Veille de sécurité · Menaces actives

Explorer le catalogue → Analyses Bulletins Éditeurs Méthode

DERNIÈRE SYNCHRONISATION · 27 oct. 2026, 08:00 · SOURCES PUBLIQUES

CATALOGUE KEV · il y a 2 heures // SCORES EPSS/CVSS · il y a 2 heures // VEILLE · il y a 4 minutes // INFRASTRUCTURE C2 · il y a 2 heures // CERT-FR (ANSSI) · il y a 2 heures

Liées au ransomware ET à forte probabilité d'exploitation (EPSS ≥ 50 %)

CVE-2021-21985 100%

VMware · vCenter Server

CVE-2021-22005 100%

VMware · vCenter Server

CVE-2019-11510 100%

Ivanti · Pulse Connect Secure

CVE-2021-34473 100%

Microsoft · Exchange Server

CVE-2019-0708 100%

Microsoft · Remote Desktop Services

CVE-2018-13379 100%

Fortinet · FortiOS

CVE-2021-35464 100%

ForgeRock · Access Management (AM)

CVE-2020-5902 100%

F5 · BIG-IP

CVE-2026-109619 PHP Group · PHP· Utilisation après libération (use-after-free) 100% 26 oct. 2026 CVE-2026-109618 PHP Group · PHP· Utilisation après libération (use-after-free) 100% 26 oct. 2026 CVE-2026-110447 Collabora · Collabora Online – Built-in CODE Server· Injection de commande système (OS) 12% 23 oct. 2026 CVE-2026-114625 Arista · VeloCloud Orchestrator· Injection SQL 1% 23 oct. 2026 CVE-2026-110936 Siemens · Software Center· CWE-427 1% 20 oct. 2026 CVE-2026-96652 Plex · Media Server· Falsification de requête côté serveur (SSRF) 2% 20 oct. 2026 CVE-2026-96654 Plex · Media Server· CWE-84 2% 20 oct. 2026 CVE-2026-96655 Plex · Media Server· Falsification de requête côté serveur (SSRF) 2% 20 oct. 2026 CVE-2026-96656 Plex · Media Server· CWE-73 2% 20 oct. 2026 CVE-2026-106931 EG Secure Solutions · SiteGuard Server Edition· Injection de commande système (OS) 3% 20 oct. 2026 CVE-2025-61624 Fortinet · Multiple Products· Traversée de répertoire 1% 16 oct. 2026 CVE-2026-102764 BeyondTrust · Remote Support· CWE-290 20% 16 oct. 2026

Agrégat de sources publiques · titre + extrait + lien vers la source

The Hacker Newsdans 4 heures

Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses

The Computer Emergency Response Team of Ukraine (CERT-UA) has issued an alert warning of unauthorized remote access to video surveillance systems manufactured by Dahua. "Cases of compromising IP cameras and DVRs with ac...

The Hacker Newsdans 2 heures

CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday confirmed active exploitation of the recently patched PHP2Shell flaws by adding them to its Known Exploited Vulnerabilities (KEV) catalog. The P...

@cveNotifyil y a 43 minutes

🚨 CVE-2026-75891The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and in...

🚨 CVE-2026-75891The Kirki plugin for WordPress is vulnerable to Privilege Escalation via PHP Object Injection in all versions up to, and including, 6.2.5 via deserialization of untrusted input through the 'get-single-symbol' branch of the...

@cveNotifyil y a 43 minutes

🚨 CVE-2026-110910### Summary`qs.stringify` with `allowEmptyArrays: true` writes the key of an empty array without encoding it, even though...

🚨 CVE-2026-110910### Summary`qs.stringify` with `allowEmptyArrays: true` writes the key of an empty array without encoding it, even though keys are encoded by default. A key that contains `&` (or the configured `delimiter`), `=`, or `#` ∴...

@cveNotifyil y a 43 minutes

🚨 CVE-2026-106174A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attac...

🚨 CVE-2026-106174A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface...

@cveNotifyil y a 43 minutes

🚨 CVE-2026-105946Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remot...

🚨 CVE-2026-105946Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remote attackers to obtain sensitive information (heap memory contents) or cause a denial of service (app...

@cveNotifyil y a 43 minutes

🚨 CVE-2026-103359The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify the authenticity of incoming payme...

🚨 CVE-2026-103359The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify the authenticity of incoming payment notifications and, until the gateway is configured, authenticates them with a value derived from...

@cveNotifyil y a 43 minutes

🚨 CVE-2026-103325The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment...

🚨 CVE-2026-103325The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validating the request signature against a key that is always empty, which allows unauthen...

@cveNotifyil y a 1 heure

🚨 CVE-2026-117472Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a har...

🚨 CVE-2026-117472Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed path. In deployments configured with URL_PREFIX, the comparison failed and the PO...

@cveNotifyil y a 1 heure

🚨 CVE-2026-117471Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device...

🚨 CVE-2026-117471Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote at...

@cveNotifyil y a 1 heure

🚨 CVE-2026-117470Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification...

🚨 CVE-2026-117470Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticated remote attacker who possessed the user's password and one captured valid WebAut...

@cveNotifyil y a 1 heure

🚨 CVE-2026-117469Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-rep...

🚨 CVE-2026-117469Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a...

@cveNotifyil y a 1 heure

🚨 CVE-2026-117468Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a d...

🚨 CVE-2026-117468Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An authenticated remote attacker holding a restricted API key-derived session could clai...

@cveNotifyil y a 1 heure

🚨 CVE-2026-111820The Analytics Insights – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Stored Cross-Site...

🚨 CVE-2026-111820The Analytics Insights – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Page Title in all versions up to, and including, 6.3.12 due to insufficient input...

@cveNotifyil y a 1 heure

🚨 CVE-2026-103332The Payex Payment Gateway for Woocommerce WordPress plugin through 1.2.10 does not properly verify the authenticity of inc...

🚨 CVE-2026-103332The Payex Payment Gateway for Woocommerce WordPress plugin through 1.2.10 does not properly verify the authenticity of incoming payment notifications, relying on a validation secret that is empty by default, allowing unaut...

@cveNotifyil y a 1 heure

🚨 CVE-2026-103312The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the authenticity of incoming payment notifica...

🚨 CVE-2026-103312The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the authenticity of incoming payment notifications on a stock install, because the callback's checksum is keyed on a merchant secret that is empt...

@cveNotifyil y a 1 heure

🚨 CVE-2026-116638The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls,...

🚨 CVE-2026-116638The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administrator-configured UEFI/BIOS passwords. An attacker with physical or administrative...

@cveNotifyil y a 1 heure

🚨 CVE-2026-116370A security flaw has been discovered in 2K Games Sid Meier's Civilization VI 1.0.12.68. The affected element is the functio...

🚨 CVE-2026-116370A security flaw has been discovered in 2K Games Sid Meier's Civilization VI 1.0.12.68. The affected element is the function loadstring of the component Lua sandbox. Performing a manipulation results in type confusion. The...