Protégez vos données, renforcez Votre Cybersécurité

CVE-2026-22730 - HIGH
18/03/2026

A critical SQL injection vulnerability in Spring AI's MariaDBFilterExpressionConverter allows attackers to bypass metadata-based access controls and execute arbitrary SQL commands. The vulnerability exists due to missing input sanitization.

Plus d'informations avec CVE Find

CVE-2026-22729 - HIGH
18/03/2026

A JSONPath injection vulnerability in Spring AI's AbstractFilterExpressionConverter allows authenticated users to bypass metadata-based access controls through crafted filter expressions. User-controlled input passed to FilterExpressionBuilder is concatenated into JSONPath queries without proper escaping, enabling attackers to inject arbitrary JSONPath logic and access unauthorized documents. Thi...

Plus d'informations avec CVE Find

CVE-2026-31938 - CRITICAL
18/03/2026

jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.2.1, user control of the `options` argument of the `output` function allows attackers to inject arbitrary HTML (such as scripts) into the browser context the created PDF is opened in. The vulnerability can be exploited in the following scenario: the attacker provides values for the output options, for example via a web interface...

crosssitescriptingOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-30884 - CRITICAL
18/03/2026

mdjnelson/moodle-mod_customcert is a Moodle plugin for creating dynamically generated certificates with complete customization via the web browser. Prior to versions 4.4.9 and 5.0.3, a teacher who holds `mod/customcert:manage` in any single course can read and silently overwrite certificate elements belonging to any other course in the Moodle installation. The `core_get_fragment` callback `editele...

authorisationproblemOWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-28500 - HIGH
18/03/2026

Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability. In versions up to and including 1.20.1, a security control bypass exists in onnx.hub.load() due to improper logic in the repository trust verification mechanism. While the function is designed to warn users when loading models from non-official sources, the use of the silent=True parameter completely sup...

OWSAP: A08

Plus d'informations avec CVE Find

CVE-2026-22171 - HIGH
18/03/2026

OpenClaw versions prior to 2026.2.19 contain a path traversal vulnerability in the Feishu media download flow where untrusted media keys are interpolated directly into temporary file paths in extensions/feishu/src/media.ts. An attacker who can control Feishu media key values returned to the client can use traversal segments to escape os.tmpdir() and write arbitrary files within the OpenClaw proces...

directorytraversalOWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-27894 - HIGH
18/03/2026

LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to version 9.5, a local file inclusion was detected in the PDF export that allows users to include local PHP files and this way execute code. In combination with GHSA-88hf-2cjm-m9g8 this allows to execute arbitrary code. Users need to login to LAM to exploit this ...

OWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-27811 - HIGH
18/03/2026

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. Prior to version 8.2.6.3, a command injection vulnerability exists in the `/config/compare///show` endpoint, allowed authenticated users to execute arbitrary system commands on the app host. The vulnerability exists in `app/modules/config/config.py` on line 362, where user input is directly f...

commandinjectionoscommandinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-21994 - CRITICAL
17/03/2026

Vulnerability in the Oracle Edge Cloud Infrastructure Designer and Visualisation Toolkit product of Oracle Open Source Projects (component: Desktop). The supported version that is affected is 0.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Edge Cloud Infrastructure Designer and Visualisation Toolkit. Successful attacks of...

Plus d'informations avec CVE Find

CVE-2026-4064 - HIGH
17/03/2026

Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to bypass role-based access controls and perform privileged operations — including reading sensitive data, creating or deleting resources, and disrupting service operations — via crafted gRPC requests.

authorisationproblemOWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-32298 - CRITICAL
17/03/2026

The Angeet ES3 KVM does not properly sanitize user-supplied variables parsed by the 'cfg.lua' script, allowing an authenticated attacker to execute OS-level commands.

oscommandinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-32296 - HIGH
17/03/2026

Sipeed NanoKVM before 2.3.1 exposes a Wi-Fi configuration endpoint without proper security checks, allowing an unauthenticated attacker with network access to change the saved configured Wi-Fi network to one of the attacker's choosing, or craft a request to exhaust the system memory and terminate the KVM process.

authorisationproblemOWSAP: A07

Plus d'informations avec CVE Find

CVE-2026-25770 - CRITICAL
17/03/2026

Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 3.9.0 and prior to version 4.14.3, a privilege escalation vulnerability exists in the Wazuh Manager's cluster synchronization protocol. The `wazuh-clusterd` service allows authenticated nodes to write arbitrary files to the manager’s file system with the permissions of the `wazuh` sy...

directorytraversalpriviliegemanagementOWSAP: A01OWSAP: A04

Plus d'informations avec CVE Find

CVE-2026-25769 - CRITICAL
17/03/2026

Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.0.0 through 4.14.2 have a Remote Code Execution (RCE) vulnerability due to Deserialization of Untrusted Data). All Wazuh deployments using cluster mode (master/worker architecture) and any organization with a compromised worker node (e.g., through initial access, insider threat, or supply chain...

OWSAP: A08

Plus d'informations avec CVE Find

CVE-2026-25534 - CRITICAL
17/03/2026

### Impact Spinnaker updated URL Validation logic on user input to provide sanitation on user inputted URLs for clouddriver. However, they missed that Java URL objects do not correctly handle underscores on parsing. This led to a bypass of the previous CVE (CVE-2025-61916) through the use of carefully crafted URLs. Note, Spinnaker found this not just in that CVE, but in the existing URL validat...

ssrfOWSAP: A10

Plus d'informations avec CVE Find

CVE-2026-4148 - HIGH
17/03/2026

A use-after-free vulnerability can be triggered in sharded clusters by an authenticated user with the read role who issues a specially crafted $lookup or $graphLookup aggregation pipeline.

memorycorruption

Plus d'informations avec CVE Find

CVE-2026-4318 - HIGH
17/03/2026

A vulnerability was determined in UTT HiPER 810G up to 1.7.7-171114. Affected is the function strcpy of the file /goform/formApLbConfig. This manipulation of the argument loadBalanceNameOld causes buffer overflow. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

overflow

Plus d'informations avec CVE Find

CVE-2026-3564 - CRITICAL
17/03/2026

A condition in ScreenConnect may allow an actor with access to server-level cryptographic material used for authentication to obtain unauthorized access, including elevated privileges, in certain scenarios.

OWSAP: A02

Plus d'informations avec CVE Find

CVE-2026-4312 - CRITICAL
17/03/2026

GCB/FCB Audit Software developed by DrangSoft has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access certain APIs to create a new administrative account.

authorisationproblemOWSAP: A07

Plus d'informations avec CVE Find

CVE-2026-0708 - HIGH
17/03/2026

A flaw was found in libucl. A remote attacker could exploit this by providing a specially crafted Universal Configuration Language (UCL) input that contains a key with an embedded null byte. This can cause a segmentation fault (SEGV fault) in the `ucl_object_emit` function when parsing and emitting the object, leading to a Denial of Service (DoS) for the affected system.

overflow

Plus d'informations avec CVE Find