Protégez vos données, renforcez Votre Cybersécurité

CVE-2026-25177 - HIGH
10/03/2026

Improper restriction of names for files and other resources in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.

Plus d'informations avec CVE Find

CVE-2026-25172 - HIGH
10/03/2026

Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.

Plus d'informations avec CVE Find

CVE-2026-24283 - HIGH
10/03/2026

Heap-based buffer overflow in Windows File Server allows an authorized attacker to elevate privileges locally.

Plus d'informations avec CVE Find

CVE-2026-23669 - HIGH
10/03/2026

Use after free in Windows Print Spooler Components allows an authorized attacker to execute code over a network.

memorycorruption

Plus d'informations avec CVE Find

CVE-2026-23654 - HIGH
10/03/2026

Dependency on vulnerable third-party component in GitHub Repo: zero-shot-scfoundation allows an unauthorized attacker to execute code over a network.

Plus d'informations avec CVE Find

CVE-2026-22627 - HIGH
10/03/2026

A buffer copy without checking size of input ('classic buffer overflow') vulnerability in Fortinet FortiSwitchAXFixed 1.0.0 through 1.0.1 may allow an unauthenticated attacker within the same adjacent network to execute unauthorized code or commands on the device via sending a crafted LLDP packet.

overflow

Plus d'informations avec CVE Find

CVE-2026-21262 - HIGH
10/03/2026

Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network.

OWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-20967 - HIGH
10/03/2026

Improper input validation in System Center Operations Manager allows an authorized attacker to elevate privileges over a network.

OWSAP: A03

Plus d'informations avec CVE Find

CVE-2025-69615 - CRITICAL
10/03/2026

Incorrect Access Control via missing 2FA rate-limiting allowing unlimited brute-force retries and full MFA bypass with no user interaction required. Affected Product: Deutsche Telekom AG Telekom Account Management Portal, versions before 2025-10-24, fixed 2025-11-03.

OWSAP: A07

Plus d'informations avec CVE Find

CVE-2025-41709 - CRITICAL
10/03/2026

[PROBLEMTYPE] in [COMPONENT] in [VENDOR] [PRODUCT] [VERSION] on [PLATFORMS] allows [ATTACKER] to [IMPACT] via [VECTOR]

oscommandinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2025-40943 - CRITICAL
10/03/2026

Affected devices do not properly sanitize contents of trace files. This could allow an attacker to inject code through social engineering a legitimate user to import a specially crafted trace file

crosssitescriptingOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-30921 - CRITICAL
10/03/2026

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.20, OneUptime Synthetic Monitors allow low-privileged project users to submit custom Playwright code that is executed on the oneuptime-probe service. In the current implementation, this untrusted code is run inside Node's vm and is given live host Playwright objects such as browser and page. This creates a distinct ...

Plus d'informations avec CVE Find

CVE-2026-30920 - HIGH
10/03/2026

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.19, OneUptime's GitHub App callback trusts attacker-controlled state and installation_id values and updates Project.gitHubAppInstallationId with isRoot: true without validating that the caller is authorized for the target project. This allows an attacker to overwrite another project's GitHub App installation binding...

authorisationproblemOWSAP: A08OWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-30887 - CRITICAL
10/03/2026

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.18, OneUptime allows project members to run custom Playwright/JavaScript code via Synthetic Monitors to test websites. However, the system executes this untrusted user code inside the insecure Node.js vm module. By leveraging a standard prototype-chain escape (this.constructor.constructor), an attacker can bypass th...

codeinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-30869 - CRITICAL
10/03/2026

SiYuan is a personal knowledge management system. Prior to 3.5.10, a path traversal vulnerability in the /export endpoint allows an attacker to read arbitrary files from the server filesystem. By exploiting double‑encoded traversal sequences, an attacker can access sensitive files such as conf/conf.json, which contains secrets including the API token, cookie signing key, and workspace access aut...

directorytraversalOWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-30862 - CRITICAL
10/03/2026

Appsmith is a platform to build admin panels, internal tools, and dashboards. Prior to 1.96, a Critical Stored XSS vulnerability exists in the Table Widget (TableWidgetV2). The root cause is a lack of HTML sanitization in the React component rendering pipeline, allowing malicious attributes to be interpolated into the DOM. By leveraging the "Invite Users" feature, an attacker with a regular user a...

crosssitescriptingOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-28513 - HIGH
10/03/2026

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to your services. Prior to 2.4.0, the OIDC token endpoint rejects an authorization code only when both the client ID is wrong and the code is expired. This allows cross-client code exchange and expired code reuse. This vulnerability is fixed in 2.4.0.

authorisationproblemOWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-27685 - CRITICAL
10/03/2026

SAP NetWeaver Enterprise Portal Administration is vulnerable if a privileged user uploads untrusted or malicious content that, upon deserialization, could result in a high impact on the confidentiality, integrity, and availability of the host system.

OWSAP: A08

Plus d'informations avec CVE Find

CVE-2026-0953 - CRITICAL
10/03/2026

The Tutor LMS Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 3.9.5 via the Social Login addon. This is due to the plugin failing to verify that the email provided in the authentication request matches the email from the validated OAuth token. This makes it possible for unauthenticated attackers to log in as any existing user, including adminis...

authorisationproblemOWSAP: A07

Plus d'informations avec CVE Find

CVE-2025-11158 - CRITICAL
10/03/2026

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports published by users, allowing insertion of arbitrary scripts and leading to a RCE.

authorisationproblemOWSAP: A01

Plus d'informations avec CVE Find