Dernières vulnérabilités critiques
CVE publiées dont le score CVSS de référence — celui du CNA ou celui de la NVD — atteint 9,0 ou plus, les plus récentes d’abord.
Mise à jour : CVE List (cvelistV5) : NVD (fkie-cad mirror) :
| CVE | Bibliothèque / produit — versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-103882 | acadlix Acadlix LMS – AI Quiz Maker, Online Exam & Course Plugin for WordPress ≤ 1.1.9 | Acadlix LMS <= 1.1.9 - Unauthenticated Arbitrary File Deletion via 'delete_file_data.file_path' Parameter | CRITICAL 9.1 | |||
| CVE-2026-118235 | wpazleen SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications ≤ 3.10.2 | SimpleForm <= 3.10.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename via Unknown File Key in simpleform_get_submit_data | CRITICAL 9.8 | |||
| CVE-2026-116512 | wedevs Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker ≤ 4.1.1 | Project Manager <= 4.1.1 - Unauthenticated Remote Code Execution via 'id' Parameter Function Injection | CRITICAL 9.8 | |||
| CVE-2026-119096 | uncannyowl Uncanny Toolkit for LearnDash ≤ 3.8.2 | Uncanny Toolkit for LearnDash <= 3.8.2 - Unauthenticated Authentication Bypass via 'email' Parameter | CRITICAL 9.8 | |||
| CVE-2026-116557 | murgroland WP Booking System – Booking Calendar ≤ 2.1.0.5 | WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJ… | CRITICAL 9.1 | |||
| CVE-2026-89270 | popupbuilder Popup Builder – Create highly converting, mobile friendly marketing popups. ≤ 4.4.5 | Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id'… | CRITICAL 9.1 | |||
| CVE-2026-109220 | addonsorg PDF Invoice for WooCommerce + Drag and Drop Template Builder ≤ 7.1.1 | PDF Invoice for WooCommerce + Drag and Drop Template Builder <= 7.1.1 - Unauthenticated PHP Object Injection to Remote Code Execution via… | CRITICAL 9.8 | |||
| CVE-2026-117656 | pow-auth assent 0.1.25 – < 0.3.2pow-auth assent a2d331e8c51376d6c0b04a81aad31e0b4d4d64a3 – < 18898bde0296152165ae470078490e5798329b1b | Unverified Sign in with Apple callback parameter can override verified ID token claims | CRITICAL 9.3 | |||
| CVE-2026-63377 | fctr-id okta-ai-agent < 3.0.1-beta | TAKO AI Agent for Okta: Unauthenticated first-run administrator takeover | CRITICAL 9.8 | |||
| CVE-2026-62863 | gojue moling < 0.5.0 | MoLing: unauthenticated SSE and wildcard CORS expose tool sessions | CRITICAL 9.6 | |||
| CVE-2026-62849 | mqttsnet thinglinks < 1.4.0 | ThingLinks TDengine TDS APIs vulnerable to unauthenticated SQL injection | CRITICAL 9.1 | |||
| CVE-2026-62853 | mqttsnet thinglinks < 1.4.0 | ThingLinks vulnerable to authenticated remote code execution via Groovy script registration in ThingLinks | CRITICAL 9.9 | |||
| CVE-2026-117666 | deadtrickster ssl_verify_fun 1.0.1 – < 1.1.8deadtrickster ssl_verify_fun a49ca56923356c7a3981692b23c42ef32c2990e0 – < ca34031299cd2e0c98794c0da4ba556b94e39aad | ssl_verify_fun: partial-label wildcard certificate matches hostnames across a label boundary | CRITICAL 9.1 | |||
| CVE-2026-61620 | seancorfield honeysql >= 2.0.0, < 2.7.1392 | HoneySQL unchecked entity names can lead to SQL injection results | CRITICAL 9.8 | |||
| CVE-2026-116241 | pgadmin.org pgAdmin 4 < 9.19 | pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier | CRITICAL 9.4 | |||
| CVE-2026-116238 | pgadmin.org pgAdmin 4 < 9.19 | pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks | CRITICAL 9.2 | |||
