Protégez vos données, renforcez Votre Cybersécurité

CVE-2026-24708 - HIGH
18/02/2026

An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using th...

Plus d'informations avec CVE Find

CVE-2025-70152 - CRITICAL
18/02/2026

code-projects Community Project Scholars Tracking System 1.0 is vulnerable to SQL Injection in the admin user management endpoints /admin/save_user.php and /admin/update_user.php. These endpoints lack authentication checks and directly concatenate user-supplied POST parameters (firstname, lastname, username, password, user_id) into SQL queries without validation or parameterization.

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2025-70151 - HIGH
18/02/2026

code-projects Scholars Tracking System 1.0 allows an authenticated attacker to achieve remote code execution via unrestricted file upload. The endpoints update_profile_picture.php and upload_picture.php store uploaded files in a web-accessible uploads/ directory using the original, user-supplied filename without validating the file type or extension. By uploading a PHP file and then requesting it ...

fileinclusionOWSAP: A04

Plus d'informations avec CVE Find

CVE-2025-70150 - CRITICAL
18/02/2026

CodeAstro Membership Management System 1.0 contains a missing authentication vulnerability in delete_members.php that allows unauthenticated attackers to delete arbitrary member records via the id parameter.

authorisationproblemOWSAP: A01

Plus d'informations avec CVE Find

CVE-2025-14009 - CRITICAL
18/02/2026

A critical vulnerability exists in the NLTK downloader component of nltk/nltk, affecting all versions. The _unzip_iter function in nltk/downloader.py uses zipfile.extractall() without performing path validation or security checks. This allows attackers to craft malicious zip packages that, when downloaded and extracted by NLTK, can execute arbitrary code. The vulnerability arises because NLTK assu...

codeinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2025-70149 - CRITICAL
18/02/2026

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in print_membership_card.php via the ID parameter.

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2025-70146 - CRITICAL
18/02/2026

Missing authentication in multiple administrative action scripts under /admin/ in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to perform unauthorized administrative operations (e.g.,adding records, deleting records) via direct HTTP requests to affected endpoints without a valid session.

authorisationproblemOWSAP: A07OWSAP: A01

Plus d'informations avec CVE Find

CVE-2025-70141 - CRITICAL
18/02/2026

SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php. The AJAX dispatcher does not enforce authentication or authorization before invoking administrative methods in admin_class.php based on the action parameter. An unauthenticated remote attacker can perform sensitive operations such as creating customers and deleting users (including the admin ...

authorisationproblemOWSAP: A07OWSAP: A01

Plus d'informations avec CVE Find

CVE-2025-70998 - CRITICAL
18/02/2026

UTT HiPER 810 / nv810v4 router firmware v1.5.0-140603 was discovered to contain insecure default credentials for the telnet service, possibly allowing a remote attacker to gain root access via a crafted script.

Plus d'informations avec CVE Find

CVE-2025-65791 - CRITICAL
18/02/2026

ZoneMinder v1.36.34 is vulnerable to Command Injection in web/views/image.php. The application passes unsanitized user input directly to the exec() function.

oscommandinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-1426 - HIGH
18/02/2026

The Advanced AJAX Product Filters plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.9.6 via deserialization of untrusted input in the shortcode_check function within the Live Composer compatibility layer. This makes it possible for authenticated attackers, with Author-level access and above, to inject a PHP Object. No known POP chain is present in...

OWSAP: A08

Plus d'informations avec CVE Find

CVE-2026-1937 - CRITICAL
18/02/2026

The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the `yaymail_import_state` AJAX action in all versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to update arbitrary options on...

authorisationproblemOWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-1714 - HIGH
18/02/2026

The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution plugin for WordPress is vulnerable to Email Relay Abuse in all versions up to, and including, 3.3.2. This is due to the lack of validation on the 'send_to', 'product_title', 'wlmessage', and 'wlemail' parameters in the 'woolentor_suggest_price_action' AJAX endpoint. This makes it possible for unaut...

OWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-26119 - HIGH
17/02/2026

Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network.

authorisationproblemOWSAP: A07

Plus d'informations avec CVE Find

CVE-2026-1670 - CRITICAL
17/02/2026

The affected products are vulnerable to an unauthenticated API endpoint exposure, which may allow an attacker to remotely change the "forgot password" recovery email address.

authorisationproblemOWSAP: A07

Plus d'informations avec CVE Find

CVE-2025-13689 - HIGH
17/02/2026

IBM DataStage on Cloud Pak for Data could allow an authenticated user to execute arbitrary commands and gain access to sensitive information due to unrestricted file uploads.

fileinclusionOWSAP: A04

Plus d'informations avec CVE Find

CVE-2026-23595 - HIGH
17/02/2026

An authentication bypass in the application API allows an unauthorized administrative account to be created. A remote attacker could exploit this vulnerability to create privileged user accounts. Successful exploitation could allow an attacker to gain administrative access, modify system configurations, and access or manipulate sensitive data.

OWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-22769 - CRITICAL
17/02/2026

Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence. Dell recommends that customers upgr...

OWSAP: A07

Plus d'informations avec CVE Find

CVE-2025-33089 - CRITICAL
17/02/2026

IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information or perform unauthorized actions due to the use of hard coded user credentials.

OWSAP: A07

Plus d'informations avec CVE Find

CVE-2026-2630 - HIGH
17/02/2026

A Command Injection vulnerability exists where an authenticated, remote attacker could execute arbitrary code on the underlying server where Tenable Security Center is hosted.

oscommandinjectionOWSAP: A03

Plus d'informations avec CVE Find