Protégez vos données, renforcez Votre Cybersécurité

CVE-2026-1720 - HIGH
05/03/2026

The WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the 'install_and_active_plugin' function in all versions up to, and including, 1.4.24. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install...

authorisationproblemOWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-2599 - CRITICAL
05/03/2026

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.7 via deserialization of untrusted input in the 'download_csv' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability ha...

OWSAP: A08

Plus d'informations avec CVE Find

CVE-2026-28536 - CRITICAL
05/03/2026

Authentication bypass vulnerability in the device authentication module. Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality.

Plus d'informations avec CVE Find

CVE-2026-1678 - CRITICAL
05/03/2026

dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the cached size becomes incorrect, and the final null terminator can be written past the buffer. With assertions disabled (default), a malicious DNS response can trigger an out-of-bounds write when CONFIG_DNS_RESOLVER is enabled.

overflow

Plus d'informations avec CVE Find

CVE-2026-28134 - HIGH
05/03/2026

Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetEngine jet-engine allows Remote Code Inclusion.This issue affects JetEngine: from n/a through <= 3.7.2.

codeinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-29000 - CRITICAL
04/03/2026

pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user incl...

OWSAP: A02

Plus d'informations avec CVE Find

CVE-2026-27803 - HIGH
04/03/2026

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, when a Manager has manage=false for a given collection, they can still perform several management operations as long as they have access to the collection. This issue has been patched in version 1.35.4.

priviliegemanagementauthorisationproblemOWSAP: A04OWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-27802 - HIGH
04/03/2026

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to version 1.35.4, there is a privilege escalation vulnerability via bulk permission update to unauthorized collections by Manager. This issue has been patched in version 1.35.4.

priviliegemanagementauthorisationproblemOWSAP: A04OWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-3545 - CRITICAL
04/03/2026

Insufficient data validation in Navigation in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

OWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-3544 - HIGH
04/03/2026

Heap buffer overflow in WebCodecs in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High)

Plus d'informations avec CVE Find

CVE-2026-3540 - HIGH
04/03/2026

Inappropriate implementation in WebAudio in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

Plus d'informations avec CVE Find

CVE-2026-3539 - HIGH
04/03/2026

Object lifecycle issue in DevTools in Google Chrome prior to 145.0.7632.159 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)

Plus d'informations avec CVE Find

CVE-2026-0847 - HIGH
04/03/2026

A vulnerability in NLTK versions up to and including 3.9.2 allows arbitrary file read via path traversal in multiple CorpusReader classes, including WordListCorpusReader, TaggedCorpusReader, and BracketParseCorpusReader. These classes fail to properly sanitize or validate file paths, enabling attackers to traverse directories and access sensitive files on the server. This issue is particularly cri...

directorytraversalOWSAP: A01

Plus d'informations avec CVE Find

CVE-2025-70223 - CRITICAL
04/03/2026

Stack buffer overflow vulnerability in D-Link DIR-513 v1.10 via the curTime parameter to goform/formAdvNetwork.

Plus d'informations avec CVE Find

CVE-2026-20131 - CRITICAL
04/03/2026

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to execute arbitrary Java code as root on an affected device. This vulnerability is due to insecure deserialization of a user-supplied Java byte stream. An attacker could exploit this vulnerability by sending a crafted serialized Java ob...

OWSAP: A08

Plus d'informations avec CVE Find

CVE-2026-20103 - HIGH
04/03/2026

A vulnerability in the Remote Access SSL VPN functionality of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to exhaust device memory resulting in a denial of service (DoS) condition to new Remote Access SSL VPN connections. This does not affect the management interface, though it ma...

Plus d'informations avec CVE Find

CVE-2026-20101 - HIGH
04/03/2026

A vulnerability in the SAML 2.0 single sign-on (SSO) feature of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a DoS condition. This vulnerability is due to insufficient error checking when processing SAML messages. An attacker could exploit this vulnerability by sending crafted ...

OWSAP: A02

Plus d'informations avec CVE Find

CVE-2026-20082 - HIGH
04/03/2026

A vulnerability in the handling of the embryonic connection limits in Cisco Secure Firewall Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause incoming TCP SYN packets to be dropped incorrectly. This vulnerability is due to improper handling of new, incoming TCP connections that are destined to management or data interfaces when the device is und...

Plus d'informations avec CVE Find

CVE-2026-20079 - CRITICAL
04/03/2026

A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system. This vulnerability is due to an improper system process that is created at boot time. An attacker could exploit this vulnera...

OWSAP: A07

Plus d'informations avec CVE Find

CVE-2026-20039 - HIGH
04/03/2026

A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to ineffective memory management of the VPN web server. An attacker could exploit this vulner...

Plus d'informations avec CVE Find