FACTUALRISK Cyber Intelligence
Mise à jour : 12 Oct 2026 · 06:01
P0 35P1 11KEV 30EPSS 6
← Accueil
🗞 Briefing
💥 Menaces▾
💥 Attaques🦠 Ransomware📡 Exploitation🕵️ Acteurs🌍 Géopolitique📰 News
🛡 Vulnérabilités▾
🛡 Dashboard CVE🗃 Base CVE🔧 Patches⛓ Supply Chain
📋 Conformité▾
📋 Compliance🎯 IOC Tracker📈 Statistiques
📚 Guides🛰 Agent Vigie
← Retour FactualRisk
P0 — Urgence
35
KEV + signal fort
KEV exploité
30
14j: 11 nouveaux
EPSS élevé
6
≥ 0.20 (exploitation probable)
Total findings
207
Top 300 • tri score
⚠️ P0 • CVE-2015-5477 • ISC BIND — ISC BIND Data Processing Errors Vulnerability • P0 • CVE-2015-3306 • ProFTPD ProFTPD — ProFTPD Improper Access Control Vulnerability • P0 • CVE-2016-3081 • Apache Struts — Apache Struts Command Injection Vulnerability • P0 • CVE-2026-71362 • Adobe Commerce and Magento — Adobe Commerce and Magento Incorrect Authorization Vulnerability • P0 • CVE-2026-104286 • Fortinet FortiMail — Fortinet FortiMail Path Traversal Vulnerability • P0 • CVE-2026-88771 • Citrix NetScaler — Citrix NetScaler Improper Input Validation Vulnerability • P0 • CVE-2026-76504 • Cisco Catalyst SD-WAN Manager — Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability • P0 • CVE-2026-102489 • Zammad GmbH Zammad — Zammad GmbH Zammad Session Fixation Vulnerability • P0 • CVE-2026-86950 • Apple Multiple Products — Apple Multiple Products Out-of-Bounds Write Vulnerability • P0 • CVE-2026-102490 • Zammad GmbH Zammad — Zammad GmbH Zammad Improper Privilege Management Vulnerability • P0 • CVE-2026-107406 • — Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway • P0 • CVE-2026-88779 • Citrix NetScaler — Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability • P0 • CVE-2026-76461 • Cisco Secure Email Gateway — Cisco Secure Email Gateway SQL Injection Vulnerability • P0 • CVE-2025-39682 • Linux Kernel — Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability • P0 • CVE-2026-87902 • WordPress Core — WordPress Core Remote File Inclusion Vulnerability • P0 • CVE-2026-93616 • Check Point Multiple Products — Check Point Multiple Products Path Traversal Vulnerability • P0 • CVE-2026-105133 • — OTX Pulse : Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer • P0 • CVE-2021-3199 • ONLYOFFICE Docs — ONLYOFFICE Docs Server Path Traversal Vulnerability
World Clocksmaj 1s
Status Sourceslatence
• CISA KEV0.15s
• OSV.dev0.42s
🐙 GHSA1.36s
📋 NVD32.09s
📊 EPSS2.88s
🦠 Ransomware.live17.06s
💣 Exploit-DB0.44s
• AlienVault OTX12.42s
📡 GreyNoise1.82s
🔗 URLhaus0.07s
🗺️ MITRE CVE0.10s
✅ VulnCheck Community1.12s
• Security Social0.07s
• Enhanced Vendor Feeds4.52s
• Press/Buzz1.71s
Tendances 7 jours KEV P0 P1 EPSS↑
Top Vendors
go62
pip20
Ubuntu13
npm7
composer7
Citrix3
Cisco3
Linux3
Zammad GmbH2
Check Point2
maven2
rubygems2
Top CWEs
CWE-20013
CWE-40011
CWE-8639
CWE-228
CWE-207
CWE-6397
CWE-896
CWE-6136
🧩 CMS & E-commerceWordPress, Presta…
WordPress1
Magento1
🌐 Threat Intel — 7 derniers jours
Chargement threat intel…
⌕
P1 P2 KEV only EPSS≥0.20 REMOTE PoC CRITICAL 🆕 Nouveaux
Visible: --
Heatmap CVSS × EPSS (visible)survol = détail CVE
★ Prio CVE Sev CVSS EPSS Score Vendor Produit CWE Description Signaux
P0 CVE-2015-5477 MAJ HIGH 7.5 0.994 269.3 ISC BIND CWE-19 ISC BIND Data Processing Errors Vulnerability KEV EPSS↑ 🦠 RANSOM 🗺 ATT&CK
P0 CVE-2015-3306 MAJ CRITICAL 10.0 0.995 257.4 ProFTPD ProFTPD CWE-284 ProFTPD Improper Access Control Vulnerability KEV EPSS↑ 🗺 ATT&CK
P0 CVE-2016-3081 MAJ HIGH 8.1 0.961 238.9 Apache Struts CWE-77 Apache Struts Command Injection Vulnerability KEV EPSS↑ CWE! 🗺 ATT&CK
P0 CVE-2026-71362 CRITICAL 9.1 0.875 229.6 Adobe Commerce and Magento CWE-863 Adobe Commerce and Magento Incorrect Authorization Vulnerability KEV EPSS↑ 🧩 MAGENTO 🗺 ATT&CK
P0 CVE-2026-104286 MAJ CRITICAL 9.8 0.022 184.4 Fortinet FortiMail CWE-22 Fortinet FortiMail Path Traversal Vulnerability KEV CWE! 🗺 ATT&CK
P0 CVE-2026-88771 CRITICAL 9.8 0.011 183.1 Citrix NetScaler CWE-20 Citrix NetScaler Improper Input Validation Vulnerability KEV CWE! 🗺 ATT&CK