| CVE-2026-61850 | akuity kargo >= 0.6.0, < 1.8.14 ; >= 1.9.0-rc.1, < 1.9.9 ; >= 1.10.0-rc.1, < 1.10.8 | Kargo: Privilege escalation via Project RBAC management in the Kargo API | CRITICAL 9.3 | |||
| CVE-2026-55598 | madeofpendletonwool PinePods < 0.9.0 | PinePods: Authenticated SSRF via podcast RSS enclosure URL (server-side fetch of attacker-controlled URL, no host validation) | CRITICAL 9.1 | |||
| CVE-2026-78403 | Thalesgroup Sentinel Keys Server < 1.3.8.0 | Unauthenticated Stack Buffer Overflow in Sentinel Keys Server | CRITICAL 9.3 | |||
| CVE-2026-116852 | Marketing Fire Widget Options n/a – 4.2.5 | WordPress Widget Options plugin <= 4.2.5 - Remote Code Execution (RCE) vulnerability | CRITICAL 9.1 | |||
| CVE-2026-116386 | Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications n/a – 4.0.2 | WordPress SMS Alert Order Notifications plugin <= 4.0.2 - Privilege Escalation vulnerability | CRITICAL 9.8 | |||
| CVE-2026-90888 | leadsnap LeadSnap n/a – 1.25 | WordPress LeadSnap plugin <= 1.25 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-39738 | FunnelKit FunnelKit Automations n/a – 3.8.6.1 | WordPress FunnelKit Automations plugin <= 3.8.6.1 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-39732 | Ivijan-Stefan Stipic Transliterator n/a – 2.5.13 | WordPress Transliterator plugin <= 2.5.13 - SQL Injection vulnerability | CRITICAL 9.3 | |||
| CVE-2026-119526 | ThemeREX Royal Event n/a – 2.0 | WordPress Royal Event theme <= 2.0 - PHP Object Injection vulnerability | CRITICAL 9.8 | |||
| CVE-2026-118697 | JetBrains Toolbox App 3.9.0 – < 3.9.1 ; < 3.8.2JetBrains IntelliJ IDEA < 2026.2.4 | In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon trusted compromised interme | CRITICAL 9.0 | |||
| CVE-2026-119978 | flowise npm < 3.1.3flowise-components npm < 3.1.3 | Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore | CRITICAL 9.0 | |||
| CVE-2026-61826 | morpheus65535 bazarr < 1.5.7-beta.14 | Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request for… | CRITICAL 10.0 | |||
| CVE-2026-112816 | Canonical LXD 4.0.14 – < 4.0.15 ; 5.0.10 – < 5.0.11 ; 5.21.8 – < 5.21.9 ; … | Improper certificate validation in the HTTPS listener in LXD | CRITICAL 10.0 | |||
| CVE-2026-119717 | up9inc pybars4 ≤ 0.9.13 | pybars4 through 0.9.13 Code Injection via Bracketed Path Segments | CRITICAL 9.2 | |||
| CVE-2026-119716 | wbond pybars3 ≤ 0.9.7 | pybars3 through 0.9.7 Code Injection via Bracketed Path Segments | CRITICAL 9.2 | |||
| CVE-2026-119706 | InternLM lmdeploy 0.9.0 – 0.18.0 | LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization | CRITICAL 9.3 | |||
| CVE-2026-93327 | Google Cloud Application Integration < 2026-09-11 | Unsafe Java Deserialization in Application Integration SubWorkflow tasks allows Remote Code Execution | CRITICAL 9.4 | |||
| CVE-2026-61738 | socfortress CoPilot < 0.1.77 | SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE) | CRITICAL 10.0 | |||
| CVE-2026-61737 | huajian123 ng-antd-admin < 22.0 | ng-antd-admin: Hardcoded JWT Secret allows Authentication Bypass in ng-antd-admin | CRITICAL 9.8 | |||
| CVE-2026-61730 | socfortress CoPilot < 0.1.77 | SOCFortress CoPilot: Unauthenticated Exposure of ScoutSuite Reports and Uploaded GCP Service-Account Key via Static Mount | CRITICAL 9.3 | |||
| CVE-2026-61729 | socfortress CoPilot < 0.1.76 | SOCFortress CoPilot: Hardcoded Default Header Secret - Unauthenticated Active-Response Invocation and Alert Injection | CRITICAL 9.4 | |||
