Pourquoi la veille des vulnérabilités est critique pour votre entreprise
En 2025, 48 185 nouvelles vulnérabilités (CVE) ont été publiées — soit une hausse de 20 % par rapport à 2024. En 2026, la tendance s'accélère encore. Chaque jour, plus de 130 failles sont rendues publiques, dont certaines concernent les logiciels que votre entreprise utilise au quotidien.
Selon le Verizon Data Breach Investigations Report, 60 % des violations de données exploitent des vulnérabilités pour lesquelles un correctif existait déjà au moment de l'attaque. Le problème n'est pas l'absence de correctifs — c'est l'absence de veille. Aucune équipe IT ne peut suivre manuellement 130 CVE par jour.
Avec CVE Find, explorez la plus grande base de données de vulnérabilités au monde.
Le CVE (Common Vulnerabilities and Exposures) est une liste de failles de sécurité informatique divulguées publiquement. Le programme CVE a pour objectif de faciliter le partage des données entre les différentes capacités de détection des vulnérabilités, qu'il s'agisse d'outils, de bases de données ou de services. Il fournit également une norme pour évaluer la couverture de ces outils et services.
Accédez à CVE Find
Ce que CVE Find fait pour vous
Comment être alerté en temps réel ?
CVE Find vous notifie par email et SMS dès qu'une vulnérabilité concerne vos produits. Fréquence configurable : de l'alerte instantanée au résumé mensuel.
Mes logiciels sont-ils vulnérables ?
Configurez vos produits (CMS, serveurs, librairies) via le catalogue CPE. CVE Find surveille la base MITRE en continu et vous alerte automatiquement. 338 000+ CVE indexés.
Comment prioriser les correctifs ?
Le scoring CVSS (gravité) et EPSS (probabilité d'exploitation réelle) vous indiquent quoi corriger en premier. Fini les faux positifs.
Quelles failles sont activement exploitées ?
Le catalogue CISA KEV intégré identifie les vulnérabilités déjà exploitées dans la nature. Ce sont les failles à corriger en priorité absolue.
La plateforme est-elle disponible en français ?
Oui. CVE Find est disponible en français, anglais et allemand. Développée en Suisse par Bexxo, c'est la seule plateforme CVE francophone complète.
Les données sont-elles fiables et à jour ?
Synchronisation en temps réel avec MITRE, NVD, CISA et FIRST.org. Plus de 48 000 CVE ajoutés en 2025, et la base s'enrichit chaque heure.
Restez en avance avec les dernières failles critiques de sécurité.
CVE-2026-4145 - HIGH
15/04/2026
During an internal security assessment, a potential vulnerability was discovered in Lenovo Software Fix that could allow a local authenticated user to perform arbitrary code execution with elevated privileges.
OWSAP: A03
CVE-2026-3505 - CRITICAL
15/04/2026
Allocation of resources without limits or throttling vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules).This issue affects BC-JAVA: before 1.84. Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.
CVE-2026-40499 - HIGH
15/04/2026
radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by embedding a newline byte in the PE section header name field. Attackers can craft a malicious PDB file with specially crafted section names to inject r2 commands that are executed when the idp command processes the file.
oscommandinjectionOWSAP: A03
CVE-2026-39884 - HIGH
14/04/2026
mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Versions 3.4.0 and prior contain an argument injection vulnerability in the port_forward tool in src/tools/port_forward.ts, where a kubectl command is constructed via string concatenation with user-controlled input and then naively split on spaces before being passed to spawn(). Unlike all other tools in th...
OWSAP: A03
CVE-2026-35031 - CRITICAL
14/04/2026
Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain a vulnerability chain in the subtitle upload endpoint (POST /Videos/{itemId}/Subtitles), where the Format field is not validated, allowing path traversal via the file extension and enabling arbitrary file write. This arbitrary file write can be chained into arbitrary file read via .strm files, database extractio...
directorytraversalOWSAP: A03OWSAP: A01
CVE-2026-34457 - CRITICAL
14/04/2026
OAuth2 Proxy is a reverse proxy that provides authentication using OAuth2 providers. Versions prior to 7.15.2 contain a configuration-dependent authentication bypass in deployments where OAuth2 Proxy is used with an auth_request-style integration (such as nginx auth_request) and either --ping-user-agent is set or --gcp-healthchecks is enabled. In affected configurations, OAuth2 Proxy treats any re...
OWSAP: A07
CVE-2026-27290 - HIGH
14/04/2026
Adobe Framemaker versions 2022.8 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code in the context of the current user. If the application uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted application would then exec...
OWSAP: A08
CVE-2026-39399 - CRITICAL
14/04/2026
NuGet Gallery is a package repository that powers nuget.org. A security vulnerability exists in the NuGetGallery backend job’s handling of .nuspec files within NuGet packages. An attacker can supply a crafted nuspec file with malicious metadata, leading to cross package metadata injection that may result in remote code execution (RCE) and/or arbitrary blob writes due to insufficient input valida...
directorytraversalOWSAP: A03OWSAP: A01
CVE-2026-40291 - HIGH
14/04/2026
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an insecure direct object modification vulnerability in the PUT /api/users/{id} endpoint allows any authenticated user with ROLE_STUDENT to escalate their privileges to ROLE_ADMIN by modifying the roles field on their own user record. The API Platform security expression is_granted('EDIT', object) only verif...
priviliegemanagementauthorisationproblemOWSAP: A04OWSAP: A01
CVE-2026-35196 - HIGH
14/04/2026
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an OS Command Injection vulnerability exists in the main/inc/ajax/gradebook.ajax.php endpoint within the export_all_certificates action, where the course code retrieved from the session variable $_SESSION['_cid'] via api_get_course_id() is concatenated directly into a shell_exec() command string without sani...
oscommandinjectionOWSAP: A03
CVE-2026-27306 - HIGH
14/04/2026
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Attacker requires elevated privileges. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
OWSAP: A03
CVE-2026-27305 - HIGH
14/04/2026
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction.
directorytraversalOWSAP: A01
CVE-2026-27304 - CRITICAL
14/04/2026
ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
OWSAP: A03
CVE-2026-34160 - HIGH
14/04/2026
Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the PENS (Package Exchange Notification Services) plugin endpoint at public/plugin/Pens/pens.php is accessible without authentication and accepts a user-controlled package-url parameter that the server fetches using curl without filtering private or internal IP addresses, enabling unauthenticated Server-Side...
authorisationproblemssrfOWSAP: A07OWSAP: A10
CVE-2026-24893 - HIGH
14/04/2026
openITCOCKPIT is an open source monitoring tool built for different monitoring engines. openITCOCKPIT Community Edition prior to version 5.5.2 contains a command injection vulnerability that allows an authenticated user with permission to add or modify hosts to execute arbitrary OS commands on the monitoring backend. The vulnerability arises because user-controlled host attributes (specifically th...
oscommandinjectionOWSAP: A03
CVE-2026-5752 - CRITICAL
14/04/2026
Sandbox Escape Vulnerability in Terrarium allows arbitrary code execution with root privileges on a host process via JavaScript prototype chain traversal.
CVE-2026-34617 - HIGH
14/04/2026
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Cross-Site Scripting (XSS) vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that...
crosssitescriptingOWSAP: A03
CVE-2026-34615 - CRITICAL
14/04/2026
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction. Scope is changed.
OWSAP: A08
CVE-2026-33824 - CRITICAL
14/04/2026
Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
CVE-2026-33120 - HIGH
14/04/2026
Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network.
overflow