P0 CVE-2026-76504 CRITICAL 9.8 0.018 179.0 Cisco Catalyst SD-WAN Manager CWE-177 Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability KEV 🗺 ATT&CK
P0 CVE-2026-102489 MAJ CRITICAL 9.8 0.013 178.3 Zammad GmbH Zammad CWE-384 Zammad GmbH Zammad Session Fixation Vulnerability KEV 🗺 ATT&CK
P0 CVE-2026-86950 HIGH 8.8 0.012 177.3 Apple Multiple Products CWE-787 Apple Multiple Products Out-of-Bounds Write Vulnerability KEV CWE! 🗺 ATT&CK
P0 CVE-2026-102490 MAJ HIGH 7.8 0.005 175.5 Zammad GmbH Zammad CWE-269 Zammad GmbH Zammad Improper Privilege Management Vulnerability KEV ⛓ SUPPLY 🗺 ATT&CK
P0 CVE-2026-107406 NOUVEAU CRITICAL 9.5 0.005 170.6 CWE-119 Critical Zero-Day Vulnerabilities Exploited in Citrix NetScaler ADC, Gateway CWE! 📡 ITW 📣 MÉDIATISÉ ×3 🗺 ATT&CK
P0 CVE-2026-88779 MAJ HIGH 7.5 0.006 168.7 Citrix NetScaler CWE-119 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability KEV CWE! 🗺 ATT&CK
P0 CVE-2026-76461 CRITICAL 9.8 0.283 167.7 Cisco Secure Email Gateway CWE-89 Cisco Secure Email Gateway SQL Injection Vulnerability KEV EPSS↑ CWE! 🗺 ATT&CK
P0 CVE-2025-39682 MAJ CRITICAL 9.8 0.029 167.3 Linux Kernel NVD-CWE-Other Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability KEV 🦠 RANSOM
P0 CVE-2026-87902 HIGH 8.1 0.400 166.6 WordPress Core CWE-98 WordPress Core Remote File Inclusion Vulnerability KEV EPSS↑ 🧩 WORDPRESS 🗺 ATT&CK
P0 CVE-2026-93616 CRITICAL 9.8 0.197 157.4 Check Point Multiple Products CWE-22 Check Point Multiple Products Path Traversal Vulnerability KEV CWE! 🗺 ATT&CK
P0 CVE-2026-105133 MAJ HIGH 7.3 0.004 157.3 CWE-287 OTX Pulse : Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer CWE! 📡 ITW 📣 MÉDIATISÉ ×2 🗺 ATT&CK
P0 CVE-2021-3199 MAJ CRITICAL 9.8 0.194 157.0 ONLYOFFICE Docs CWE-22 ONLYOFFICE Docs Server Path Traversal Vulnerability KEV CWE! 🗺 ATT&CK
P0 CVE-2026-76460 MAJ CRITICAL 10.0 0.140 146.8 Cisco Identity Services Engine CWE-648 Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability KEV 🗺 ATT&CK
P0 CVE-2026-105134 MAJ CRITICAL 10.0 0.018 140.2 CWE-77 OTX Pulse : Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer CWE! 📡 ITW 🗺 ATT&CK
P0 CVE-2026-85102 CRITICAL 9.8 0.075 137.9 Check Point Multiple Products CWE-295 Check Point Multiple Products Improper Certificate Validation Vulnerability KEV 🗺 ATT&CK
P0 CVE-2026-93952 CRITICAL 10.0 0.011 136.3 Arista VeloCloud Orchestrator CWE-20 Arista VeloCloud Orchestrator Improper Input Validation Vulnerability KEV CWE! 🗺 ATT&CK
P0 CVE-2026-94127 CRITICAL 9.8 0.022 131.5 F5 BIG-IP APM CWE-122 F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability KEV 🗺 ATT&CK
P0 CVE-2026-5430 CRITICAL 10.0 0.006 130.7 WSO2 Multiple Products CWE-347 WSO2 Multiple Products Path Traversal Vulnerability KEV 🗺 ATT&CK
P0 CVE-2026-65660 HIGH 8.8 0.021 130.3 Microsoft SharePoint CWE-94 Microsoft SharePoint Code Injection Vulnerability KEV CWE! 🗺 ATT&CK
P0 CVE-2026-7273 HIGH 8.8 0.025 125.8 Zyxel GS1900 Series Switches CWE-121 Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability KEV 🗺 ATT&CK
P0 CVE-2026-88772 HIGH 8.1 0.013 125.2 Citrix NetScaler CWE-119 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability KEV CWE! 🗺 ATT&CK
P0 CVE-2026-53266 HIGH 8.8 0.008 123.8 Linux Kernel NVD-CWE-noinfo Linux Kernel Out-of-Bounds Write Vulnerability KEV
P0 CVE-2026-58704 MAJ HIGH 8.8 0.006 123.5 Google Pixel CWE-285 Google Pixel Improper Authorization Vulnerability KEV 🗺 ATT&CK
P0 CVE-2025-39964 HIGH 7.8 0.013 118.3 Linux Kernel CWE-362 Linux Kernel Race Condition Vulnerability KEV
P0 CVE-2023-22894 MAJ HIGH 7.2 0.036 117.5 Strapi Strapi CWE-312 Strapi Cleartext Storage of Sensitive Information Vulnerability KEV 🗺 ATT&CK
P0 CVE-2026-87886 HIGH 7.8 0.002 117.1 Acronis Backup CWE-276 Acronis Backup Incorrect Default Permissions Vulnerability KEV
P0 CVE-2026-84409 HIGH 7.5 0.004 110.5 CWE-79 Lantronix G520 Series Cellular Gateway CWE! 🦠 RANSOM 📡 ITW 🗺 ATT&CK
