Protégez vos données, renforcez Votre Cybersécurité

CVE-2026-3047 - HIGH
05/03/2026

A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypa...

Plus d'informations avec CVE Find

CVE-2026-27944 - CRITICAL
05/03/2026

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.3, the /api/backup endpoint is accessible without authentication and discloses the encryption keys required to decrypt the backup in the X-Backup-Security response header. This allows an unauthenticated attacker to download a full system backup containing sensitive data (user credentials, session tokens, SSL private ke...

authorisationproblemOWSAP: A07OWSAP: A04

Plus d'informations avec CVE Find

CVE-2026-26022 - HIGH
05/03/2026

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, a stored cross-site scripting (XSS) vulnerability exists in the comment and issue description functionality. The application's HTML sanitizer explicitly allows data: URI schemes, enabling authenticated users to inject arbitrary JavaScript execution via malicious links. This issue has been patched in version 0.14.2.

crosssitescriptingOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-25921 - CRITICAL
05/03/2026

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers. This issue has been patched in version 0.14.2.

OWSAP: A08

Plus d'informations avec CVE Find

CVE-2026-24457 - CRITICAL
05/03/2026

An unsafe parsing of OpenMQ's configuration, allows a remote attacker to read arbitrary files from a MQ Broker's server. A full exploitation could read unauthorized files of the OpenMQ’s host OS. In some scenarios RCE could be achieved.

directorytraversalOWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-1720 - HIGH
05/03/2026

The WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the 'install_and_active_plugin' function in all versions up to, and including, 1.4.24. This makes it possible for authenticated attackers, with Subscriber-level access and above, to install...

authorisationproblemOWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-2599 - CRITICAL
05/03/2026

The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.7 via deserialization of untrusted input in the 'download_csv' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability ha...

OWSAP: A08

Plus d'informations avec CVE Find

CVE-2026-28536 - CRITICAL
05/03/2026

Authentication bypass vulnerability in the device authentication module. Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality.

Plus d'informations avec CVE Find

CVE-2026-1678 - CRITICAL
05/03/2026

dns_unpack_name() caches the buffer tailroom once and reuses it while appending DNS labels. As the buffer grows, the cached size becomes incorrect, and the final null terminator can be written past the buffer. With assertions disabled (default), a malicious DNS response can trigger an out-of-bounds write when CONFIG_DNS_RESOLVER is enabled.

overflow

Plus d'informations avec CVE Find

CVE-2026-28134 - HIGH
05/03/2026

Improper Control of Generation of Code ('Code Injection') vulnerability in Crocoblock JetEngine jet-engine allows Remote Code Inclusion.This issue affects JetEngine: from n/a through <= 3.7.2.

codeinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-28115 - CRITICAL
05/03/2026

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem allows Blind SQL Injection.This issue affects WP Attractive Donations System - Easy Stripe & Paypal donations: from n/a through <= 1.25.

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-28114 - CRITICAL
05/03/2026

Unrestricted Upload of File with Dangerous Type vulnerability in firassaidi WooCommerce License Manager fs-license-manager allows Upload a Web Shell to a Web Server.This issue affects WooCommerce License Manager: from n/a through <= 7.0.6.

fileinclusionOWSAP: A04

Plus d'informations avec CVE Find

CVE-2026-28105 - CRITICAL
05/03/2026

Deserialization of Untrusted Data vulnerability in ThemeREX Good Energy goodenergy allows Object Injection.This issue affects Good Energy: from n/a through <= 1.7.7.

OWSAP: A08

Plus d'informations avec CVE Find

CVE-2025-69338 - CRITICAL
05/03/2026

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in don-themes Riode Core riode-core allows Blind SQL Injection.This issue affects Riode Core: from n/a through <= 1.6.26.

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2025-68555 - CRITICAL
05/03/2026

Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Nutrie nutrie allows Upload a Web Shell to a Web Server.This issue affects Nutrie: from n/a through < 2.0.1.

fileinclusionOWSAP: A04

Plus d'informations avec CVE Find

CVE-2025-68553 - CRITICAL
05/03/2026

Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Lendiz lendiz allows Upload a Web Shell to a Web Server.This issue affects Lendiz: from n/a through < 2.0.1.

fileinclusionOWSAP: A04

Plus d'informations avec CVE Find

CVE-2025-54001 - CRITICAL
05/03/2026

Deserialization of Untrusted Data vulnerability in ThemeREX Classter classter allows Object Injection.This issue affects Classter: from n/a through <= 2.5.

OWSAP: A08

Plus d'informations avec CVE Find

CVE-2024-57854 - CRITICAL
05/03/2026

Net::NSCA::Client versions through 0.009002 for Perl uses a poor random number generator. Version v0.003 switched to use Data::Rand::Obscure instead of Crypt::Random for generation of a random initialisation vectors. Data::Rand::Obscure uses Perl's built-in rand() function, which is not suitable for cryptographic functions.

OWSAP: A02

Plus d'informations avec CVE Find

CVE-2026-3381 - CRITICAL
05/03/2026

Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib. Compress::Raw::Zlib includes a copy of the zlib library. Compress::Raw::Zlib version 2.220 includes zlib 1.3.2, which addresses findings fron the 7ASecurity audit of zlib. The includes fixs for CVE-2026-27171.

Plus d'informations avec CVE Find

CVE-2026-3257 - CRITICAL
05/03/2026

UnQLite versions through 0.06 for Perl uses a potentially insecure version of the UnQLite library. UnQLite for Perl embeds the UnQLite library. Version 0.06 and earlier of the Perl module uses a version of the library from 2014 that may be vulnerable to a heap-based overflow.

Plus d'informations avec CVE Find