CVE Find: monitor vulnerabilities in real time

More than 130 new vulnerabilities are published every day, and the trend continues to accelerate in 2026. CVE Find, our platform developed by Bexxo, alerts you in real time to those affecting your infrastructure.

Why vulnerability monitoring is critical for your business

In 2025, 48,185 new vulnerabilities (CVEs) were published — a 20% increase compared to 2024. In 2026, the trend is accelerating further. Every day, more than 130 flaws are made public, some of which affect the software your business uses daily.

According to the Verizon Data Breach Investigations Report, 60% of data breaches exploit vulnerabilities for which a patch already existed at the time of the attack. The problem is not the absence of patches — it is the absence of monitoring. No IT team can manually track 130 CVEs per day.

Explorez notre solution mondiale

Avec CVE Find, explorez la plus grande base de données de vulnérabilités au monde.

Le CVE (Common Vulnerabilities and Exposures) est une liste de failles de sécurité informatique divulguées publiquement. Le programme CVE a pour objectif de faciliter le partage des données entre les différentes capacités de détection des vulnérabilités, qu'il s'agisse d'outils, de bases de données ou de services. Il fournit également une norme pour évaluer la couverture de ces outils et services.

Accédez à CVE Find

What CVE Find does for you

How can I be alerted in real time?

CVE Find notifies you by email and SMS as soon as a vulnerability affects your products. Configurable frequency: from instant alerts to monthly summaries.

Are my software products vulnerable?

Configure your products (CMS, servers, libraries) via the CPE catalogue. CVE Find continuously monitors the MITRE database and alerts you automatically. 338,000+ CVEs indexed.

How do I prioritise patches?

CVSS scoring (severity) and EPSS (probability of real-world exploitation) show you what to fix first. No more false positives.

Which vulnerabilities are being actively exploited?

The integrated CISA KEV catalogue identifies vulnerabilities already exploited in the wild. These are the flaws to fix with absolute top priority.

Is the platform available in English?

Yes. CVE Find is available in French, English and German. Developed in Switzerland by Bexxo, it is the only comprehensive French-language CVE platform.

Is the data reliable and up to date?

Real-time synchronisation with MITRE, NVD, CISA and FIRST.org. More than 48,000 CVEs added in 2025, and the database is enriched every hour.

Permanent Update

Stay ahead with the latest critical security vulnerabilities.

Previous
Next
10

CVE-2026-40281 - CRITICAL
06/05/2026

Gotenberg is a Docker-powered stateless API for PDF files. In versions 8.30.1 and earlier, the metadata write endpoint validates metadata keys for control characters but leaves metadata values unsanitized. A newline character in a metadata value splits the ExifTool stdin line into two separate arguments, allowing injection of arbitrary ExifTool pseudo-tags such as -FileName, -Directory, -SymLink, ...

OWSAP: A03

Plus d'informations avec CVE Find
8.6

CVE-2026-44116 - HIGH
06/05/2026

OpenClaw before 2026.4.22 contains a server-side request forgery vulnerability in the Zalo plugin's sendPhoto function that fails to validate outbound photo URLs through the SSRF guard. Attackers can bypass SSRF protection by providing malicious photo URLs to the Zalo Bot API, enabling unauthorized access to internal resources.

ssrfOWSAP: A10

Plus d'informations avec CVE Find
8.8

CVE-2026-44115 - HIGH
06/05/2026

OpenClaw before 2026.4.22 contains an exec allowlist analysis vulnerability allowing shell expansion hiding in unquoted heredoc bodies. Attackers can bypass allowlist validation by embedding shell expansion tokens in heredoc bodies to execute unapproved commands at runtime.

