

directorytraversalOWSAP: A01

Plus d'informations avec CVE Find

CVE-2019-25468 - CRITICAL
11/03/2026

NetGain EM Plus 10.1.68 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands by submitting malicious parameters to the script_test.jsp endpoint. Attackers can send POST requests with shell commands embedded in the 'content' parameter to execute code and retrieve command output.

codeinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2019-25467 - HIGH
11/03/2026

Verypdf docPrint Pro 8.0 contains a structured exception handling buffer overflow vulnerability that allows local attackers to execute arbitrary code by supplying an oversized alphanumeric encoded payload in the User Password or Master Password fields. Attackers can craft a malicious payload with encoded shellcode and SEH chain manipulation to bypass protections and execute a MessageBox proof-of-c...

overflow

Plus d'informations avec CVE Find

CVE-2019-25466 - HIGH
11/03/2026

Easy File Sharing Web Server 7.2 contains a local structured exception handling buffer overflow vulnerability that allows local attackers to execute arbitrary code by creating a malicious username. Attackers can craft a username with a payload containing 4059 bytes of padding followed by a nseh value and seh pointer to trigger the overflow when adding a new user account.

overflow

Plus d'informations avec CVE Find

CVE-2018-25159 - CRITICAL
11/03/2026

Epross AVCON6 systems management platform contains an object-graph navigation language (OGNL) injection vulnerability that allows unauthenticated attackers to execute arbitrary commands by injecting malicious OGNL expressions. Attackers can send crafted requests to the login.action endpoint with OGNL payloads in the redirect parameter to instantiate ProcessBuilder objects and execute system comman...

Plus d'informations avec CVE Find

CVE-2026-31862 - CRITICAL
11/03/2026

Cloud CLI (aka Claude Code UI) is a desktop and mobile UI for Claude Code, Cursor CLI, Codex, and Gemini-CLI. Prior to 1.24.0, multiple Git-related API endpoints use execAsync() with string interpolation of user-controlled parameters (file, branch, message, commit), allowing authenticated attackers to execute arbitrary OS commands. This vulnerability is fixed in 1.24.0.

oscommandinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-31852 - CRITICAL
11/03/2026

Jellyfin is an open-source media system. The code-quality.yml GitHub Actions workflow in jellyfin/jellyfin-ios is vulnerable to arbitrary code execution via pull requests from forked repositories. Due to the workflow's elevated permissions (nearly all write permissions), this vulnerability enables full repository takeover of jellyfin/jellyfin-ios, exfiltration of highly privileged secrets, Apple A...

priviliegemanagementOWSAP: A04

Plus d'informations avec CVE Find

CVE-2026-31839 - HIGH
11/03/2026

Striae is a firearms examiner's comparison companion. A high-severity integrity bypass vulnerability existed in Striae's digital confirmation workflow prior to v3.0.0. Hash-only validation trusted manifest hash fields that could be modified together with package content, allowing tampered confirmation packages to pass integrity checks. This vulnerability is fixed in 3.0.0.

Plus d'informations avec CVE Find

CVE-2026-20046 - HIGH
11/03/2026

A vulnerability in task group assignment for a specific CLI command in Cisco IOS XR Software could allow an authenticated, local attacker to elevate privileges and gain full administrative control of an affected device. This vulnerability is due to incorrect mapping of a command to task groups within the source code. An attacker with a low-privileged account could exploit this vulnerability by ...

OWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-20040 - HIGH
11/03/2026

A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device. This vulnerability is due to insufficient validation of user arguments that are passed to specific CLI commands. An attacker with a low-privileged account could exploit this vulnerability by using crafted...

oscommandinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2025-70082 - CRITICAL
11/03/2026

An issue in Lantronix EDS3000PS v.3.1.0.0R2 allows an attacker to execute arbitrary code and obtain sensitive information via the ltrx_evo component

oscommandinjectionOWSAP: A03OWSAP: A07

Plus d'informations avec CVE Find

CVE-2025-68623 - HIGH
11/03/2026

In Microsoft DirectX End-User Runtime Web Installer 9.29.1974.0, a low-privilege user can replace an executable file during the installation process, which may result in unintended elevation of privileges. During installation, the installer runs with HIGH integrity and downloads executables and DLLs to the %TEMP% folder - writable by standard users. Subsequently, the installer executes the downloa...

OWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-28229 - CRITICAL
11/03/2026

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates (and ClusterWorkflowTemplates). Any request with a Authorization: Bearer nothing token can leak sensitive template content, including embedded Secret manifests. This vulnerability is f...

authorisationproblemOWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-27897 - CRITICAL
11/03/2026

Vociferous provides cross-platform, offline speech-to-text with local AI refinement. Prior to 4.4.2, the vulnerability exists in src/api/system.py within the export_file route. The application accepts a JSON payload containing a filename and content. While the developer intended for a native UI dialog to handle the file path, the API does not validate the filename string before it is processed by ...

directorytraversalauthorisationproblemOWSAP: A01OWSAP: A07

Plus d'informations avec CVE Find

CVE-2026-1090 - HIGH
11/03/2026

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user, when the `markdown_placeholders` feature flag was enabled, to inject JavaScript in a browser due to improper sanitization of placeholder content in markdown processing.

crosssitescriptingOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-30903 - CRITICAL
11/03/2026

External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via network access.

OWSAP: A04

Plus d'informations avec CVE Find