Pourquoi la veille des vulnérabilités est critique pour votre entreprise
En 2025, 48 185 nouvelles vulnérabilités (CVE) ont été publiées — soit une hausse de 20 % par rapport à 2024. En 2026, la tendance s'accélère encore. Chaque jour, plus de 130 failles sont rendues publiques, dont certaines concernent les logiciels que votre entreprise utilise au quotidien.
Selon le Verizon Data Breach Investigations Report, 60 % des violations de données exploitent des vulnérabilités pour lesquelles un correctif existait déjà au moment de l'attaque. Le problème n'est pas l'absence de correctifs — c'est l'absence de veille. Aucune équipe IT ne peut suivre manuellement 130 CVE par jour.
Avec CVE Find, explorez la plus grande base de données de vulnérabilités au monde.
Le CVE (Common Vulnerabilities and Exposures) est une liste de failles de sécurité informatique divulguées publiquement. Le programme CVE a pour objectif de faciliter le partage des données entre les différentes capacités de détection des vulnérabilités, qu'il s'agisse d'outils, de bases de données ou de services. Il fournit également une norme pour évaluer la couverture de ces outils et services.
Accédez à CVE Find
Ce que CVE Find fait pour vous
Comment être alerté en temps réel ?
CVE Find vous notifie par email et SMS dès qu'une vulnérabilité concerne vos produits. Fréquence configurable : de l'alerte instantanée au résumé mensuel.
Mes logiciels sont-ils vulnérables ?
Configurez vos produits (CMS, serveurs, librairies) via le catalogue CPE. CVE Find surveille la base MITRE en continu et vous alerte automatiquement. 338 000+ CVE indexés.
Comment prioriser les correctifs ?
Le scoring CVSS (gravité) et EPSS (probabilité d'exploitation réelle) vous indiquent quoi corriger en premier. Fini les faux positifs.
Quelles failles sont activement exploitées ?
Le catalogue CISA KEV intégré identifie les vulnérabilités déjà exploitées dans la nature. Ce sont les failles à corriger en priorité absolue.
La plateforme est-elle disponible en français ?
Oui. CVE Find est disponible en français, anglais et allemand. Développée en Suisse par Bexxo, c'est la seule plateforme CVE francophone complète.
Les données sont-elles fiables et à jour ?
Synchronisation en temps réel avec MITRE, NVD, CISA et FIRST.org. Plus de 48 000 CVE ajoutés en 2025, et la base s'enrichit chaque heure.
Restez en avance avec les dernières failles critiques de sécurité.
CVE-2019-25581 - HIGH
21/03/2026
i-doit CMDB 1.12 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the objGroupID parameter. Attackers can send GET requests with crafted SQL payloads in the objGroupID parameter to extract sensitive database information including usernames, database names, and version details.
sqlinjectionOWSAP: A03
CVE-2019-25580 - HIGH
21/03/2026
ownDMS 4.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the IMG parameter. Attackers can send GET requests to pdfstream.php, imagestream.php, or anyfilestream.php with crafted SQL payloads in the IMG parameter to extract sensitive database information including version and database names.
fileinclusionOWSAP: A04
CVE-2019-25578 - HIGH
21/03/2026
phpTransformer 2016.9 contains an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the idnews parameter. Attackers can send crafted GET requests to GeneratePDF.php with SQL payloads in the idnews parameter to extract sensitive database information or manipulate queries.
directorytraversalOWSAP: A01
CVE-2019-25576 - HIGH
21/03/2026
Kepler Wallpaper Script 1.1 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code into the category parameter. Attackers can send GET requests to the category endpoint with URL-encoded SQL UNION statements to extract database information including usernames, database names, and MySQL version details.
sqlinjectionOWSAP: A03
CVE-2019-25575 - HIGH
21/03/2026
SimplePress CMS 1.0.7 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'p' and 's' parameters. Attackers can send GET requests with crafted SQL payloads to extract sensitive database information including usernames, database names, and version details.
sqlinjectionOWSAP: A03
CVE-2019-25568 - CRITICAL
21/03/2026
Memu Play 6.0.7 contains an insecure file permissions vulnerability that allows low-privilege users to escalate privileges by replacing the MemuService.exe executable. Attackers can rename and overwrite MemuService.exe in the installation directory with a malicious executable, which executes with system-level privileges when the service restarts after a computer reboot.
authorisationproblemOWSAP: A07
CVE-2026-4261 - HIGH
21/03/2026
The Expire Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.2. This is due to the plugin allowing a user to update the 'on_expire_default_to_role' meta through the 'save_extra_user_profile_fields' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an a...