P1 CVE-2026-67279 MEDIUM 6.5 0.010 110.2 MikroTik RouterOS CWE-841 Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability KEV 🗺 ATT&CK
P0 CVE-2026-107810 NOUVEAU HIGH 8.1 0.004 109.0 go github.com/0xJacky/Nginx-UI CWE-59 Nginx UI: Backup restore follows crafted symlinks into the live Nginx configuration path before restore flags are applied 🦠 RANSOM 📡 ITW
P0 CVE-2026-107716 NOUVEAU MEDIUM 7.3 0.001 109.0 pip banks CWE-22 Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry CWE! 🦠 RANSOM 📡 ITW 🗺 ATT&CK
P2 GHSA-p4h8-xg7f-xqrc MAJ HIGH 6.5 0.000 99.0 go github.com/go-vikunja/vikunja CWE-400 Duplicate Advisory: Vikunja: Denial of service via decompression bomb in the data import 🦠 RANSOM 📡 ITW
P2 GHSA-jmr8-r558-3jhx MAJ MEDIUM 4.3 0.000 85.8 go code.vikunja.io/api CWE-522 Duplicate Advisory: Vikunja: TOTP secret is readable after enrollment, no step-up auth 🦠 RANSOM 📡 ITW 🗺 ATT&CK
P2 CVE-2026-107726 NOUVEAU CRITICAL 9.3 0.004 71.3 maven com.hazelcast:hazelcast CWE-20 Hazelcast allows arbitrary member memory access by low-privileged client CWE! ⛓ SUPPLY 🗺 ATT&CK
P2 CVE-2026-108261 NOUVEAU CRITICAL 9.3 0.002 66.0 npm tinacms CWE-346 TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment ⛓ SUPPLY 🗺 ATT&CK
P1 CVE-2026-96587 CRITICAL 10.0 0.003 65.4 CWE-798 Viidure Dashcam Android Application CWE! 🗺 ATT&CK
P1 CVE-2026-105697 NOUVEAU CRITICAL 9.9 0.004 64.9 pip langflow CWE-78 Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration CWE! 🗺 ATT&CK
P1 CVE-2026-100730 NOUVEAU CRITICAL 9.8 0.006 64.5 CWE-502 Grid Protection Alliance openPDC and openHistorian CWE! 🗺 ATT&CK
P1 CVE-2026-15340 NOUVEAU CRITICAL 9.8 0.006 64.5 CWE-120 Savannah lwIP SMTP client CWE! 🗺 ATT&CK
P2 CVE-2026-108259 NOUVEAU HIGH 8.2 0.003 64.5 npm @tinacms/cli CWE-94 Tina: Code injection via unescaped Git branch name in generated client source CWE! ⛓ SUPPLY 🗺 ATT&CK
P1 CVE-2026-105278 NOUVEAU CRITICAL 9.8 0.003 64.2 CWE-798 Grid Protection Alliance openPDC and openHistorian CWE! 🗺 ATT&CK
P1 CVE-2026-103630 MAJ CRITICAL 9.6 0.003 63.0 CWE-416 Long Term Support Channel Update for ChromeOS CWE! 🗺 ATT&CK
P2 CVE-2026-107725 NOUVEAU HIGH 8.7 0.004 62.7 maven com.hazelcast:hazelcast CWE-862 Hazelcast has an authorization bypass in IMap Predicates API ⛓ SUPPLY 🗺 ATT&CK
P2 CVE-2026-95102 MAJ CRITICAL 9.4 0.003 61.8 CWE-306 Monta monta.app CWE! 🗺 ATT&CK
P2 CVE-2026-107806 NOUVEAU CRITICAL 9.4 0.003 61.8 go github.com/0xJacky/Nginx-UI CWE-94 Nginx UI: Authenticated Remote Code Execution via Backup Restore App Config Overwrite CWE! 🗺 ATT&CK
P2 CVE-2026-107845 NOUVEAU CRITICAL 9.3 0.003 61.1 composer contao/comments-bundle CWE-79 Contao: Cross-site scripting in the comments bundle CWE! 🗺 ATT&CK
P3 CVE-2026-108260 NOUVEAU HIGH 7.6 0.002 60.9 npm @tinacms/web-components CWE-79 @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS CWE! ⛓ SUPPLY 🗺 ATT&CK
P3 CVE-2026-72046 NOUVEAU LOW 0.0 0.007 60.8 Ubuntu — USN-8905-2: Linux kernel (GCP) vulnerabilities 🦠 RANSOM 📡 ITW
P1 CVE-2026-102255 NOUVEAU CRITICAL 10.0 0.005 60.6 CWE-441 Max severity SonicWall SMA1000 flaw now exploited in attacks 🗺 ATT&CK
P1 CVE-2026-71379 CRITICAL 10.0 0.004 60.5 CWE-552 Toptech TMS7 and TopHAT
P3 CVE-2026-91979 NOUVEAU HIGH 0.0 0.004 60.5 go code.vikunja.io/api CWE-400 Vikunja: Denial of service via decompression bomb in the data import 🦠 RANSOM 📡 ITW
P2 CVE-2026-94591 MAJ HIGH 8.4 0.001 60.5 CWE-321 Armatura LLC Armatura One ⛓ SUPPLY 🗺 ATT&CK
P3 CVE-2026-100294 HIGH 7.5 0.002 60.3 CWE-798 Anjvision YSSD-RTMP-H5 CWE! ⛓ SUPPLY 🗺 ATT&CK
P3 CVE-2025-68296 NOUVEAU LOW 0.0 0.002 60.2 Ubuntu — USN-8903-2: Linux kernel vulnerabilities 🦠 RANSOM 📡 ITW
P3 CVE-2025-68768 NOUVEAU LOW 0.0 0.002 60.2 Ubuntu — USN-8903-2: Linux kernel vulnerabilities 🦠 RANSOM 📡 ITW
P2 CVE-2026-70356 CRITICAL 9.1 0.004 60.1 CWE-434 Toptech TMS7 and TopHAT CWE! 🗺 ATT&CK
P3 CVE-2026-86138 NOUVEAU HIGH 7.8 0.001 60.0 Ubuntu CWE-190 USN-8910-1: libxml2 vulnerabilities CWE! 🗺 ATT&CK
P1 CVE-2026-84411 MAJ CRITICAL 9.8 0.009 59.9 CWE-191 MikroTik RouterOS 🗺 ATT&CK
