Protégez vos données, renforcez Votre Cybersécurité

CVE-2026-3910 - HIGH
13/03/2026

Inappropriate implementation in V8 in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

codeinjectionoverflowOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-3909 - HIGH
13/03/2026

Out of bounds write in Skia in Google Chrome prior to 146.0.7680.75 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

overflow

Plus d'informations avec CVE Find

CVE-2026-3891 - CRITICAL
13/03/2026

The Pix for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing capability check and missing file type validation in the 'lkn_pix_for_woocommerce_c6_save_settings' function in all versions up to, and including, 1.5.0. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution ...

fileinclusionOWSAP: A04

Plus d'informations avec CVE Find

CVE-2026-32746 - CRITICAL
13/03/2026

telnetd in GNU inetutils through 2.7 allows an out-of-bounds write in the LINEMODE SLC (Set Local Characters) suboption handler because add_slc does not check whether the buffer is full.

overflow

Plus d'informations avec CVE Find

CVE-2026-32459 - HIGH
13/03/2026

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in flycart UpsellWP checkout-upsell-and-order-bumps allows Blind SQL Injection.This issue affects UpsellWP: from n/a through <= 2.2.4.

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-32433 - HIGH
13/03/2026

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in codepeople CP Contact Form with Paypal cp-contact-form-with-paypal allows Blind SQL Injection.This issue affects CP Contact Form with Paypal: from n/a through <= 1.3.61.

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-32422 - HIGH
13/03/2026

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in levelfourdevelopment WP EasyCart wp-easycart allows Blind SQL Injection.This issue affects WP EasyCart: from n/a through <= 5.8.13.

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-32399 - HIGH
13/03/2026

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Blind SQL Injection.This issue affects Media LIbrary Assistant: from n/a through <= 3.32.

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-32368 - HIGH
13/03/2026

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in delphiknight Geo to Lat geo-to-lat allows Blind SQL Injection.This issue affects Geo to Lat: from n/a through <= 1.0.19.

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-32366 - HIGH
13/03/2026

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in robfelty Collapsing Categories collapsing-categories allows Blind SQL Injection.This issue affects Collapsing Categories: from n/a through <= 3.0.9.

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-32306 - CRITICAL
13/03/2026

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.23, the telemetry aggregation API accepts user-controlled aggregationType, aggregateColumnName, and aggregationTimestampColumnName parameters and interpolates them directly into ClickHouse SQL queries via the .append() method (documented as "trusted SQL"). There is no allowlist, no parameterized query binding, and n...

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-32304 - CRITICAL
13/03/2026

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. Prior to 3.0.14, the create_function(args, code) function passes both parameters directly to the Function constructor without any sanitization, allowing arbitrary code execution. This is distinct from CVE-2026-29091 which was call_user_func_array using eval() in v2.x. This finding affects create_function ...

codeinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-32301 - CRITICAL
13/03/2026

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.7.0, Centrifugo is vulnerable to Server-Side Request Forgery (SSRF) when configured with a dynamic JWKS endpoint URL using template variables (e.g. {{tenant}}). An unauthenticated attacker can craft a JWT with a malicious iss or aud claim value that gets interpolated into the JWKS fetch URL before the token signature is v...

ssrfOWSAP: A10

Plus d'informations avec CVE Find

CVE-2026-31922 - HIGH
13/03/2026

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ays Pro Fox LMS fox-lms allows Blind SQL Injection.This issue affects Fox LMS: from n/a through <= 1.0.6.3.

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-31917 - HIGH
13/03/2026

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs WP ERP erp allows SQL Injection.This issue affects WP ERP: from n/a through <= 1.16.10.

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-31886 - CRITICAL
13/03/2026

Dagu is a workflow engine with a built-in Web user interface. Prior to 2.2.4, the dagRunId request field accepted by the inline DAG execution endpoints is passed directly into filepath.Join to construct a temporary directory path without any format validation. Go's filepath.Join resolves .. segments lexically, so a caller can supply a value such as ".." to redirect the computed directory outside t...

directorytraversalOWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-26954 - CRITICAL
13/03/2026

SandboxJS is a JavaScript sandboxing library. Prior to 0.8.34, it is possible to obtain arrays containing Function, which allows escaping the sandbox. Given an array containing Function, and Object.fromEntries, it is possible to construct {[p]: Function} where p is any constructible property. This vulnerability is fixed in 0.8.34.

codeinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-25823 - CRITICAL
13/03/2026

HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have a stack buffer overflow that leads to a Denial of Service, which can also be exploited to achieve Unauthenticated Remote Code Execution.

Plus d'informations avec CVE Find

CVE-2026-25818 - CRITICAL
13/03/2026

HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have weak entropy for authentication cookies, allowing an attacker with a stolen session cookie to find the user password by brute-forcing an encryption parameter.

OWSAP: A05

Plus d'informations avec CVE Find

CVE-2026-25817 - HIGH
13/03/2026

HMS Networks Ewon Flexy with firmware before 15.0s4, Cosy+ with firmware 22.xx before 22.1s6, and Cosy+ with firmware 23.xx before 23.0s3 have improper neutralization of special elements used in an OS command allowing remote code execution by attackers with low privilege access on the gateway, provided the attacker has credentials.

codeinjectionOWSAP: A03

Plus d'informations avec CVE Find