Priorisation des failles exploitées et accès rapide aux avis éditeurs utiles à l’infrastructure.
GPUStack // GPUStack
GPUStack contains an improper authentication vulnerability which could allow unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml.
[ Ouvrir la fiche NVD ↗ ]OpenBSD // OpenSSH
OpenBSD OpenSSH on Linux contains an unexpected status code or return value vulnerability that could allow for authentication bypass.
[ Ouvrir la fiche NVD ↗ ]SignalWire // FreeSwitch
SignalWire FreeSwitch contains a code injection vulnerability that permits configuration and credential disclosure, arbitrary call control, and command execution.
[ Ouvrir la fiche NVD ↗ ]SonicWall // SonicOS SSLVPN
SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).
[ Ouvrir la fiche NVD ↗ ]Apple // Multiple Products
Apple iOS, iPadOS, macOS, Safari, tvOS and watchOS 10.5 contain an improper authentication vulnerability which could allow an attacker with arbitrary read and write capability to bypass pointer authentication.
[ Ouvrir la fiche NVD ↗ ]WordPress // WordPress Core
WordPress WordPress Core contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that could allow unauthenticated attackers to execute code on the server during the upgrade window. This is due to predictable, web-accessible staging paths used during full-package core upgrades.
[ Ouvrir la fiche NVD ↗ ]Ivanti // Connect Secure
Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.
[ Ouvrir la fiche NVD ↗ ]Ivanti // Connect Secure
Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.
[ Ouvrir la fiche NVD ↗ ]GitLab // Community Edition and Enterprise Edition
GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
[ Ouvrir la fiche NVD ↗ ]Cisco // Secure Firewall ASA Software and Cisco Secure FTD Software
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
[ Ouvrir la fiche NVD ↗ ]Broadcom // VMware ESX
Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.
[ Ouvrir la fiche NVD ↗ ]Linux // Kernel
Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.
[ Ouvrir la fiche NVD ↗ ]Adobe // Commerce and Magento
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.
[ Ouvrir la fiche NVD ↗ ]Google // Brotli
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
[ Ouvrir la fiche NVD ↗ ]PHP Group // PHP
PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
[ Ouvrir la fiche NVD ↗ ]PHP Group // PHP
PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.
[ Ouvrir la fiche NVD ↗ ]Arista // VeloCloud Orchestrator
Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
[ Ouvrir la fiche NVD ↗ ]Collabora // Collabora Online – Built-in CODE Server
Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.
[ Ouvrir la fiche NVD ↗ ]EG Secure Solutions // SiteGuard Server Edition
EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
[ Ouvrir la fiche NVD ↗ ]Plex // Media Server
Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
[ Ouvrir la fiche NVD ↗ ]Sources centrales pour identifier les vulnérabilités, confirmer l’exploitation connue et approfondir les détails techniques.
CISA
Catalogue des vulnérabilités connues comme ayant été exploitées dans la nature.
[ Ouvrir la ressource ↗ ]NIST
Base de vulnérabilités enrichie avec recherche, références et données techniques.
[ Ouvrir la ressource ↗ ]CVE Program
Catalogue de référence des identifiants CVE et des enregistrements associés.
[ Ouvrir la ressource ↗ ]GitHub
Base d’avis de sécurité pour les dépendances, projets et écosystèmes logiciels.
[ Ouvrir la ressource ↗ ]OffSec
Archive publique de références et preuves de concept liées à des vulnérabilités.
[ Ouvrir la ressource ↗ ]Ressources Microsoft pour suivre les correctifs, avis de sécurité et mises à jour affectant Windows, Microsoft 365 et l’écosystème Microsoft.
Microsoft
Portail Microsoft consacré aux vulnérabilités, avis et informations du Security Response Center.
[ Ouvrir la ressource ↗ ]Microsoft
Guide Microsoft pour rechercher les vulnérabilités et mises à jour de sécurité publiées.
[ Ouvrir la ressource ↗ ]Microsoft Learn
Documentation Microsoft sur les fonctions de gestion des vulnérabilités de Defender.
[ Ouvrir la ressource ↗ ]Avis éditeur Fortinet et renseignements PSIRT pour FortiOS, FortiGate, FortiAnalyzer et les autres produits Fortinet.
Fortinet
Portail des avis de sécurité Fortinet et des vulnérabilités affectant ses produits.
[ Ouvrir la ressource ↗ ]Fortinet
Ressources Fortinet consacrées à la sécurité de ses produits et à son processus de réponse.
[ Ouvrir la ressource ↗ ]Avis et ressources de sécurité pour Aruba Central, AOS-CX, Aruba Instant et les produits HPE Aruba Networking.
HPE Aruba Networking
Portail de soutien HPE Networking pour la documentation, les téléchargements et les avis associés aux produits réseau.
[ Ouvrir la ressource ↗ ]HPE Aruba Networking
Point d’accès aux bulletins et avis de sécurité Aruba Networking.
[ Ouvrir la ressource ↗ ]Avis de sécurité pour VMware vCenter, ESXi et les produits VMware maintenant publiés dans l’écosystème Broadcom.
Broadcom / VMware
Portail Broadcom pour consulter les avis de sécurité de produits VMware.
[ Ouvrir la ressource ↗ ]Broadcom
Portail de soutien Broadcom pour les produits, documents et informations de maintenance.
[ Ouvrir la ressource ↗ ]Sources pour suivre les vulnérabilités qui touchent les systèmes Linux et les dépendances open source.
Canonical
Avis de sécurité Canonical pour les paquets et versions Ubuntu supportées.
[ Ouvrir la ressource ↗ ]Red Hat
Portail Red Hat consacré aux mises à jour, avis et vulnérabilités de sécurité.
[ Ouvrir la ressource ↗ ]GitHub
Avis couvrant plusieurs écosystèmes et dépendances de projets open source.
[ Ouvrir la ressource ↗ ]Une présence dans CISA KEV indique une exploitation connue, mais la priorité réelle dépend aussi de l’exposition et des actifs présents dans votre environnement. Pour corriger une vulnérabilité, utilisez toujours les avis et correctifs officiels de l’éditeur.