P3 CVE-2026-107720 NOUVEAU HIGH 7.4 0.003 59.7 npm fast-jwt CWE-20 fast-jwt: createVerifier accepts unsigned JWTs when key is '' or null and algorithms is explicitly set CWE! ⛓ SUPPLY 🗺 ATT&CK
P2 CVE-2026-55797 NOUVEAU HIGH 8.8 0.015 59.7 go github.com/argoproj/argo-cd/v2 CWE-78 Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL CWE! 🗺 ATT&CK
P2 CVE-2026-68068 CRITICAL 9.0 0.003 59.4 CWE-89 Toptech TMS7 and TopHAT CWE! 🗺 ATT&CK
P2 CVE-2026-72510 CRITICAL 9.0 0.003 59.4 CWE-89 Toptech TMS7 and TopHAT CWE! 🗺 ATT&CK
P2 CVE-2026-68954 CRITICAL 9.0 0.003 59.4 CWE-89 Toptech TMS7 and TopHAT CWE! 🗺 ATT&CK
P2 CVE-2026-72507 CRITICAL 9.0 0.003 59.4 CWE-89 Toptech TMS7 and TopHAT CWE! 🗺 ATT&CK
P2 CVE-2026-63713 CRITICAL 9.0 0.003 59.4 CWE-89 Toptech TMS7 and TopHAT CWE! 🗺 ATT&CK
P1 CVE-2026-100291 CRITICAL 9.8 0.003 59.2 CWE-1188 Anjvision YSSD-RTMP-H5 🗺 ATT&CK
P2 CVE-2026-100292 HIGH 8.8 0.003 58.1 CWE-78 Anjvision YSSD-RTMP-H5 CWE! 🗺 ATT&CK
P2 CVE-2026-107809 NOUVEAU HIGH 8.8 0.002 58.0 go github.com/0xJacky/Nginx-UI CWE-352 Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs CWE! 🗺 ATT&CK
P2 CVE-2026-21589 NOUVEAU CRITICAL 9.3 0.018 57.9 CWE-552 Atlassian Data Center Flaw Draws Exploitation Attempts Within Two Hours of Public Details
P2 CVE-2026-7395 HIGH 8.5 0.002 56.3 CWE-306 Hitachi Energy Asset Suite CWE! 🗺 ATT&CK
P3 CVE-2026-107826 NOUVEAU HIGH 7.5 0.005 55.5 go github.com/corazawaf/coraza/v3 CWE-674 Coraza JSON body processor: argument-limit truncation reopens an unbounded-depth gjson.Valid stack overflow (process crash) ⛓ SUPPLY
P2 CVE-2026-94592 MAJ HIGH 8.4 0.001 55.5 CWE-798 Armatura LLC Armatura One CWE! 🗺 ATT&CK
P3 CVE-2026-94204 HIGH 7.5 0.003 55.3 CWE-732 Viidure Dashcam Android Application ⛓ SUPPLY 🗺 ATT&CK
P2 CVE-2026-95372 HIGH 8.3 0.004 55.3 CWE-416 Long Term Support Channel Update for ChromeOS CWE! 🗺 ATT&CK
P3 CVE-2026-91191 HIGH 7.5 0.002 55.2 CWE-347 Lantronix G520 Series Cellular Gateway ⛓ SUPPLY 🗺 ATT&CK
P2 CVE-2026-102324 HIGH 8.3 0.003 55.1 CWE-416 Long Term Support Channel Update for ChromeOS CWE! 🗺 ATT&CK
P2 CVE-2026-107808 NOUVEAU HIGH 8.1 0.004 54.1 go github.com/0xJacky/Nginx-UI CWE-287 Nginx UI: Authentication bypass: password login does not enforce a passkey-only second factor (2FA bypass) CWE! 🗺 ATT&CK
P2 GHSA-68w4-83fh-f2w8 MAJ HIGH 8.1 0.000 53.6 pip pyload-ng CWE-287 pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password CWE! 🗺 ATT&CK
P2 GHSA-r44w-v6gf-x3p6 MAJ HIGH 8.1 0.000 53.6 pip pyload-ng CWE-287 pyLoad has an authentication bypass in API key validation (check_apikey cache) CWE! 🗺 ATT&CK
P2 CVE-2026-96940 MAJ HIGH 8.8 0.005 53.4 CWE-1390 Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes 🗺 ATT&CK
P2 CVE-2026-107811 NOUVEAU HIGH 8.8 0.004 53.2 go github.com/0xJacky/Nginx-UI CWE-200 0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser 🗺 ATT&CK
P2 CVE-2026-104629 NOUVEAU HIGH 8.8 0.003 53.2 CWE-470 Grid Protection Alliance openPDC and openHistorian
P2 CVE-2026-107813 NOUVEAU HIGH 8.8 0.003 53.2 go github.com/0xJacky/Nginx-UI CWE-862 Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up
P2 CVE-2026-107807 NOUVEAU HIGH 8.8 0.003 53.2 go github.com/0xJacky/Nginx-UI CWE-312 Nginx UI: Node Secret Credential Exposure via URL Query Parameter 🗺 ATT&CK
P2 CVE-2026-100298 HIGH 8.8 0.003 53.1 CWE-522 Anjvision YSSD-RTMP-H5 🗺 ATT&CK
P2 CVE-2026-100293 HIGH 8.8 0.002 53.0 CWE-347 Anjvision YSSD-RTMP-H5 🗺 ATT&CK
P3 CVE-2026-107715 NOUVEAU MEDIUM 6.8 0.004 51.3 rubygems mechanize CWE-200 Mechanize sends credential headers to another host after an HTTP redirect ⛓ SUPPLY 🗺 ATT&CK
P3 CVE-2026-107399 NOUVEAU MEDIUM 6.8 0.004 51.2 rubygems mechanize CWE-200 Mechanize sends credential headers to another origin after a meta refresh ⛓ SUPPLY 🗺 ATT&CK
P3 CVE-2026-75032 NOUVEAU MEDIUM 6.3 0.002 51.1 Ubuntu CWE-125 USN-8908-1: BlueZ vulnerabilities CWE! 🗺 ATT&CK
P3 CVE-2026-19774 NOUVEAU HIGH 7.1 0.003 50.9 Ubuntu CWE-121 USN-8908-1: BlueZ vulnerabilities
