Protégez vos données, renforcez votre cybersécurité

CVE-2026-26832 - CRITICAL
25/03/2026

node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize() function in src/index.js is vulnerable to OS Command Injection. The file path parameter is concatenated into a shell command string and passed to child_process.exec() without proper sanitization

Plus d'informations avec CVE Find

CVE-2026-20086 - HIGH
25/03/2026

A vulnerability in the processing of Control and Provisioning of Wireless Access Points (CAPWAP) packets of Cisco IOS XE Wireless Controller Software for the Catalyst CW9800 Family could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. This vulnerability is due to improper handling of a malformed CAPWAP packet. An attacker could explo...

Plus d'informations avec CVE Find

CVE-2026-20084 - HIGH
25/03/2026

A vulnerability in the DHCP snooping feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause BOOTP packets to be forwarded between VLANs, resulting in a denial of service (DoS) condition. This vulnerability is due to improper handling of BOOTP packets on Cisco Catalyst 9000 Series Switches. An attacker could exploit this vulnerability by sending BOOTP request ...

Plus d'informations avec CVE Find

CVE-2026-20012 - HIGH
25/03/2026

A vulnerability in the Internet Key Exchange version 2 (IKEv2) feature of Cisco IOS Software, Cisco IOS XE Software, Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to trigger a memory leak, resulting in a denial of service (DoS) condition on an affected device. This vulnera...

Plus d'informations avec CVE Find

CVE-2024-58341 - HIGH
25/03/2026

OpenCart Core 4.0.2.3 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'search' parameter. Attackers can send GET requests to the product search endpoint with malicious 'search' values to extract sensitive database information using boolean-based blind or time-based blind SQL injection techniques.

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-26830 - CRITICAL
25/03/2026

pdf-image (npm package) through version 2.0.0 allows OS command injection via the pdfFilePath parameter. The constructGetInfoCommand and constructConvertCommandForPage functions use util.format() to interpolate user-controlled file paths into shell command strings that are executed via child_process.exec()

Plus d'informations avec CVE Find

CVE-2026-23514 - HIGH
25/03/2026

Kiteworks is a private data network (PDN). Versions 9.2.0 and 9.2.1 of Kiteworks Core have an access control vulnerability that allows authenticated users to access unauthorized content. Upgrade Kiteworks Core to version 9.2.2 or later to receive a patch.

Plus d'informations avec CVE Find

CVE-2025-32991 - CRITICAL
25/03/2026

In N2WS Backup & Recovery before 4.4.0, a two-step attack against the RESTful API results in remote code execution.

Plus d'informations avec CVE Find

CVE-2024-51348 - HIGH
25/03/2026

A stack-based buffer overflow vulnerability in the P2P API service in BS Producten Petcam with firmware 33.1.0.0818 allows unauthenticated attackers within network range to overwrite the instruction pointer and achieve Remote Code Execution (RCE) by sending a specially crafted HTTP request.

Plus d'informations avec CVE Find

CVE-2026-2072 - HIGH
25/03/2026

Cross-Site Scripting vulnerability in Hitachi Infrastructure Analytics Advisor (Analytics probe component), Hitachi Ops Center Analyzer.This issue affects Hitachi Infrastructure Analytics Advisor:; Hitachi Ops Center Analyzer: from 10.0.0-00 before 11.0.5-00.

crosssitescriptingOWSAP: A03

Plus d'informations avec CVE Find

CVE-2025-33244 - CRITICAL
24/03/2026

NVIDIA APEX for Linux contains a vulnerability where an unauthorized attacker could cause a deserialization of untrusted data. This vulnerability affects environments that use PyTorch versions earlier than 2.6. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, data tampering, and information disclosure.

OWSAP: A08

Plus d'informations avec CVE Find

CVE-2026-33331 - HIGH
24/03/2026

oRPC is an tool that helps build APIs that are end-to-end type-safe and adhere to OpenAPI standards. Prior to version 1.13.9, a stored cross-site scripting (XSS) vulnerability exists in the OpenAPI documentation generation of orpc. If an attacker can control any field within the OpenAPI specification (such as info.description), they can break out of the JSON context and execute arbitrary JavaScrip...

crosssitescriptingOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-22559 - HIGH
24/03/2026

An Improper Input Validation vulnerability in UniFi Network Server may allow unauthorized access to an account if the account owner is socially engineered into clicking a malicious link. Affected Products: UniFi Network Server (Version 10.1.85 and earlier) Mitigation: Update UniFi Network Server to Version 10.1.89 or later.

OWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-33340 - CRITICAL
24/03/2026

LoLLMs WEBUI provides the Web user interface for Lord of Large Language and Multi modal Systems. A critical Server-Side Request Forgery (SSRF) vulnerability has been identified in all known existing versions of `lollms-webui`. The `@router.post("/api/proxy")` endpoint allows unauthenticated attackers to force the server into making arbitrary GET requests. This can be exploited to access internal s...

authorisationproblemssrfOWSAP: A07OWSAP: A10

Plus d'informations avec CVE Find

CVE-2026-29839 - HIGH
24/03/2026

DedeCMS v5.7.118 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability in /sys_task_add.php.

csrfOWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-27654 - HIGH
24/03/2026

NGINX Open Source and NGINX Plus have a vulnerability in the ngx_http_dav_module module that might allow an attacker to trigger a buffer overflow to the NGINX worker process; this vulnerability may result in termination of the NGINX worker process or modification of source or destination file names outside the document root. This issue affects NGINX Open Source and NGINX Plus when the configuratio...

Plus d'informations avec CVE Find

CVE-2026-33310 - HIGH
24/03/2026

Intake is a package for finding, investigating, loading and disseminating data. Prior to version 2.0.9, the shell() syntax within parameter default values appears to be automatically expanded during the catalog parsing process. If a catalog contains a parameter default such as shell(), the command may be executed when the catalog source is accessed. This means that if a user loads a malic...

oscommandinjectioncodeinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-4723 - CRITICAL
24/03/2026

Use-after-free in the JavaScript Engine component. This vulnerability affects Firefox < 149 and Thunderbird < 149.

memorycorruption

Plus d'informations avec CVE Find

CVE-2026-4722 - HIGH
24/03/2026

Privilege escalation in the IPC component. This vulnerability affects Firefox < 149 and Thunderbird < 149.

Plus d'informations avec CVE Find

CVE-2026-4721 - CRITICAL
24/03/2026

Memory safety bugs present in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 149, Firefox ESR < 115.34, Firefox ESR < 140.9, Thunderbird < 149, and Thunderbi...

overflow

Plus d'informations avec CVE Find