Perché il monitoraggio delle vulnerabilità è critico per la vostra azienda
Nel 2025, 48 185 nuove vulnerabilità (CVE) sono state pubblicate, un aumento del 20% rispetto al 2024. Ogni giorno, più di 130 falle vengono rese pubbliche, alcune delle quali riguardano i software che la vostra azienda utilizza quotidianamente.
Secondo il Verizon Data Breach Investigations Report, il 60% delle violazioni dei dati sfrutta vulnerabilità per le quali esisteva già una patch al momento dell'attacco. Nessun team IT può seguire manualmente 130 CVE al giorno.
Avec CVE Find, explorez la plus grande base de données de vulnérabilités au monde.
Le CVE (Common Vulnerabilities and Exposures) est une liste de failles de sécurité informatique divulguées publiquement. Le programme CVE a pour objectif de faciliter le partage des données entre les différentes capacités de détection des vulnérabilités, qu'il s'agisse d'outils, de bases de données ou de services. Il fournit également une norme pour évaluer la couverture de ces outils et services.
Accédez à CVE Find
Cosa fa CVE Find per voi
Come essere avvisati in tempo reale?
CVE Find vi notifica tramite e-mail e SMS non appena una vulnerabilità riguarda i vostri prodotti. Frequenza configurabile: dall'avviso istantaneo al riepilogo mensile.
I miei software sono vulnerabili?
Configurate i vostri prodotti (CMS, server, librerie) tramite il catalogo CPE. CVE Find monitora continuamente la base MITRE e vi avvisa automaticamente. 338 000+ CVE indicizzati.
Come priorizzare le correzioni?
Il punteggio CVSS (gravità) e EPSS (probabilità di sfruttamento reale) vi indicano cosa correggere per primo, senza falsi positivi.
Quali falle vengono attivamente sfruttate?
Il catalogo CISA KEV integrato identifica le vulnerabilità già sfruttate nella realtà. Queste sono le falle da correggere con priorità assoluta.
La piattaforma è disponibile in italiano?
CVE Find è disponibile in francese, inglese e tedesco. La piattaforma è sviluppata in Svizzera da Bexxo.
I dati sono affidabili e aggiornati?
Sincronizzazione in tempo reale con MITRE, NVD, CISA e FIRST.org: la base viene arricchita ogni ora.
Rimani sempre un passo avanti con le ultime vulnerabilità critiche di sicurezza.
CVE-2026-57853 - HIGH
04/11/2026
DataGerry before 3.3.0 contains a server-side template injection vulnerability that allows authenticated attackers with base.docapi.template.add permission to store arbitrary Jinja2 payloads in the template_data field via POST /rest/docapi/template, which is later rendered in a non-sandboxed Jinja2 environment when a user calls GET /rest/docapi/template/
crosssitescriptingOWSAP: A03
CVE-2026-92704 - HIGH
04/11/2026
SharpEmu is an experimental PlayStation 5 emulator for Windows and Linux. In version 0.0.3-release.3 and earlier, the repository-provided debugger frontend tooling is vulnerable while running. This tooling is not included in the release archives. The frontend exposes an HTTP API on 127.0.0.1:8765 without authentication or CSRF token. Its do_POST handler in tools/SharpEmu.DebuggerFrontend/deb...
authorisationproblemcsrfOWSAP: A07OWSAP: A01
CVE-2026-121966 - HIGH
04/11/2026
Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url requests) through an auth-server connection pool shared by all clients, exposing connection-bound NTLM or Negotiate authentication. An unauthenticated attacker can reuse another user's authenticated connection, receiving the victim's identity via authResponseHeaders to access backend...
CVE-2026-121958 - HIGH
04/11/2026
FreeRDP through 3.32.1 has a heap out-of-bounds write in the RDPGFX client because the delete_surface callback truncates surface hash keys to 16 bits, leaving the surface table inconsistent so HashTable_GetKeys writes past its allocated key array. A malicious or man-in-the-middle RDP server can exploit this by creating surfaceId 0xFFFF, closing the RDPGFX channel, sending repeated DELETESURFACE PD...
CVE-2026-121953 - CRITICAL
04/11/2026
FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel with a new ChannelId overwrites the listener's single callback slot, which rdpgfx_on_close frees without clearing. A malicious RDP server can open and close such a channel, then send a PDU on the original channel to crash the client or potentially execute code.
memorycorruption
CVE-2026-121952 - CRITICAL
04/11/2026
FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdp_read_bitmap_cache_v2_capability_set rejects only numCellCaches values above 5, yet the bitmap cache v2 cell array is later accessed at fixed indices 0 through 4. A client connecting to the proxy can declare fewer than five cell caches in its Confirm Active, causing heap corruption, heap data leakage to the backend, or a cras...
overflow
CVE-2026-122006 - CRITICAL
04/11/2026
The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server read and write operations (e.g., reading secret_key_base) because the ImageMagick analyzer runs when a file is attached, and there is not an ImageMagick security policy to block unintended functionality.