P3 CVE-2026-105281 NOUVEAU HIGH 7.5 0.003 50.4 CWE-306 Grid Protection Alliance openPDC and openHistorian CWE! 🗺 ATT&CK
P3 CVE-2026-62367 NOUVEAU HIGH 7.5 0.001 50.1 go code.vikunja.io/api CWE-287 Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover CWE! 🗺 ATT&CK
P2 CVE-2026-68581 NOUVEAU HIGH 8.1 0.005 49.2 go code.vikunja.io/api CWE-863 Vikunja: Link-share principal ID collision allows cross-account API token issuance and management
P3 CVE-2025-1647 MAJ MEDIUM 5.6 0.004 49.1 npm bootstrap CWE-79 Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components CWE! ⛓ SUPPLY 🗺 ATT&CK
P2 CVE-2026-100296 HIGH 8.1 0.003 49.0 CWE-754 Anjvision YSSD-RTMP-H5 🗺 ATT&CK
P2 CVE-2026-39460 NOUVEAU HIGH 8.1 0.003 49.0 CWE-522 Red Lion Controls N-Tron 700 Series 🗺 ATT&CK
P2 CVE-2026-57458 NOUVEAU HIGH 8.1 0.003 48.9 go code.vikunja.io/api CWE-269 Vikunja: Scoped API token can mint unrestricted OAuth session credentials 🗺 ATT&CK
P2 CVE-2026-62376 NOUVEAU HIGH 8.1 0.002 48.9 go code.vikunja.io/api CWE-312 Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access 🗺 ATT&CK
P2 GHSA-9jrx-vmh8-c6xw MAJ HIGH 8.1 0.000 48.6 go code.vikunja.io/api CWE-863 Duplicate Advisory: Vikunja: Link-share principal ID collision allows cross-account API token issuance and management
P3 CVE-2026-94593 MAJ HIGH 7.8 0.001 46.9 CWE-532 Armatura LLC Armatura One 🗺 ATT&CK
P3 CVE-2026-107718 NOUVEAU MEDIUM 6.1 0.003 46.9 npm @adonisjs/http-server CWE-601 AdonisJS: Unencoded route parameters can produce open redirects ⛓ SUPPLY 🗺 ATT&CK
P3 CVE-2026-108258 NOUVEAU MEDIUM 6.9 0.004 46.8 pip shiny CWE-22 Shiny for Python has path traversal in bookmark restore CWE! 🗺 ATT&CK
P3 CVE-2024-8176 HIGH 7.5 0.014 46.6 CWE-674 Hitachi Energy REB500 🗺 ATT&CK
P3 CVE-2026-101104 HIGH 7.7 0.003 46.5 CWE-862 Meari IoT Cloud Platform OpenAPI Service
P3 CVE-2026-107394 NOUVEAU MEDIUM 6.8 0.003 46.2 pip indico CWE-918 Indico: Incomplete Server-Side Request Forgery (SSRF) check CWE! 🗺 ATT&CK
P3 CVE-2026-107805 NOUVEAU HIGH 7.5 0.004 45.5 go github.com/0xJacky/Nginx-UI CWE-400 Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage 🗺 ATT&CK
P3 CVE-2026-107840 NOUVEAU HIGH 7.5 0.004 45.5 go github.com/jhaals/yopass CWE-400 yopass Prometheus metrics middleware allows remote memory exhaustion through unbounded method labels 🗺 ATT&CK
P3 CVE-2026-76216 NOUVEAU HIGH 7.5 0.004 45.4 go code.vikunja.io/api CWE-639 Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure
P3 CVE-2026-107728 NOUVEAU HIGH 7.5 0.004 45.4 pip strawberry-graphql CWE-863 Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy
P3 CVE-2026-107839 NOUVEAU HIGH 7.5 0.003 45.4 go github.com/luskaner/ageLANServer/server CWE-400 ageLANServer: Unbounded JSON Array Allocation in AoE3 Cloud `getFileURL` Endpoint Leads to Remote Denial of Service 🗺 ATT&CK
P3 CVE-2026-97363 MAJ HIGH 7.5 0.003 45.4 CWE-307 Monta monta.app 🗺 ATT&CK
P3 CVE-2026-107812 NOUVEAU HIGH 7.5 0.002 45.2 go github.com/0xJacky/Nginx-UI CWE-494 Nginx UI: Self-upgrade runs an unsigned binary verified only by a same-origin digest → RCE via a compromised mirror or MITM 🗺 ATT&CK
P3 GHSA-p2vv-wrh8-x466 MAJ HIGH 7.5 0.000 45.0 go code.vikunja.io/api CWE-307 Duplicate Advisory: Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords 🗺 ATT&CK
P3 GHSA-37rx-7pj5-p885 MAJ HIGH 7.5 0.000 45.0 go code.vikunja.io/api CWE-200 Duplicate Advisory: Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level 🗺 ATT&CK
P3 GHSA-m4vj-wr5q-cmvr MAJ HIGH 7.5 0.000 45.0 go github.com/go-vikunja/vikunja CWE-307 Duplicate Advisory: Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited 🗺 ATT&CK
P3 GHSA-9xwc-vwww-qqmw MAJ HIGH 7.5 0.000 45.0 go code.vikunja.io/api CWE-639 Duplicate Advisory: Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure
P3 GHSA-jq7h-wrvp-3rgx MAJ HIGH 7.5 0.000 45.0 pip pyload-ng CWE-613 pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session 🗺 ATT&CK