OWSAP: A03

Plus d'informations avec CVE Find
8.8

CVE-2026-44110 - HIGH
06/05/2026

OpenClaw before 2026.4.15 contains an authorization bypass vulnerability in Matrix room control-command authorization that trusts DM pairing-store entries. Attackers with DM-paired sender IDs can execute room control commands without being in configured allowlists by posting in bot rooms, potentially enabling privileged OpenClaw behavior.

authorisationproblemOWSAP: A01

Plus d'informations avec CVE Find
9.8

CVE-2026-44109 - CRITICAL
06/05/2026

OpenClaw before 2026.4.15 contains an authentication bypass vulnerability in Feishu webhook and card-action validation that allows unauthenticated requests to reach command dispatch. Missing encryptKey configuration and blank callback tokens fail open instead of rejecting requests, enabling attackers to bypass signature verification and replay protection to execute arbitrary commands.

Plus d'informations avec CVE Find
8.8

CVE-2026-43584 - HIGH
06/05/2026

OpenClaw before 2026.4.10 contains an insufficient environment variable denylist vulnerability in its exec environment policy that allows operator-supplied overrides of high-risk interpreter startup variables including VIMINIT, EXINIT, LUA_INIT, and HOSTALIASES. Attackers can exploit this by manipulating these environment variables to influence downstream execution behavior or network connectivity...

OWSAP: A03

Plus d'informations avec CVE Find
9.6

CVE-2026-43581 - CRITICAL
06/05/2026

OpenClaw before 2026.4.10 contains an improper network binding vulnerability in the sandbox browser CDP relay that exposes Chrome DevTools Protocol on 0.0.0.0. Attackers can access the DevTools protocol outside intended local sandbox boundaries by exploiting the overly broad binding configuration.

Plus d'informations avec CVE Find
9.1

CVE-2026-43578 - CRITICAL
06/05/2026

OpenClaw versions 2026.3.31 before 2026.4.10 contain a privilege escalation vulnerability where heartbeat owner downgrade detection misses local background async exec completion events. Attackers can exploit this by providing untrusted completion content to leave a run in a more privileged context than intended.

OWSAP: A03

Plus d'informations avec CVE Find
9.8

CVE-2026-43575 - CRITICAL
06/05/2026

OpenClaw versions 2026.2.21 before 2026.4.10 contain an authentication bypass vulnerability in the sandbox noVNC helper route that exposes interactive browser session credentials. Attackers can access the noVNC helper route without bridge authentication to gain unauthorized access to the interactive browser session.

authorisationproblemOWSAP: A01

Plus d'informations avec CVE Find
8.8

CVE-2026-41938 - HIGH
06/05/2026

Vvveb before version 1.0.8.2 contains an unrestricted file upload vulnerability in the media upload handler that allows authenticated users with media-upload permissions to bypass extension restrictions by uploading a .htaccess file to map .phtml extensions to the PHP handler. Attackers can upload a .phtml file containing arbitrary PHP code and trigger execution by sending an unauthenticated HTTP ...

fileinclusionOWSAP: A04

Plus d'informations avec CVE Find
8.8

CVE-2026-41934 - HIGH
06/05/2026

Vvveb before version 1.0.8.2 contains an authenticated remote code execution vulnerability in the admin code editor that allows low-privilege authenticated users to execute arbitrary code by exploiting insufficient file extension restrictions. Attackers with editor, author, contributor, or site_admin roles can write a malicious .htaccess file to map arbitrary extensions to the PHP handler, then up...

OWSAP: A03

Plus d'informations avec CVE Find
9.8

CVE-2026-41930 - CRITICAL
06/05/2026

Vvveb before version 1.0.8.2 contains a hard-coded credentials vulnerability in its docker-compose-apache.yaml configuration that allows unauthenticated attackers to access the bundled phpMyAdmin container with pre-configured database credentials. Attackers can connect to the phpMyAdmin port to gain unrestricted read and write access to the entire Vvveb database, including administrator password h...

authorisationproblemOWSAP: A07

Plus d'informations avec CVE Find
8.3

CVE-2024-30151 - HIGH
06/05/2026

HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation. This could allow unauthorized users to gain elevated privileges, bypassing intended access restrictions. This may result in exposure of sensitive data or unauthorized system modifications

