PatchFirst · Vulnérabilités récentes
Suivez les nouveaux avis par pile, produit et version installée. Vulnérabilités publiées ou ayant fait l’objet d’une escalade au cours des 30 derniers jours : 20968. Présentes dans KEV : 90.
Signalements récents de vulnérabilités issus des annonces des éditeurs et de l’actualité de la sécurité. Ces alertes ne modifient pas la note de sécurité.
Selon OpenNet, Node.js présente une vulnérabilité d’exécution de code à distance (CVE-2026-111497). Les versions exactes affectées ne sont pas précisées. Le message ne précise pas de version corrigée.
Que faire maintenant : Vérifiez si une mise à jour de sécurité de Node.js contenant le correctif est disponible et installez-la.
CVE-2026-111497
Selon GitHub Advisory Database, Node.js présente une vulnérabilité de déni de service (CVE-2026-109932). Les versions exactes affectées ne sont pas précisées. Le message ne précise pas de version corrigée.
Que faire maintenant : Vérifiez si une mise à jour de sécurité de Node.js contenant le correctif est disponible et installez-la.
CVE-2026-109932
Selon OpenNet, PHP présente une vulnérabilité d’exécution de code à distance (CVE-2026-115560). Les versions exactes affectées ne sont pas précisées. Le message ne précise pas de version corrigée.
Que faire maintenant : Vérifiez si une mise à jour de sécurité de PHP contenant le correctif est disponible et installez-la.
CVE-2026-115560
Vulnérabilités : 489859
Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.4.
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13.
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.26.
Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Frontend: from n/a through 4.3.13.
MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stm_lms_send_test_email_ajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via cross-site request forgery to cause an uncaught PHP fatal error that, when display_errors is enabled, discloses the absolute filesystem path of the plugin.
MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stm_lms_step parameter passed to the stm_lms_import_sample_data AJAX action, which lacks capability checks and nonce verification. Attackers can traverse the file system to reference a reachable WXR file and have the handler publish its contained posts under their identity, enabling publication of attacker-chosen post type, title, content, and metadata.
Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized read and write access to data of other deployments on the same host via Symlink Attack (CAPEC-132).
Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of platform-level settings via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user with read-only access to the platform can change an installation-wide account setting that only platform administrators are permitted to change.
Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to credential disclosure via Retrieve Embedded Sensitive Data (CAPEC-37). ECE stores runtime information about platform service containers in a location that lower-privileged platform components can read, and this information includes secrets from the container configuration. An attacker with access to the internal ECE platform services can obtain these secrets, which include role tokens. A role token can let the attacker add an unauthorized host to the installation with the roles of that token.
Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to unauthorized disclosure and loss of data belonging to other deployments on the same host via Symlink Attack (CAPEC-132).
Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to authentication bypass and unauthorized changes to the configuration of other deployments on the same host via Symlink Attack (CAPEC-132).
Insertion of Sensitive Information into Externally-Accessible File or Directory (CWE-538) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Retrieve Embedded Sensitive Data (CAPEC-37). After the ECE certificate rotation procedure runs, data that it retains contains platform credentials and certificate authority private keys, and lower-privileged platform components can read this data. An attacker who controls any host in the installation can use this data to get full control of the ECE control plane and of the deployments that it manages.
Authorization Bypass Through User-Controlled Key (CWE-639) in Elastic Cloud Enterprise (ECE) can lead to privilege escalation via Privilege Abuse (CAPEC-122). An attacker who controls any host in an ECE installation can obtain credentials that are reserved for other platform roles. These credentials can give the attacker full control of the ECE control plane and of the deployments that it manages.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine allows SQL Injection.This issue affects JetEngine: from n/a through 3.9.0.1.
This update for python313 fixes the following issues: - CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111). - CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223). - CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226). - CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext instances can cause use-after-free (bsc#1283969). - CVE-2026-19553: omitted server_hostname arguments in wrap_bio() can cause silent hostname verification bypasses (bsc#1283826). - CV
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force SureForms sureforms allows Code Injection.This issue affects SureForms: from n/a through 2.12.9.
A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occurs when the policy is configured to allow loopback addresses, as Keycloak resolves hostnames via DNS during validation. An attacker can bypass domain allowlist restrictions by using a hostname that resolves to a loopback address, potentially allowing the registration of unauthorized redirect URIs.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brave Brave brave-popup-builder allows Code Injection.This issue affects Brave: from n/a through 0.8.8.
Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kali Forms: from n/a through 2.4.27.
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ThemeGrill User Registration user-registration allows Code Injection.This issue affects User Registration: from n/a through 5.3.0.
Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.