P3 GHSA-889w-m37p-88m5 MAJ HIGH 7.5 0.000 45.0 pip pyload-ng CWE-613 pyLoad: Api.set_user_permission never invalidates the target's session
P3 CVE-2026-96274 HIGH 7.4 0.002 44.6 CWE-248 Baicells Nova 430H
P3 CVE-2026-48484 NOUVEAU MEDIUM 6.5 0.003 44.4 pip pyload-ng CWE-20 pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination CWE! 🗺 ATT&CK
P3 CVE-2026-107717 NOUVEAU MEDIUM 6.5 0.003 44.3 pip banks CWE-20 Banks: User-controlled prompt input can be parsed as privileged chat messages CWE! 🗺 ATT&CK
P3 CVE-2026-97212 MAJ HIGH 7.3 0.002 44.1 CWE-613 Monta monta.app
P3 CVE-2026-64893 HIGH 7.3 0.001 43.9 CWE-319 Johnson Controls EasyIO Neo Series EC and CW Controllers
P3 GHSA-p3pr-8f3m-4qp8 MAJ MEDIUM 6.4 0.000 43.4 pip pyload-ng CWE-918 pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host CWE! 🗺 ATT&CK
P3 CVE-2026-71302 HIGH 7.1 0.003 42.9 CWE-384 Toptech TMS7 and TopHAT 🗺 ATT&CK
P3 CVE-2023-20585 MAJ MEDIUM 5.6 0.001 41.7 Ubuntu CWE-788 USN-8887-3: Linux kernel vulnerabilities
P3 CVE-2022-3114 MAJ MEDIUM 5.5 0.002 41.3 Ubuntu CWE-476 USN-8875-2: Linux kernel (NVIDIA) vulnerabilities
P3 CVE-2026-76781 NOUVEAU MEDIUM 5.5 0.002 41.2 Ubuntu CWE-476 USN-8910-1: libxml2 vulnerabilities
P3 CVE-2026-32645 NOUVEAU MEDIUM 6.0 0.001 41.1 CWE-798 Red Lion Controls N-Tron 700 Series CWE! 🗺 ATT&CK
P3 CVE-2026-100299 MEDIUM 6.8 0.001 40.9 CWE-1391 Anjvision YSSD-RTMP-H5 🗺 ATT&CK
P3 CVE-2026-96613 MEDIUM 6.5 0.002 39.3 CWE-862 Meari IoT Cloud Platform OpenAPI Service 🗺 ATT&CK
P3 CVE-2026-93474 MAJ MEDIUM 6.5 0.002 39.2 CWE-522 Monta monta.app 🗺 ATT&CK
P3 GHSA-hjx8-qv73-f7cm MAJ MEDIUM 6.5 0.000 39.0 go code.vikunja.io/api CWE-613 Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed
P3 GHSA-4hv6-xc92-j86g MAJ MEDIUM 6.5 0.000 39.0 go code.vikunja.io/api CWE-613 Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes 🗺 ATT&CK
P3 GHSA-c2g7-39fr-cp8q MAJ HIGH 6.5 0.000 39.0 go code.vikunja.io/api CWE-770 Duplicate Advisory: Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API 🗺 ATT&CK
P3 GHSA-55p4-8j34-jv53 MAJ HIGH 6.5 0.000 39.0 go code.vikunja.io/api CWE-400 Duplicate Advisory: Vikunja: Unbounded CSV row cardinality permits API process termination 🗺 ATT&CK
P3 GHSA-jfw3-2gcf-23r5 MAJ HIGH 6.5 0.000 39.0 go code.vikunja.io/api CWE-674 Duplicate Advisory: Vikunja: Unbounded nested task-filter recursion permits API process termination 🗺 ATT&CK
P3 GHSA-69rj-q3v9-vffp MAJ HIGH 6.5 0.000 39.0 go code.vikunja.io/api CWE-400 Duplicate Advisory: Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification
P3 GHSA-p4r4-8cxw-pjx7 MAJ CRITICAL 6.5 0.000 39.0 go code.vikunja.io/api CWE-639 Duplicate Advisory: Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
P3 CVE-2026-27873 MEDIUM 5.6 0.001 38.7 CWE-798 Johnson Controls EasyIO FG CWE! 🗺 ATT&CK
P3 CVE-2026-15952 MEDIUM 6.4 0.001 38.5 CWE-732 ABB Protection and Control IED Manager PCM600 🗺 ATT&CK
P3 CVE-2026-64892 MEDIUM 6.3 0.002 38.1 CWE-200 Johnson Controls EasyIO Neo Series EC and CW Controllers 🗺 ATT&CK
P3 CVE-2026-100295 MEDIUM 6.3 0.002 38.0 CWE-489 Anjvision YSSD-RTMP-H5 🗺 ATT&CK
P3 CVE-2026-107844 NOUVEAU MEDIUM 5.3 0.003 37.2 composer contao/core-bundle CWE-22 Contao: Path traversal in the images controller CWE! 🗺 ATT&CK
P3 CVE-2026-85479 NOUVEAU MEDIUM 5.3 0.003 37.1 CWE-306 Grid Protection Alliance openPDC and openHistorian CWE! 🗺 ATT&CK
P3 CVE-2026-100297 MEDIUM 5.3 0.002 37.0 CWE-918 Anjvision YSSD-RTMP-H5 CWE! 🗺 ATT&CK
P3 CVE-2026-11796 MEDIUM 5.1 0.002 35.9 CWE-306 Hitachi Energy Asset Suite CWE! 🗺 ATT&CK
P3 CVE-2026-107833 NOUVEAU MEDIUM 5.9 0.004 35.9 go github.com/corazawaf/coraza/v3 CWE-674 Coraza: Unbounded recursion in JSON response body processor causes CPU exhaustion
P3 CVE-2026-107719 NOUVEAU MEDIUM 4.2 0.002 35.5 npm fast-jwt CWE-613 fast-jwt: Verifier cache accepts expired JWTs without iat. ⛓ SUPPLY 🗺 ATT&CK
P3 CVE-2026-15953 MEDIUM 5.0 0.001 35.1 CWE-22 ABB Protection and Control IED Manager PCM600 CWE! 🗺 ATT&CK
P3 CVE-2026-107841 NOUVEAU MEDIUM 5.7 0.002 34.5 pip pacioli-guard CWE-863 pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents 🗺 ATT&CK
