Protégez vos données, renforcez Votre Cybersécurité

CVE-2026-21882 - HIGH
02/03/2026

theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to version 0.2.0, improper privilege dropping allows local privilege escalation via command re-execution. This issue has been patched in version 0.2.0.

priviliegemanagementOWSAP: A04

Plus d'informations avec CVE Find

CVE-2026-21853 - HIGH
02/03/2026

AFFiNE is an open-source, all-in-one workspace and an operating system. Prior to version 0.25.4, there is a one-click remote code execution vulnerability. This vulnerability can be exploited by embedding a specially crafted affine: URL on a website. An attacker can trigger the vulnerability in two common scenarios: 1/ A victim visits a malicious website controlled by the attacker and the website r...

codeinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-0047 - HIGH
02/03/2026

In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

OWSAP: A04

Plus d'informations avec CVE Find

CVE-2025-48636 - HIGH
02/03/2026

In openFile of BugreportContentProvider.java, there is a possible way to read and write unauthorized files due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

directorytraversalOWSAP: A01

Plus d'informations avec CVE Find

CVE-2024-31328 - HIGH
02/03/2026

In broadcastIntentLockedTraced of BroadcastController.java, there is a possible way to launch arbitrary activities from the background on the paired companion phone due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Plus d'informations avec CVE Find

CVE-2026-3132 - HIGH
02/03/2026

The Master Addons for Elementor Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.1.3 via the 'JLTMA_Widget_Admin::render_preview'. This is due to missing capability check. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute code on the server.

codeinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-28286 - HIGH
02/03/2026

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.5.2-beta3, the application enforces restrictions in the frontend/UI to prevent users from creating files or folders in internal OS paths. However, when interacting directly with the API, the restrictions are bypass-able. By sending a crafted request targeting paths like /etc, /usr, or other ...

OWSAP: A04

Plus d'informations avec CVE Find

CVE-2026-26720 - CRITICAL
02/03/2026

An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module.

codeinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-26699 - HIGH
02/03/2026

sourcecodester Personnel Property Equipment System v1.0 is vulnerable to arbitrary code execution in ip/ppes/admin/admin_change_picture.php.

codeinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-24110 - CRITICAL
02/03/2026

An issue was discovered in Tenda W20E V4.0br_V15.11.0.6. Attackers may send overly long `addDhcpRules` data. When these rules enter the `addDhcpRule` function and are processed by `ret = sscanf(pRule, " %d\t%[^\t]\t%[^\n\r\t]", &dhcpsIndex, dhcpsIP, dhcpsMac);`, the lack of size validation for the rules could lead to buffer overflows in `dhcpsIndex`, `dhcpsIP`, and `dhcpsMac`.

overflow

Plus d'informations avec CVE Find

CVE-2026-24101 - CRITICAL
02/03/2026

An issue was discovered in goform/formSetIptv in Tenda AC15V1.0 V15.03.05.18_multi. When the condition is met, `s1_1` will be passed into sub_B0488, concatenated into `doSystemCmd`. The value of s1_1 is not validated, potentially leading to a command injection vulnerability.

oscommandinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2025-52468 - HIGH
02/03/2026

Chamilo is a learning management system. Prior to version 1.11.30, an input validation vulnerability exists when importing user data from CSV files. This flaw occurs due to insufficient sanitization of user data, specifically in the "Last Name", "First Name", and "Username" fields. It allows attackers to inject a stored cross-site scripting (XSS) payload that is triggered when the user profile is ...

crosssitescriptingOWSAP: A03

Plus d'informations avec CVE Find

CVE-2025-52482 - HIGH
02/03/2026

Chamilo is a learning management system. Prior to version 1.11.30, a Stored XSS vulnerability exists in the glossary function, enabling all users with the Teachers role to inject JavaScript malicious code against the administrator. This issue has been patched in version 1.11.30.

crosssitescriptingOWSAP: A03

Plus d'informations avec CVE Find

CVE-2025-50187 - CRITICAL
02/03/2026

Chamilo is a learning management system. Prior to version 1.11.28, parameter from SOAP request is evaluated without filtering which leads to Remote Code Execution. This issue has been patched in version 1.11.28.

OWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-3431 - CRITICAL
02/03/2026

On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and perform unauthorized operations including reading, modifying, and deleting data.

authorisationproblemOWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-20430 - HIGH
02/03/2026

In wlan AP FW, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00467553; Issue ID: MSV-5151.

overflow

Plus d'informations avec CVE Find

CVE-2026-3422 - CRITICAL
02/03/2026

U-Office Force developed by e-Excellence has a Insecure Deserialization vulnerability, allowing unauthenticated remote attackers to execute arbitrary code on the server by sending maliciously crafted serialized content.

OWSAP: A08

Plus d'informations avec CVE Find

CVE-2026-3000 - CRITICAL
02/03/2026

IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary DLL files from a remote source and execute them.

OWSAP: A08

Plus d'informations avec CVE Find

CVE-2026-2999 - CRITICAL
02/03/2026

IDExpert Windows Logon Agent developed by Changing has a Remote Code Execution vulnerability, allowing unauthenticated remote attackers to force the system to download arbitrary executable files from a remote source and execute them.

OWSAP: A08

Plus d'informations avec CVE Find

CVE-2026-3400 - HIGH
02/03/2026

A security flaw has been discovered in Tenda AC15 up to 15.13.07.13. Affected by this issue is some unknown functionality of the file /goform/TextEditingConversion. The manipulation of the argument wpapsk_crypto2_4g results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

overflow

Plus d'informations avec CVE Find