authorisationproblemOWSAP: A01
CVE-2026-3334 - HIGH
21/03/2026
The CMS Commander plugin for WordPress is vulnerable to SQL Injection via the 'or_blogname', 'or_blogdescription', and 'or_admin_email' parameters in all versions up to, and including, 2.288. This is due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL queries in the restore workflow. This makes it possible for authenticated attackers,...
sqlinjectionOWSAP: A03
CVE-2026-2941 - HIGH
21/03/2026
The Linksy Search and Replace plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'linksy_search_and_replace_item_details' function in all versions up to, and including, 1.0.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to update any database table, any value, including the wp_capabilities...
authorisationproblemOWSAP: A01
CVE-2026-1313 - HIGH
21/03/2026
The MimeTypes Link Icons plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.2.20. This is due to the plugin making outbound HTTP requests to user-controlled URLs without proper validation when the "Show file size" option is enabled. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web request...
ssrfOWSAP: A10
CVE-2026-32051 - HIGH
21/03/2026
OpenClaw versions prior to 2026.3.1 contain an authorization mismatch vulnerability that allows authenticated callers with operator.write scope to invoke owner-only tool surfaces including gateway and cron through agent runs in scoped-token deployments. Attackers with write-scope access can perform control-plane actions beyond their intended authorization level by exploiting inconsistent owner-onl...
authorisationproblemOWSAP: A01
CVE-2026-32042 - HIGH
21/03/2026
OpenClaw versions 2026.2.22 prior to 2026.2.25 contain a privilege escalation vulnerability allowing unpaired device identities to bypass operator pairing requirements and self-assign elevated operator scopes including operator.admin. Attackers with valid shared gateway authentication can present a self-signed unpaired device identity to request and obtain higher operator scopes before pairing app...
authorisationproblemOWSAP: A01
CVE-2026-24060 - CRITICAL
21/03/2026
Service information is not encrypted when transmitted as BACnet packets over the wire, and can be sniffed, intercepted, and modified by an attacker. Valuable information such as the File Start Position and File Data can be sniffed from network traffic using Wireshark's BACnet dissector filter. The proprietary format used by WebCTRL to receive updates from the PLC can also be sniffed and rever...
OWSAP: A02
CVE-2026-33243 - HIGH
20/03/2026
barebox is a bootloader. In barebox from version 2016.03.0 to before version 2025.09.3 and from version 2025.10.0 to before version 2026.03.1, when creating a FIT, mkimage(1) sets the hashed-nodes property of the FIT signature node to list which nodes of the FIT were hashed as part of the signing process as these will need to be verified later on by the bootloader. However, hashed-nodes itself is ...
OWSAP: A08
CVE-2026-33226 - HIGH
20/03/2026
Budibase is a low code platform for creating internal tools, workflows, and admin panels. In versions from 3.30.6 and prior, the REST datasource query preview endpoint (POST /api/queries/preview) makes server-side HTTP requests to any URL supplied by the user in fields.path with no validation. An authenticated admin can reach internal services that are not exposed to the internet — including clo...
ssrfOWSAP: A10
CVE-2026-33186 - CRITICAL
20/03/2026
gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully ro...
OWSAP: A01
CVE-2026-29796 - CRITICAL
20/03/2026
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this...
authorisationproblemOWSAP: A07
CVE-2026-25192 - CRITICAL
20/03/2026
WebSocket endpoints lack proper authentication mechanisms, enabling attackers to perform unauthorized station impersonation and manipulate data sent to the backend. An unauthenticated attacker can connect to the OCPP WebSocket endpoint using a known or discovered charging station identifier, then issue or receive OCPP commands as a legitimate charger. Given that no authentication is required, this...
authorisationproblemOWSAP: A07
CVE-2026-31903 - HIGH
20/03/2026
The WebSocket Application Programming Interface lacks restrictions on the number of authentication requests. This absence of rate limiting may allow an attacker to conduct denial-of-service attacks by suppressing or mis-routing legitimate charger telemetry, or conduct brute-force attacks to gain unauthorized access.
OWSAP: A07
CVE-2026-3584 - CRITICAL
20/03/2026
The Kali Forms plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.4.9 via the 'form_process' function. This is due to the 'prepare_post_data' function mapping user-supplied keys directly into internal placeholder storage, combined with the use of 'call_user_func' on these placeholder values. This makes it possible for unauthenticated attackers to ex...
codeinjectionOWSAP: A03