P3 CVE-2026-27872 MEDIUM 5.6 0.001 33.7 CWE-269 Johnson Controls EasyIO FG 🗺 ATT&CK
P3 CVE-2026-107396 NOUVEAU MEDIUM 5.4 0.002 32.6 pip indico CWE-692 Indico: Cross-Site-Scripting in link fields
P3 GHSA-pjr3-86v4-5p7w MAJ MEDIUM 5.4 0.000 32.4 go code.vikunja.io/api CWE-269 Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)
P3 GHSA-fprf-r6rv-xg99 MAJ MEDIUM 5.4 0.000 32.4 go code.vikunja.io/api CWE-863 Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants
P3 CVE-2026-107834 NOUVEAU MEDIUM 5.3 0.003 32.2 go github.com/corazawaf/coraza/v3 CWE-400 Coraza: Resource exhaustion via deferred file handle accumulation in multipart body processor 🗺 ATT&CK
P3 CVE-2026-75597 NOUVEAU MEDIUM 5.3 0.003 32.2 pip pyload-ng CWE-209 pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo 🗺 ATT&CK
P3 CVE-2026-107842 NOUVEAU MEDIUM 5.3 0.003 32.1 composer contao/core-bundle CWE-200 Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
P3 CVE-2026-107843 NOUVEAU MEDIUM 5.3 0.003 32.1 composer contao/core-bundle CWE-204 Contao: The registration module re-sends activation mails 🗺 ATT&CK
P3 CVE-2026-107804 NOUVEAU MEDIUM 5.3 0.002 32.1 go github.com/0xJacky/Nginx-UI CWE-346 Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout 🗺 ATT&CK
P3 CVE-2026-107397 NOUVEAU MEDIUM 4.4 0.002 31.7 pip indico CWE-79 Indico: Cross-Site-Scripting in minutes editor CWE! 🗺 ATT&CK
P3 CVE-2026-101022 NOUVEAU MEDIUM 4.3 0.002 31.0 CWE-918 Grid Protection Alliance openPDC and openHistorian CWE! 🗺 ATT&CK
P3 CVE-2026-107825 NOUVEAU MEDIUM 4.0 0.003 29.3 go github.com/corazawaf/coraza/v3 CWE-20 Coraza: ProcessURI silently drops QUERY_STRING and ARGS_GET on URI parse failure — defense-in-depth bypass for non-net/http integrations CWE! 🗺 ATT&CK
P3 CVE-2026-71189 LOW 3.5 0.002 26.2 CWE-79 Toptech TMS7 and TopHAT CWE! 🗺 ATT&CK
P3 CVE-2026-107848 NOUVEAU LOW 3.5 0.001 26.1 composer contao/core-bundle CWE-352 Contao: Cross-site request forgery in custom backend actions CWE! 🗺 ATT&CK
P3 CVE-2026-107395 NOUVEAU MEDIUM 4.3 0.002 26.1 pip indico CWE-862 Indico: Missing access check in legacy session export API
P3 CVE-2026-107850 NOUVEAU MEDIUM 4.3 0.002 26.0 composer contao/core-bundle CWE-639 Contao: Improper access control in the preview links module 🗺 ATT&CK
P3 CVE-2026-107851 NOUVEAU MEDIUM 4.3 0.002 26.0 composer contao/core-bundle CWE-524 Contao: Improper access control in the table access voter 🗺 ATT&CK
P3 GHSA-vcgv-7rvm-m3vp MAJ MEDIUM 4.3 0.000 25.8 go code.vikunja.io/api CWE-200 Duplicate Advisory: Vikunja: Link-share token can enumerate users through the v2 API
P3 GHSA-2922-qgfj-pr7v MAJ MEDIUM 4.3 0.000 25.8 go code.vikunja.io/api CWE-200 Duplicate Advisory: Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project
P3 GHSA-phph-c358-5mwm MAJ MEDIUM 4.3 0.000 25.8 go code.vikunja.io/api CWE-863 Duplicate Advisory: Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)
P3 GHSA-ccgq-fx7h-2v4c MAJ MEDIUM 4.3 0.000 25.8 go code.vikunja.io/api CWE-639 Duplicate Advisory: Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)
P3 CVE-2026-94594 MAJ MEDIUM 4.0 0.001 24.1 CWE-532 Armatura LLC Armatura One 🗺 ATT&CK
P3 CVE-2026-107727 NOUVEAU LOW 3.7 0.004 22.6 pip strawberry-graphql CWE-400 Strawberry legacy graphql-ws retains naturally completed subscription slots
P3 CVE-2026-69662 LOW 3.7 0.002 22.4 CWE-95 Toptech TMS7 and TopHAT
P3 CVE-2026-50343 LOW 0.0 0.003 8.4 — GPZ: Windows Exploitation Techniques: Dangling COM Object Registrations PoC 🗺 ATT&CK
P3 CVE-2026-66804 LOW 0.0 0.003 8.4 — GPZ: Windows Exploitation Techniques: Dangling COM Object Registrations PoC 🗺 ATT&CK
P3 GHSA-fr26-jjhm-638c MAJ HIGH 0.0 0.000 5.0 pip pyload-ng CWE-22 pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=) CWE! 🗺 ATT&CK
P3 CVE-2026-52914 NOUVEAU LOW 0.0 0.008 0.9 Ubuntu — USN-8911-1: Linux kernel (OEM) vulnerabilities 🗺 ATT&CK
P3 CVE-2026-91973 NOUVEAU MEDIUM 0.0 0.007 0.8 go code.vikunja.io/api CWE-307 Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords 🗺 ATT&CK
