Protégez vos données, renforcez Votre Cybersécurité

CVE-2026-21333 - HIGH
10/03/2026

Illustrator versions 29.8.4, 30.1 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

OWSAP: A08

Plus d'informations avec CVE Find

CVE-2026-31824 - HIGH
10/03/2026

Sylius is an Open Source eCommerce Framework on Symfony. A Time-of-Check To Time-of-Use (TOCTOU) race condition was discovered in the promotion usage limit enforcement. The same class of vulnerability affects the promotion usage limit (the global used counter on Promotion entities), coupon usage limit (the global used counter on PromotionCoupon entities), and coupon per-customer usage limit (the p...

Plus d'informations avec CVE Find

CVE-2026-31817 - HIGH
10/03/2026

OliveTin gives access to predefined shell commands from a web interface. Prior to 3000.11.2, when the saveLogs feature is enabled, OliveTin persists execution log entries to disk. The filename used for these log files is constructed in part from the user-supplied UniqueTrackingId field in the StartAction API request. This value is not validated or sanitized before being used in a file path, allowi...

directorytraversalOWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-30966 - CRITICAL
10/03/2026

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.7 and 8.6.20, Parse Server's internal tables, which store Relation field mappings such as role memberships, can be directly accessed via the REST API or GraphQL API by any client using only the application key. No master key is required. An attacker can create, read, update,...

OWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-0123 - HIGH
10/03/2026

In EfwApTransport::ProcessRxRing of efw_ap_transport.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

overflow

Plus d'informations avec CVE Find

CVE-2026-0122 - HIGH
10/03/2026

In multiple places, there is a possible out of bounds write due to memory corruption. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

overflow

Plus d'informations avec CVE Find

CVE-2026-28495 - CRITICAL
10/03/2026

GetSimple CMS is a content management system. The massiveAdmin plugin (v6.0.3) bundled with GetSimpleCMS-CE v3.3.22 allows an authenticated administrator to overwrite the gsconfig.php configuration file with arbitrary PHP code via the gsconfig editor module. The form lacks CSRF protection, enabling a remote unauthenticated attacker to exploit this via Cross-Site Request Forgery against a logged-in...

csrfOWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-27825 - CRITICAL
10/03/2026

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to version 0.17.0, the `confluence_download_attachment` MCP tool accepts a `download_path` parameter that is written to without any directory boundary enforcement. An attacker who can call this tool and supply or access a Confluence attachment with malicious content can write arbitrary conten...

directorytraversalOWSAP: A01OWSAP: A04

Plus d'informations avec CVE Find

CVE-2025-48611 - CRITICAL
10/03/2026

In DeviceId of DeviceId.java, there is a possible desync in persistence due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Plus d'informations avec CVE Find

CVE-2026-28292 - CRITICAL
10/03/2026

`simple-git`, an interface for running git commands in any node.js application, has an issue in versions 3.15.0 through 3.32.2 that allows an attacker to bypass two prior CVE fixes (CVE-2022-25860 and CVE-2022-25912) and achieve full remote code execution on the host machine. Version 3.23.0 contains an updated fix for the vulnerability.

oscommandinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-27826 - HIGH
10/03/2026

MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to version 0.17.0, an unauthenticated attacker who can reach the mcp-atlassian HTTP endpoint can force the server process to make outbound HTTP requests to an arbitrary attacker-controlled URL by supplying two custom HTTP headers without an `Authorization` header. No authentication is require...

ssrfOWSAP: A10

Plus d'informations avec CVE Find

CVE-2026-3847 - HIGH
10/03/2026

Memory safety bugs present in Firefox 148.0.2. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 148.0.2.

overflowmemorycorruption

Plus d'informations avec CVE Find

CVE-2026-3845 - HIGH
10/03/2026

Heap buffer overflow in the Audio/Video: Playback component in Firefox for Android. This vulnerability affects Firefox < 148.0.2.

Plus d'informations avec CVE Find

CVE-2026-3843 - CRITICAL
10/03/2026

Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 on Linux contains a SQL Injection vulnerability (CWE-89) in the system configuration module. A remote attacker can send specially crafted HTTP POST requests to the /php/request.php endpoint via the sql parameter in application/x-www-form-urlencoded data (e.g., action=do&sql=&reload_driver=0) to execute arbitrary SQL comm...

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-30957 - CRITICAL
10/03/2026

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, OneUptime Synthetic Monitors allow a low-privileged authenticated project user to execute arbitrary commands on the oneuptime-probe server/container. The root cause is that untrusted Synthetic Monitor code is executed inside Node's vm while live host-realm Playwright browser and page objects are exposed to it. A...

Plus d'informations avec CVE Find

CVE-2026-30956 - CRITICAL
10/03/2026

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, a low‑privileged user can bypass authorization and tenant isolation in OneUptime v10.0.20 and earlier by sending a forged is-multi-tenant-query header together with a controlled projectid header. Because the server trusts this client-supplied header, internal permission checks in BasePermission are skipped and...

authorisationproblemOWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-30944 - HIGH
10/03/2026

StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.0, the /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user (at least Editor) to generate API tokens for any other user, including owner and admin accounts. The endpoint fails to validate whether the requesting user is authorized to create tokens on behalf of the target user ID...

authorisationproblemOWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-30934 - HIGH
10/03/2026

FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-beta and 1.2.2-stable, Stored XSS is possible via share metadata fields (e.g., title, description) that are rendered into HTML for /public/share/ without context-aware escaping. The server uses text/template instead of html/template, allowing injected scripts to execute when victims visit the share URL. This v...

crosssitescriptingOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-26118 - HIGH
10/03/2026

Server-side request forgery (ssrf) in Azure MCP Server allows an authorized attacker to elevate privileges over a network.

ssrfOWSAP: A10

Plus d'informations avec CVE Find

CVE-2026-26116 - HIGH
10/03/2026

Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find