CVE-2026-65555 - CRITICAL
04/11/2026
Incorrect Privilege Assignment vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit allows Privilege Escalation.This issue affects Uncanny Toolkit for LearnDash: from n/a through 3.8.2.
priviliegemanagementOWSAP: A04
CVE-2026-121940 - HIGH
04/11/2026
Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows authenticated users to access other users' projects by supplying unscoped object ids. Attackers can enumerate auto-increment ids on /api/project, /api/asset and /api/script handlers to read, overwrite, cascade-delete data, and add themselves as project members.
authorisationproblemOWSAP: A01
CVE-2026-119481 - CRITICAL
04/11/2026
Incorrect Privilege Assignment vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Privilege Escalation.This issue affects JetFormBuilder: from n/a through 3.6.7.1.
priviliegemanagementOWSAP: A04
CVE-2026-121147 - HIGH
04/11/2026
This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL certificate pinning in the network security configuration, resulting in ineffective certificate pinning controls. An attacker positioned to intercept network traffic could exploit this vulnerability to intercept or modify communications between the application and its backend services.
authorisationproblemOWSAP: A07
CVE-2026-104799 - HIGH
04/11/2026
The Mobile builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.4.2 via the `wcfmmp_profile_settings()` REST handler exposed at `POST /mobile-builder/v1/wcfm-profile-settings`. This is due to a PHP loose-comparison logic flaw in the meta key allow-list check — `strpos( $key, 'mobile_builder' ) == 0` evaluates to `true` for any key that does *...
priviliegemanagementOWSAP: A04
CVE-2026-120554 - HIGH
04/11/2026
The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.5.11 This is due to a non-atomic multi-option write sequence in the `ACUI_Cron::save_settings()` function, which persists `acui_cron_activated`, `acui_cron_configured_by`, `acui_cron_user_id`, and `acui_cron_path_to_file` before reaching the authorization gat...
authorisationproblemOWSAP: A01
CVE-2026-110022 - HIGH
04/11/2026
The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them via reflection, but the deployment routine processes archive entries that were never covered by the signature verification. An unauthenticated local attacker can replace an unsigned DLL outside the signed prefix in the archive passes verification and overwrites...
OWSAP: A08
CVE-2026-110935 - HIGH
04/11/2026
The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository. Archive entries containing relative path segments such as '..' are not rejected, allowing an unauthenticated local attacker to write files outside the plugin repository to arbitrary locations accessible with the current user's permissions which could result ...
directorytraversalOWSAP: A01
CVE-2026-114421 - HIGH
04/11/2026
SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose initial password is empty without adequately verifying ownership. A remote unauthenticated attacker who identifies such an account can set a new password, authenticate as that account, and prevent the intended recipient from using it until recovery.
OWSAP: A07
CVE-2026-114425 - CRITICAL
04/11/2026
SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer attachment metadata. An unauthenticated remote sender can cause the mail-processing worker to disclose, move, or delete an accessible regular file when LFT is enabled and the message reaches an affected secure-mail processing path. The validated workers ran as root.
OWSAP: A04
CVE-2026-121816 - HIGH
04/11/2026
Herowatch Mini developed by About Time Technologies has a Missing Authentication vulnerability. Unauthenticated remote attackers can connect to the affected device's ADB service and obtain an ADB shell, thereby accessing device resources or performing related operations.
authorisationproblemOWSAP: A07
CVE-2026-121818 - HIGH
04/11/2026
Herowatch Mini developed by About Time Technologies has a system signing vulnerability. Authenticated local attackers can exploit a publicly available test key to sign malicious programs, allowing them to elevate privileges and execute arbitrary code.
CVE-2026-87040 - HIGH
04/11/2026
The nRF link-layer receive paths of the open-source Bluetooth LE Controller did not validate the on-air LENGTH field of a received PDU against the maximum receive length that was used to program the radio. isr_rx_pdu() in subsys/bluetooth/controller/ll_sw/nordic/lll/lll_conn.c enqueued any non-empty data PDU after only the sequence-number and (for encrypted links) MIC checks, and the corresponding...
overflow
