Priorisation des failles exploitées et accès rapide aux avis éditeurs utiles à l’infrastructure.
Ivanti // Connect Secure
Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.
[ Ouvrir la fiche NVD ↗ ]Ivanti // Connect Secure
Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.
[ Ouvrir la fiche NVD ↗ ]GitLab // Community Edition and Enterprise Edition
GitLab Community Edition and Enterprise Edition contain a integer overflow or wraparound vulnerability that could allow an unauthenticated user to execute arbitrary code on the GitLab server via a specially crafted regular expression in a CI/CD configuration, due to insufficient regular expression validation.
[ Ouvrir la fiche NVD ↗ ]Cisco // Secure Firewall ASA Software and Cisco Secure FTD Software
Cisco Secure Firewall ASA Software and Cisco Secure FTD Software contains an unchecked return value to NULL pointer dereference vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.
[ Ouvrir la fiche NVD ↗ ]Broadcom // VMware ESX
Broadcom VMWare ESX contains an insufficient logging vulnerability that could allow a malicious actor with admin access to perform certain operations without being logged.
[ Ouvrir la fiche NVD ↗ ]Linux // Kernel
Linux Kernel contains a missing initialization of a variable vulnerability that could allow for unintended modification of page-cache-backed data via failure to preserve the shared-fragment marker during socket buffer coalescing, causing ESP input processing to decrypt shared fragments in place. This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.
[ Ouvrir la fiche NVD ↗ ]Adobe // Commerce and Magento
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session.
[ Ouvrir la fiche NVD ↗ ]Google // Brotli
Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
[ Ouvrir la fiche NVD ↗ ]PHP Group // PHP
PHP contains an out-of-memory corruption vulnerability that allows for unauthenticated remote code execution.
[ Ouvrir la fiche NVD ↗ ]PHP Group // PHP
PHP contains a stale internal request-state vulnerability that allows for unauthenticated remote code execution.
[ Ouvrir la fiche NVD ↗ ]Arista // VeloCloud Orchestrator
Arista VeloCloud Orchestrator on-prem contains a SQL injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.
[ Ouvrir la fiche NVD ↗ ]Collabora // Collabora Online – Built-in CODE Server
Collabora Collabora Online – Built-in CODE Server when used within the NextCloud platform contains an OS command injection vulnerability that allows for remote code execution when the CODE server isn't running.
[ Ouvrir la fiche NVD ↗ ]EG Secure Solutions // SiteGuard Server Edition
EG Secure Solutions SiteGuard Server Edition contains an OS command injection vulnerability which may allow an attacker to execute arbitrary OS commands with root or SYSTEM privileges on the system running the affected product.
[ Ouvrir la fiche NVD ↗ ]Plex // Media Server
Plex Media Server contains an external control of file name or path vulnerability which can allow an admin user to write arbitrary files that may be executed on load. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655.
[ Ouvrir la fiche NVD ↗ ]Plex // Media Server
Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.
[ Ouvrir la fiche NVD ↗ ]Plex // Media Server
Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.
[ Ouvrir la fiche NVD ↗ ]Plex // Media Server
Plex Media Server contains a server-side request forgery (SSRF) vulnerability which could allow an attacker using any X-Plex-Token value to include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. This vulnerability can be chained with CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656.
[ Ouvrir la fiche NVD ↗ ]Siemens // Software Center
Siemens Software Center contains an uncontrolled search path element vulnerability that could allow an authenticated local attacker to place a specially crafted DLL in a directory that the application searches, leading to arbitrary code execution with the privileges of the affected application.
[ Ouvrir la fiche NVD ↗ ]BeyondTrust // Remote Support
BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.
[ Ouvrir la fiche NVD ↗ ]Fortinet // Multiple Products
FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
[ Ouvrir la fiche NVD ↗ ]Sources centrales pour identifier les vulnérabilités, confirmer l’exploitation connue et approfondir les détails techniques.
CISA
Catalogue des vulnérabilités connues comme ayant été exploitées dans la nature.
[ Ouvrir la ressource ↗ ]NIST
Base de vulnérabilités enrichie avec recherche, références et données techniques.
[ Ouvrir la ressource ↗ ]CVE Program
Catalogue de référence des identifiants CVE et des enregistrements associés.
[ Ouvrir la ressource ↗ ]GitHub
Base d’avis de sécurité pour les dépendances, projets et écosystèmes logiciels.
[ Ouvrir la ressource ↗ ]OffSec
Archive publique de références et preuves de concept liées à des vulnérabilités.
[ Ouvrir la ressource ↗ ]Ressources Microsoft pour suivre les correctifs, avis de sécurité et mises à jour affectant Windows, Microsoft 365 et l’écosystème Microsoft.
Microsoft
Portail Microsoft consacré aux vulnérabilités, avis et informations du Security Response Center.
[ Ouvrir la ressource ↗ ]Microsoft
Guide Microsoft pour rechercher les vulnérabilités et mises à jour de sécurité publiées.
[ Ouvrir la ressource ↗ ]Microsoft Learn
Documentation Microsoft sur les fonctions de gestion des vulnérabilités de Defender.
[ Ouvrir la ressource ↗ ]Avis éditeur Fortinet et renseignements PSIRT pour FortiOS, FortiGate, FortiAnalyzer et les autres produits Fortinet.
Fortinet
Portail des avis de sécurité Fortinet et des vulnérabilités affectant ses produits.
[ Ouvrir la ressource ↗ ]Fortinet
Ressources Fortinet consacrées à la sécurité de ses produits et à son processus de réponse.
[ Ouvrir la ressource ↗ ]Avis et ressources de sécurité pour Aruba Central, AOS-CX, Aruba Instant et les produits HPE Aruba Networking.
HPE Aruba Networking
Portail de soutien HPE Networking pour la documentation, les téléchargements et les avis associés aux produits réseau.
[ Ouvrir la ressource ↗ ]HPE Aruba Networking
Point d’accès aux bulletins et avis de sécurité Aruba Networking.
[ Ouvrir la ressource ↗ ]Avis de sécurité pour VMware vCenter, ESXi et les produits VMware maintenant publiés dans l’écosystème Broadcom.
Broadcom / VMware
Portail Broadcom pour consulter les avis de sécurité de produits VMware.
[ Ouvrir la ressource ↗ ]Broadcom
Portail de soutien Broadcom pour les produits, documents et informations de maintenance.
[ Ouvrir la ressource ↗ ]Sources pour suivre les vulnérabilités qui touchent les systèmes Linux et les dépendances open source.
Canonical
Avis de sécurité Canonical pour les paquets et versions Ubuntu supportées.
[ Ouvrir la ressource ↗ ]Red Hat
Portail Red Hat consacré aux mises à jour, avis et vulnérabilités de sécurité.
[ Ouvrir la ressource ↗ ]GitHub
Avis couvrant plusieurs écosystèmes et dépendances de projets open source.
[ Ouvrir la ressource ↗ ]Une présence dans CISA KEV indique une exploitation connue, mais la priorité réelle dépend aussi de l’exposition et des actifs présents dans votre environnement. Pour corriger une vulnérabilité, utilisez toujours les avis et correctifs officiels de l’éditeur.