| CVE-2026-61728 | socfortress CoPilot < 0.1.76 | SOCFortress CoPilot: Stored comment and SOC-field XSS permits privileged account takeover | CRITICAL 9.9 | |||
| CVE-2026-112905 | givanz Vvveb < 1.0.8.7 | Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft | CRITICAL 9.0 | |||
| CVE-2026-110799 | givanz Vvveb < 1.0.8.7 | Vvveb: Authentication Bypass via PHP Array Injection leading to full Account Takeover | CRITICAL 9.8 | |||
| CVE-2026-119660 | yincongcyincong MuseBot < 2.0.0 | MuseBot before 2.0.0 Authentication Bypass via Hard-Coded Session Key | CRITICAL 9.3 | |||
| CVE-2026-119597 | AIDotNet OpenDeepWiki ≤ 2.0.6 | OpenDeepWiki through 2.0.6 Hard-coded JWT Signing Key Admin Token Forgery | CRITICAL 9.3 | |||
| CVE-2026-119568 | vsftpd vsftpd ≤ 3.0.5 | vsftpd through 3.0.5 require_ssl_reuse Bypass via FTPS Data Channel Hijacking | CRITICAL 9.1 | |||
| CVE-2026-119419 | cakephp cakephp ≤ 5.4.3 | CakePHP through 5.4.3 SQL Injection via StringExpression and IdentifierExpression Collation | CRITICAL 9.2 | |||
| CVE-2026-119418 | cakephp cakephp ≤ 5.4.3 | CakePHP through 5.4.3 SQL Injection via WindowExpression range() and frame() | CRITICAL 9.2 | |||
| CVE-2026-116366 | ClickHouse ClickHouse 26.3 – < 26.3.62.3-lts ; 26.8 – < 26.8.36.3-lts ; 26.9 – < 26.9.27.3-stable ; …ClickHouse ClickHouse Cloud 25.12 – < 25.12.1.1713 ; 26.2 – < 26.2.1.835 ; 26.4 – < 26.4.1.2704 ; … | Unauthenticated RCE vulnerability against ClickHouse Server | CRITICAL 9.5 | |||
| CVE-2025-31704 | Dahua Intelligent Connection Center V1.000.0000000.1 – 1.000.0000005.0 ; V5.000.0000000.6 – < V5.000.0000000.15 | Dahua Intelligent Connection Center command injection | CRITICAL 9.8 | |||
| CVE-2026-82104 | Teltonika Networks RUT 7.22 – 7.24.2Teltonika Networks RUTX 7.22 – 7.24.2+3 autres | API permission bypass via logic bug | CRITICAL 9.4 | 0.4 % | ||
| CVE-2026-103039 | Gravity Forms Gravity Forms ≤ 3.1.2 | Gravity Forms <= 3.1.2 - Unauthenticated PHP Object Injection via Post Custom Field | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-107249 | Drupal Block AJAX 0.0.0 – < 3.0.2 | Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192 | CRITICAL 9.8 | 0.2 % | ||
| CVE-2026-119263 | Google Chrome 156.0.8078.79 – < 156.0.8078.79 | Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary co | CRITICAL 9.6 | 0.2 % | ||
| CVE-2026-119261 | Google Chrome 156.0.8078.79 – < 156.0.8078.79 | Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code ou | CRITICAL 9.6 | 0.2 % | ||
| CVE-2023-22793 | Veeam Management Pack for Microsoft System Center 9.0 – < 13.1.0.334 | A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veeam Virtualization Exte | CRITICAL 9.3 | 0.5 % | ||
| CVE-2026-61707 | socfortress CoPilot < 0.1.76 | SOCFortress CoPilot: Stored case-report template injection permits backend code execution | CRITICAL 9.0 | 0.2 % | ||
| CVE-2026-61645 | docat-org docat < 1.6.0 | Docat has Arbitrary File Upload exists in Upload API | CRITICAL 9.1 | 0.4 % | ||
| CVE-2026-103093 | ServiceNow ServiceNow AI Platform < Yokohama Patch 13 Hot Fix 4a ; < Zurich Patch 10 Hot Fix 3b ; < Zurich Patch 12 ; … | Sandbox Escape via Table Rotation in ServiceNow AI Platform | CRITICAL 9.4 | 0.4 % | ||
| CVE-2026-118769 | randombit botan >= 2.1.0, < 3.13.0 | Botan: Integer overflow when reporting block size in FFI can cause memory corruption | CRITICAL 9.2 | 0.4 % | ||
| CVE-2026-118762 | monkeytypegame monkeytype < 26.43.0 | Monkeytype: fork PR can execute code with elevated GITHUB_TOKEN | CRITICAL 9.3 | 0.3 % | ||
