Bexxo sécurise les PME suisses avant que les cyberattaques ne surviennent

CVE-2026-32725 - HIGH
31/03/2026

SciTokens C++ is a minimal library for creating and using SciTokens from C or C++. Prior to version 1.4.1, scitokens-cpp is vulnerable to an authorization bypass when processing path-based scopes in tokens. The library normalizes the scope path from the token before authorization and collapses ".." path components instead of rejecting them. As a result, an attacker can use parent-directory travers...

OWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-30282 - CRITICAL
31/03/2026

An arbitrary file overwrite vulnerability in UXGROUP LLC Cast to TV Screen Mirroring v2.2.77 allows attackers to overwrite critical internal files via the file import process, leading to arbtrary code execution or information exposure.

directorytraversalOWSAP: A01OWSAP: A04

Plus d'informations avec CVE Find

CVE-2026-24164 - HIGH
31/03/2026

NVIDIA BioNeMo contains a vulnerability where a user could cause a deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, denial of service, information disclosure, and data tampering.

OWSAP: A08

Plus d'informations avec CVE Find

CVE-2026-24148 - HIGH
31/03/2026

NVIDIA Jetson for JetPack contains a vulnerability in the system initialization logic, where an unprivileged attacker could cause the initialization of a resource with an insecure default. A successful exploit of this vulnerability might lead to information disclosure of encrypted data, data tampering, and partial denial of service across devices sharing the same machine ID.

Plus d'informations avec CVE Find

CVE-2026-34361 - CRITICAL
31/03/2026

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the FHIR Validator HTTP service exposes an unauthenticated "/loadIG" endpoint that makes outbound HTTP requests to attacker-controlled URLs. Combined with a startsWith() URL prefix matching flaw in the credential provider (ManagedWebAccessUtils.getServer()), an attacker ...

OWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-34243 - CRITICAL
31/03/2026

wenxian is a tool to generate BIBTEX files from given identifiers (DOI, PMID, arXiv ID, or paper title). In versions 0.3.1 and prior, a GitHub Actions workflow uses untrusted user input from issue_comment.body directly inside a shell command, allowing potential command injection and arbitrary code execution on the runner. At time of publication, there are no publicly available patches.

commandinjectionoscommandinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-5204 - HIGH
31/03/2026

A vulnerability was determined in Tenda CH22 1.0.0.1. Affected is the function formWebTypeLibrary of the file /goform/webtypelibrary of the component Parameter Handler. This manipulation of the argument webSiteId causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

overflow

Plus d'informations avec CVE Find

CVE-2026-34504 - HIGH
31/03/2026

OpenClaw before 2026.3.28 contains a server-side request forgery vulnerability in the fal provider image-generation-provider.ts component that allows attackers to fetch internal URLs. A malicious or compromised fal relay can exploit unguarded image download fetches to expose internal service metadata and responses through the image pipeline.

ssrfOWSAP: A10

Plus d'informations avec CVE Find

CVE-2026-34162 - CRITICAL
31/03/2026

FastGPT is an AI Agent building platform. Prior to version 4.14.9.5, the FastGPT HTTP tools testing endpoint (/api/core/app/httpTools/runTool) is exposed without any authentication. This endpoint acts as a full HTTP proxy — it accepts a user-supplied baseUrl, toolPath, HTTP method, custom headers, and body, then makes a server-side HTTP request and returns the complete response to the caller. Th...

authorisationproblemssrfOWSAP: A07OWSAP: A10

Plus d'informations avec CVE Find

CVE-2026-0596 - CRITICAL
31/03/2026

A command injection vulnerability exists in mlflow/mlflow when serving a model with `enable_mlserver=True`. The `model_uri` is embedded directly into a shell command executed via `bash -c` without proper sanitization. If the `model_uri` contains shell metacharacters, such as `$()` or backticks, it allows for command substitution and execution of attacker-controlled commands. This vulnerability aff...

oscommandinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-34156 - CRITICAL
31/03/2026

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to version 2.0.28, NocoBase's Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist (controlled by WORKFLOW_SCRIPT_MODULES env var). However, the console object passed into the sandbox context exposes host-realm Writable...

OWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-32920 - HIGH
31/03/2026

OpenClaw before 2026.3.12 automatically discovers and loads plugins from .OpenClaw/extensions/ without explicit trust verification, allowing arbitrary code execution. Attackers can execute malicious code by including crafted workspace plugins in cloned repositories that execute when users run OpenClaw from the directory.

OWSAP: A08

Plus d'informations avec CVE Find

CVE-2026-32917 - CRITICAL
31/03/2026

OpenClaw before 2026.3.13 contains a remote command injection vulnerability in the iMessage attachment staging flow that allows attackers to execute arbitrary commands on configured remote hosts. The vulnerability exists because unsanitized remote attachment paths containing shell metacharacters are passed directly to the SCP remote operand without validation, enabling command execution when remot...

oscommandinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-32916 - CRITICAL
31/03/2026

OpenClaw versions 2026.3.7 before 2026.3.11 contain an authorization bypass vulnerability where plugin subagent routes execute gateway methods through a synthetic operator client with broad administrative scopes. Remote unauthenticated requests to plugin-owned routes can invoke runtime.subagent methods to perform privileged gateway actions including session deletion and agent execution.

priviliegemanagementOWSAP: A04

Plus d'informations avec CVE Find

CVE-2025-15618 - CRITICAL
31/03/2026

Business::OnlinePayment::StoredTransaction versions through 0.01 for Perl uses an insecure secret key. Business::OnlinePayment::StoredTransaction generates a secret key by using a MD5 hash of a single call to the built-in rand function, which is unsuitable for cryptographic use. This key is intended for encrypting credit card transaction data.

OWSAP: A02

Plus d'informations avec CVE Find

CVE-2025-10553 - HIGH
31/03/2026

A Stored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.

crosssitescriptingOWSAP: A03

Plus d'informations avec CVE Find

CVE-2025-10551 - HIGH
31/03/2026

A Stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.

crosssitescriptingOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-34042 - HIGH
31/03/2026

act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it including someone anywhere on the internet to create caches with arbitrary keys and retrieve all existing caches. If they can predict which cache keys will be used by local actions, they can ...

authorisationproblemOWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-34040 - HIGH
31/03/2026

Moby is an open source container framework. Prior to version 29.3.1, a security vulnerability has been detected that allows attackers to bypass authorization plugins (AuthZ). This issue has been patched in version 29.3.1.

OWSAP: A07

Plus d'informations avec CVE Find

CVE-2026-32714 - CRITICAL
31/03/2026

SciTokens is a reference library for generating and using SciTokens. Prior to version 1.9.6, the KeyCache class in scitokens was vulnerable to SQL Injection because it used Python's str.format() to construct SQL queries with user-supplied data (such as issuer and key_id). This allowed an attacker to execute arbitrary SQL commands against the local SQLite database. This issue has been patched in ve...

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find