OWSAP: A09

Plus d'informations avec CVE Find
8.8

CVE-2026-7875 - HIGH
06/05/2026

NanoClaw contains a host/container filesystem boundary vulnerability in outbound attachment handling and outbox cleanup that allows a compromised or prompt-injected container to read files outside the intended outbox directory by supplying crafted messages_out.id and content.files values or creating symlinked outbox files. Attackers can exploit this vulnerability to trigger host-side reads of arbi...

directorytraversalOWSAP: A01

Plus d'informations avec CVE Find
8.8

CVE-2026-42503 - HIGH
06/05/2026

gopls by default communicates via pipe. However, -port and -listen flags are supported as means of debugging. If -listen is given a value without an explicit host (e.g. :8080), or -port is used, gopls will listen on 0.0.0.0.  As a result, users might inadvertently cause gopls to bind 0.0.0.0. This can allow a malicious party on the same network to execute code arbitrarily via gopls.

Plus d'informations avec CVE Find
8.8

CVE-2026-20034 - HIGH
06/05/2026

A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to execute arbitr...

OWSAP: A01

Plus d'informations avec CVE Find
9.1

CVE-2026-5081 - CRITICAL
06/05/2026

Apache::Session::Generate::ModUniqueId versions from 1.54 through 1.94 for Perl session ids are insecure. Apache::Session::Generate::ModUniqueId (added in version 1.54) uses the value of the UNIQUE_ID environment variable for the session id. The UNIQUE_ID variable is set by the Apache mod_unique_id plugin, which generates unique ids for the request. The id is based on the IPv4 address, the proces...

OWSAP: A02

Plus d'informations avec CVE Find
8.8

CVE-2025-31951 - HIGH
06/05/2026

HCL BigFix RunBookAI is affected by a Unvalidated Command Input / Potential Command Smuggling vulnerability. A flaw in a component's input handling was identified that could permit unauthorized command execution.

commandinjectionOWSAP: A03OWSAP: A04

Plus d'informations avec CVE Find
9.1

CVE-2026-40010 - CRITICAL
06/05/2026

Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack in Apache Wicket. This issue affects Apache Wicket: from 8.0.0 through 8.17.0, 9.0.0, from 10.0.0 through 10.8.0. Users are recommended to upgrade to version 10.9.0, which fixes the issue.

OWSAP: A07

Plus d'informations avec CVE Find
8.8

CVE-2026-7841 - HIGH
06/05/2026

A remote code execution vulnerability exists in Notification Settings on GeoVision GV-ASWeb 6.2.0. An authenticated user with System Setting permissions can execute arbitrary commands on the server by sending a crafted HTTP POST request to the ASWebCommon.srf backend endpoint to bypass the frontend restrictions.

codeinjectionOWSAP: A03

Plus d'informations avec CVE Find
View all CVE alerts
1342+ CVE
These Last 7 Days
Dernière mise à jour : 2026-05-07 14:17

Management of CVEs and CWEs: Your Shield Against Cyber Threats.

20292+ CVE - Authorization problems

9129+ CVE - Cross-Site Request Forgery

18893+ CVE - SQL Injection

43846+ CVE - Cross-site Scripting

Bexxo?

Why choose Bexxo?

I

Certified Expertise

CyberSafe Label certified and authorized to handle confidential data for federal institutions, our experts apply the highest security standards in the industry.

II

Personalized Support

We adapt our services to your specific needs, whether you are an SME or a large company.

III

Proactive Protection

We anticipate threats before they become a problem, thereby reducing risks and the impact of attacks.

Don't let your business be vulnerable to cyber threats. With Bexxo, secure your digital future today!

Frequently asked questions about CVE Find

How does CVE Find help with nFADP compliance?

The nFADP requires appropriate technical measures to protect data. Vulnerability monitoring is one of these measures: identifying and fixing flaws in your systems demonstrates proactive security management. CVE Find provides the traceability needed in the event of an inspection by the FDPIC.

How does the CVE Find alert system work?