| CVE-2026-119145 | frappe frappe 16.0.0 – < 16.34.0frappe frappe < 15.121.0 | Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload | CRITICAL 9.4 | 0.8 % | ||
| CVE-2026-119128 | zitadel zitadel 4.0.0 – < 4.19.5 | ZITADEL 4.0.0 before 4.19.5 Login V2 Account Takeover via Forgeable verificationCheck Cookie | CRITICAL 9.1 | 0.3 % | ||
| CVE-2026-90868 | Progress Software WS_FTP Server < 2024.0.7 ; < 2025.0.4 | OS Command Injection in Progress WS_FTP Server | CRITICAL 9.9 | 1.5 % | ||
| CVE-2026-90866 | Progress Software WS_FTP Server < 2024.0.7 ; < 2025.0.4 | Virtual Folder Path Confinement Bypass in Progress WS_FTP Server | CRITICAL 9.1 | 0.7 % | ||
| CVE-2026-90865 | Progress Software WS_FTP Server < 2024.0.7 ; < 2025.0.4 | Command Injection via FTP Notification Variables in Progress WS_FTP Server | CRITICAL 9.0 | 1.1 % | ||
| CVE-2026-90864 | Progress Software WS_FTP Server < 2024.0.7 ; < 2025.0.4 | Host Administrator Path Containment Bypass in Progress WS_FTP Server | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-90863 | Progress Software WS_FTP Server < 2024.0.7 ; < 2025.0.4 | Privilege Escalation via Missing Authorization in WS_FTP Manager | CRITICAL 9.1 | 0.7 % | ||
| CVE-2026-84295 | Progress Software WS_FTP Server < 2024.0.6 ; < 2025.0.3 | Improper Authentication in Progress WS_FTP Server | CRITICAL 10.0 | 0.6 % | ||
| CVE-2026-111732 | RT-Labs P-Net < 1.0.3 | Out-of-bounds write when parsing AR Vendor Block requests | CRITICAL 9.3 | 0.4 % | ||
| CVE-2026-112256 | OpenText Advanced Authentication Server 6.4.0.0 – 6.4.3.8 ; 6.5.0.0 – 6.5.0.10 ; 6.6.0.0 – 6.6.1.0 | Logon bypass (trust of attacker-controlled completed-methods list) | CRITICAL 9.2 | 0.2 % | ||
| CVE-2026-62131 | Zoho Flow Zoho Flow n/a – 2.14.5 | WordPress Zoho Flow plugin <= 2.14.5 - PHP Object Injection vulnerability | CRITICAL 9.8 | 0.3 % | ||
| CVE-2026-62018 | ThemeREX Gunslinger n/a – 1.11 | WordPress Gunslinger theme <= 1.11 - PHP Object Injection vulnerability | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-62017 | ThemeREX Good Homes n/a – 1.3.13 | WordPress Good Homes theme <= 1.3.13 - PHP Object Injection vulnerability | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-62016 | ThemeREX Gamic n/a – 1.19 | WordPress Gamic theme <= 1.19 - PHP Object Injection vulnerability | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-62015 | ThemeREX Gamezone n/a – 1.1.11 | WordPress Gamezone theme <= 1.1.11 - PHP Object Injection vulnerability | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-62014 | ThemeREX EmojiNation n/a – 1.0.12 | WordPress EmojiNation theme <= 1.0.12 - PHP Object Injection vulnerability | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-62013 | ThemeREX Edge Decor n/a – 2.9 | WordPress Edge Decor theme <= 2.9 - PHP Object Injection vulnerability | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-62012 | ThemeREX Coinpress n/a – 1.0.15 | WordPress Coinpress theme <= 1.0.15 - PHP Object Injection vulnerability | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-62011 | ThemeREX Bonbon n/a – 1.11 | WordPress Bonbon theme <= 1.11 - PHP Object Injection vulnerability | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-62010 | ThemeREX Avventure n/a – 1.1.12 | WordPress Avventure theme <= 1.1.12 - PHP Object Injection vulnerability | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-62009 | ThemeREX Filmax n/a – 1.1.11 | WordPress Filmax theme <= 1.1.11 - PHP Object Injection vulnerability | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-62008 | ThemeREX Orpheus n/a – 1.8 | WordPress Orpheus theme <= 1.8 - PHP Object Injection vulnerability | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-62006 | ThemeREX Nuts n/a – 1.12 | WordPress Nuts theme <= 1.12 - PHP Object Injection vulnerability | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-62005 | ThemeREX Muzicon n/a – 1.15 | WordPress Muzicon theme <= 1.15 - PHP Object Injection vulnerability | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-62004 | ThemeREX Motorix n/a – 1.11 | WordPress Motorix theme <= 1.11 - PHP Object Injection vulnerability | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-62003 | ThemeREX Mission n/a – 1.22 | WordPress Mission theme <= 1.22 - PHP Object Injection vulnerability | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-62002 | ThemeREX Meals & Wheels n/a – 1.1.13 | WordPress Meals & Wheels theme <= 1.1.13 - PHP Object Injection vulnerability | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-62001 | ThemeREX Marcell n/a – 1.2.14 | WordPress Marcell theme <= 1.2.14 - PHP Object Injection vulnerability | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-61998 | ThemeREX Le Truffe n/a – 1.1.7 | WordPress Le Truffe theme <= 1.1.7 - PHP Object Injection vulnerability | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-61997 | ThemeREX Legal Stone n/a – 1.2.11 | WordPress Legal Stone theme <= 1.2.11 - PHP Object Injection vulnerability | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-61992 | Von Eyal Fitoussi GEO my WordPress n/a – 4.5.5.3 | WordPress GEO my WordPress plugin <= 4.5.5.4 - PHP Object Injection vulnerability | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-61991 | Ajax Load More AjaxLoadMore Cache n/a – 3.1.1 | WordPress AjaxLoadMore Cache plugin <= 3.1.1 - Remote Code Execution (RCE) vulnerability | CRITICAL 10.0 | 0.7 % | ||
| CVE-2026-54860 | ThemeREX Ozisti n/a – 1.1.10 | WordPress Ozisti theme <= 1.1.10 - PHP Object Injection vulnerability | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-54859 | ThemeREX Preservation n/a – 1.15 | WordPress Preservation theme <= 1.15 - PHP Object Injection vulnerability | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-54858 | ThemeREX Printy n/a – 1.13.0 | WordPress Printy theme <= 1.13.0 - PHP Object Injection vulnerability | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-54857 | ThemeREX Quirky n/a – 1.23 | WordPress Quirky theme <= 1.23 - PHP Object Injection vulnerability | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-54856 | ThemeREX RexCoin n/a – 1.2.6 | WordPress RexCoin theme <= 1.2.6 - PHP Object Injection vulnerability | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-18894 | IBM Langflow OSS 1.0.0 – 1.12.4 | Langflow OSS is affected by multiple vulnerabilities | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-93680 | IBM Langflow OSS 1.0.0 – 1.12.8 | Langflow OSS is affected by multiple vulnerabilities | CRITICAL 9.8 | 2.3 % | ||
| CVE-2026-104317 | IBM Langflow OSS 1.0.0 – 1.12.3 | Langflow OSS is affected by multiple vulnerabilities | CRITICAL 9.8 | 0.6 % | ||
| CVE-2026-104339 | IBM Langflow OSS 1.0.0 – 1.12.3 | Langflow OSS is affected by multiple vulnerabilities | CRITICAL 9.8 | 0.7 % | ||
| CVE-2026-107327 | IBM Langflow OSS 1.0.0 – 1.12.4 | Langflow OSS is affected by multiple vulnerabilities | CRITICAL 9.9 | 0.7 % |