P3 CVE-2026-91972 NOUVEAU HIGH 0.0 0.006 0.8 go code.vikunja.io/api CWE-307 Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited 🗺 ATT&CK
P3 CVE-2026-91968 NOUVEAU HIGH 0.0 0.004 0.5 go code.vikunja.io/api CWE-674 Vikunja: Unbounded nested task-filter recursion permits API process termination
P3 CVE-2026-91971 NOUVEAU HIGH 0.0 0.004 0.5 go code.vikunja.io/api CWE-400 Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification
P3 CVE-2026-91985 NOUVEAU HIGH 0.0 0.004 0.5 go code.vikunja.io/api CWE-200 Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level 🗺 ATT&CK
P3 CVE-2026-91970 NOUVEAU HIGH 0.0 0.004 0.5 go code.vikunja.io/api CWE-770 Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API
P3 CVE-2026-91969 NOUVEAU HIGH 0.0 0.003 0.4 go code.vikunja.io/api CWE-400 Vikunja: Unbounded CSV row cardinality permits API process termination
P3 CVE-2026-91982 NOUVEAU MEDIUM 0.0 0.003 0.4 go code.vikunja.io/api CWE-312 Vikunja: TOTP secret is readable after enrollment, no step-up auth 🗺 ATT&CK
P3 CVE-2026-91981 NOUVEAU MEDIUM 0.0 0.003 0.4 go code.vikunja.io/api CWE-200 Vikunja: Link-share token can enumerate users through the v2 API 🗺 ATT&CK
P3 CVE-2026-91980 NOUVEAU MEDIUM 0.0 0.003 0.4 go code.vikunja.io/api CWE-200 Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project
P3 CVE-2026-91983 NOUVEAU MEDIUM 0.0 0.003 0.4 go code.vikunja.io/api CWE-863 Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)
P3 CVE-2026-91984 NOUVEAU MEDIUM 0.0 0.003 0.3 go code.vikunja.io/api CWE-639 Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)
P3 CVE-2026-68582 NOUVEAU CRITICAL 0.0 0.003 0.3 go code.vikunja.io/api CWE-639 Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)
P3 CVE-2026-64349 NOUVEAU LOW 0.0 0.002 0.2 Ubuntu — USN-8887-3: Linux kernel vulnerabilities
P3 CVE-2023-54125 MAJ LOW 0.0 0.002 0.2 Ubuntu — USN-8875-2: Linux kernel (NVIDIA) vulnerabilities
P3 CVE-2026-43095 NOUVEAU LOW 0.0 0.001 0.2 Ubuntu — USN-8911-1: Linux kernel (OEM) vulnerabilities 🗺 ATT&CK
P3 GHSA-m687-p538-r5hp MAJ HIGH 0.0 0.000 0.0 go code.vikunja.io/api CWE-942 Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted 🗺 ATT&CK
P3 GHSA-fmmf-xq98-g327 MAJ MEDIUM 0.0 0.000 0.0 go code.vikunja.io/api CWE-863 Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
P3 GHSA-w2ch-4xgr-22ww MAJ LOW 0.0 0.000 0.0 go code.vikunja.io/api CWE-285 Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal
P3 GHSA-8wvg-r2j4-3737 MAJ MEDIUM 0.0 0.000 0.0 go code.vikunja.io/api CWE-200 Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint 🗺 ATT&CK
P3 GHSA-3hc7-r24j-rpwc MAJ MEDIUM 0.0 0.000 0.0 go code.vikunja.io/api CWE-200 Vikunja: Cross-project task disclosure through subtask expansion
P3 GHSA-g38j-7v97-x298 MAJ MEDIUM 0.0 0.000 0.0 go code.vikunja.io/api CWE-862 Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID 🗺 ATT&CK
P3 GHSA-9q47-3cm2-2rp8 MAJ MEDIUM 0.0 0.000 0.0 pip pyload-ng CWE-290 pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header
--
--
Détails
🦠 Exploitation
🌍 Géo/Acteurs
🗺 ATT&CK
📋 Compliance
🎫 Ticket
CVE
--
Priority
--
CVSS / EPSS / Score
--
CVSS Vector
--
CWE
--
Vendor / Product
--
Source(s)
--
Publié
--
Description
--
Score breakdown
--
Références
--
Ransomware
—
Gang
—
In-the-Wild
—
GreyNoise
—
Exploit-DB
—
OTX Pulses
—
PoC public
—
Supply Chain
—
URLhaus URLs
—
PhishTank
—
IOC Count
—
Liens d'exploitation
Threat Actor
—
Pays d'origine
—
Campagne
—
Recherche contextuelle
Techniques ATT&CK associées
Tactiques
Liens MITRE
Obligations réglementaires déclenchées
Actions recommandées
Template ticket JIRA / ServiceNow — copier/coller dans votre ITSM
--

L'écosystème

Digimoove ESN Paris — Cyber · Cloud · Automatisation IA · Observabilité NAIvigate Veille & formation IA FactualRisk est une marque de l'écosystème Digimoove
Raccourcis: / recherche • Esc fermer • f fullscreen • clic ligne = détails • CVE/CVSS = NVD • ★ = watchlist