You configure the list of products and technologies you use (servers, CMS, libraries, network equipment). CVE Find continuously monitors the MITRE database and alerts you by email or SMS as soon as a new vulnerability affects one of your products, with the severity score and patch recommendations.

How many CVEs are published each year?

The volume of published CVEs increases every year: 25,227 in 2022, 29,065 in 2023, 40,009 in 2024, and 48,185 in 2025. In 2026, the trend continues to accelerate with more than 130 CVEs published per day. CVE Find indexes all these vulnerabilities in real time.

Is CVE Find free?

Consulting the CVE Find database on www.cvefind.com is free and accessible to all. Advanced features (personalised alerts, monitoring of specific products, SMS notifications) are available to Bexxo clients as part of our audit and monitoring packages.

What is CVE Find?

CVE Find is a Swiss vulnerability monitoring platform, developed and maintained by Bexxo (tesweb SA). It covers the entire MITRE CVE database with real-time updates, email and SMS alerts, and integrated scoring to prioritise patches. The interface is available in French, English and German.

What is a CVE?

A CVE (Common Vulnerabilities and Exposures) is a unique identifier assigned to a known security flaw (e.g. CVE-2024-12345). This system, maintained by the MITRE Corporation, allows security professionals to reference the same vulnerability universally. In 2025, more than 48,000 new CVEs were published (+20% vs 2024).

What is the difference between CVE Find and the NIST NVD database?

The NVD (National Vulnerability Database) from NIST is the official US source. CVE Find aggregates this data and adds a layer of personalised alerts, product filtering and EPSS scoring (real-world exploitation probability) that the NVD does not offer natively. The interface is available in English.

Why is CVE monitoring essential for an SME?

More than 130 vulnerabilities are published every day, and this number increases year on year (+20% between 2024 and 2025). Without active monitoring, your company may be using software with known and exploitable flaws. 60% of data breaches exploit vulnerabilities for which a patch already existed (Verizon DBIR).
The nFADP requires appropriate technical measures to protect data. Vulnerability monitoring is one of these measures: identifying and fixing flaws in your systems demonstrates proactive security management. CVE Find provides the traceability needed in the event of an inspection by the FDPIC.
You configure the list of products and technologies you use (servers, CMS, libraries, network equipment). CVE Find continuously monitors the MITRE database and alerts you by email or SMS as soon as a new vulnerability affects one of your products, with the severity score and patch recommendations.
The volume of published CVEs increases every year: 25,227 in 2022, 29,065 in 2023, 40,009 in 2024, and 48,185 in 2025. In 2026, the trend continues to accelerate with more than 130 CVEs published per day. CVE Find indexes all these vulnerabilities in real time.
Consulting the CVE Find database on www.cvefind.com is free and accessible to all. Advanced features (personalised alerts, monitoring of specific products, SMS notifications) are available to Bexxo clients as part of our audit and monitoring packages.
CVE Find is a Swiss vulnerability monitoring platform, developed and maintained by Bexxo (tesweb SA). It covers the entire MITRE CVE database with real-time updates, email and SMS alerts, and integrated scoring to prioritise patches. The interface is available in French, English and German.
A CVE (Common Vulnerabilities and Exposures) is a unique identifier assigned to a known security flaw (e.g. CVE-2024-12345). This system, maintained by the MITRE Corporation, allows security professionals to reference the same vulnerability universally. In 2025, more than 48,000 new CVEs were published (+20% vs 2024).
The NVD (National Vulnerability Database) from NIST is the official US source. CVE Find aggregates this data and adds a layer of personalised alerts, product filtering and EPSS scoring (real-world exploitation probability) that the NVD does not offer natively. The interface is available in English.
More than 130 vulnerabilities are published every day, and this number increases year on year (+20% between 2024 and 2025). Without active monitoring, your company may be using software with known and exploitable flaws. 60% of data breaches exploit vulnerabilities for which a patch already existed (Verizon DBIR).
Discover how bexxo can secure your business. Don't hesitate to contact us for a personalized consultation today!
Contact us Chat with an expert