Protégez vos données, renforcez Votre Cybersécurité

CVE-2026-28229 - CRITICAL
11/03/2026

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 4.0.2 and 3.7.11, Workflow templates endpoints allow any client to retrieve WorkflowTemplates (and ClusterWorkflowTemplates). Any request with a Authorization: Bearer nothing token can leak sensitive template content, including embedded Secret manifests. This vulnerability is f...

authorisationproblemOWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-27897 - CRITICAL
11/03/2026

Vociferous provides cross-platform, offline speech-to-text with local AI refinement. Prior to 4.4.2, the vulnerability exists in src/api/system.py within the export_file route. The application accepts a JSON payload containing a filename and content. While the developer intended for a native UI dialog to handle the file path, the API does not validate the filename string before it is processed by ...

directorytraversalauthorisationproblemOWSAP: A01OWSAP: A07

Plus d'informations avec CVE Find

CVE-2026-1090 - HIGH
11/03/2026

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.6 before 18.7.6, 18.8 before 18.8.6, and 18.9 before 18.9.2 that could have allowed an authenticated user, when the `markdown_placeholders` feature flag was enabled, to inject JavaScript in a browser due to improper sanitization of placeholder content in markdown processing.

crosssitescriptingOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-30903 - CRITICAL
11/03/2026

External Control of File Name or Path in the Mail feature of Zoom Workplace for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privilege via network access.

OWSAP: A04

Plus d'informations avec CVE Find

CVE-2026-32060 - HIGH
11/03/2026

OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in apply_patch that allows attackers to write or delete files outside the configured workspace directory. When apply_patch is enabled without filesystem sandbox containment, attackers can exploit crafted paths including directory traversal sequences or absolute paths to escape workspace boundaries and modify arbitrary file...

directorytraversalOWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-32059 - HIGH
11/03/2026

OpenClaw version 2026.2.22-2 prior to 2026.2.23 tools.exec.safeBins validation for sort command fails to properly validate GNU long-option abbreviations, allowing attackers to bypass denied-flag checks via abbreviated options. Remote attackers can execute sort commands with abbreviated long options to skip approval requirements in allowlist mode.

authorisationproblemOWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-1993 - HIGH
11/03/2026

The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Improper Privilege Management in versions 7.1.0 through 9.0.2. This is due to the `update_settings()` function accepting arbitrary plugin setting names without a whitelist of allowed settings. This makes it possible for authenticated attackers with the `exactmetrics_save_settings` capability to modify any plugin ...

priviliegemanagementOWSAP: A04

Plus d'informations avec CVE Find

CVE-2026-1992 - HIGH
11/03/2026

The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Insecure Direct Object Reference in versions 8.6.0 through 9.0.2. This is due to the `store_settings()` method in the `ExactMetrics_Onboarding` class accepting a user-supplied `triggered_by` parameter that is used instead of the current user's ID to check permissions. This makes it possible for authenticated atta...

authorisationproblemOWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-3826 - CRITICAL
11/03/2026

IFTOP developed by WellChoose has a Local File Inclusion vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server.

OWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-31844 - HIGH
11/03/2026

An authenticated SQL Injection vulnerability (CWE-89) exists in the Koha staff interface in the /cgi-bin/koha/suggestion/suggestion.pl endpoint due to improper validation of the displayby parameter used by the GetDistinctValues functionality. A low-privileged staff user can inject arbitrary SQL queries via crafted requests to this parameter, allowing execution of unintended SQL statements and expo...

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-2631 - CRITICAL
11/03/2026

The Datalogics Ecommerce Delivery WordPress plugin before 2.6.60 exposes an unauthenticated REST endpoint that allows any remote user to modify the option `datalogics_token` without verification. This token is subsequently used for authentication in a protected endpoint that allows users to perform arbitrary WordPress `update_option()` operations. Attackers can use this to enable registartion and...

priviliegemanagementOWSAP: A04

Plus d'informations avec CVE Find

CVE-2026-27842 - CRITICAL
11/03/2026

Authentication bypass issue exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker to bypass authentication and change the device configuration.

OWSAP: A07

Plus d'informations avec CVE Find

CVE-2026-24448 - CRITICAL
11/03/2026

Use of hard-coded credentials issue exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker to obtain administrative access.

OWSAP: A07

Plus d'informations avec CVE Find

CVE-2023-27573 - CRITICAL
11/03/2026

netbox-docker before 2.5.0 has a superuser account with default credentials (admin password for the admin account, and 0123456789abcdef0123456789abcdef01234567 value for SUPERUSER_API_TOKEN). In practice on the public Internet, almost all users changed the password but only about 90% changed the token. Having a default token value was intentional and was valuable for the main intended use case of ...

Plus d'informations avec CVE Find

CVE-2025-13067 - HIGH
11/03/2026

The Royal Addons for Elementor plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 1.7.1049. This is due to insufficient file type validation detecting files named main.php, allowing a file with such a name to bypass sanitization. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the af...

fileinclusionOWSAP: A04

Plus d'informations avec CVE Find

CVE-2026-23814 - HIGH
11/03/2026

A vulnerability in the command parameters of a certain AOS-CX CLI command could allow a low-privilege authenticated remote attacker to inject malicious commands resulting in unwanted behavior.

commandinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-23813 - CRITICAL
11/03/2026

A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated remote actor to circumvent existing authentication controls. In some cases this could enable resetting the admin password.

authorisationproblemOWSAP: A07

Plus d'informations avec CVE Find

CVE-2026-21290 - HIGH
11/03/2026

Adobe Commerce versions 2.4.9-alpha3, 2.4.8-p3, 2.4.7-p8, 2.4.6-p13, 2.4.5-p15, 2.4.4-p16 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field. A ...

crosssitescriptingOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-21333 - HIGH
10/03/2026

Illustrator versions 29.8.4, 30.1 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

OWSAP: A08

Plus d'informations avec CVE Find

CVE-2026-31829 - HIGH
10/03/2026

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.0.13, Flowise exposes an HTTP Node in AgentFlow and Chatflow that performs server-side HTTP requests using user-controlled URLs. By default, there are no restrictions on target hosts, including private/internal IP ranges (RFC 1918), localhost, or cloud metadata endpoints. This enables Server-Side Re...

ssrfOWSAP: A10

Plus d'informations avec CVE Find