FACTUALRISK Cyber Intelligence
Mise à jour : 14 Oct 2026 · 12:02
P0 32P1 16KEV 31EPSS 5🆕 5
← Accueil
🗞 Briefing
💥 Menaces▾
💥 Attaques🦠 Ransomware📡 Exploitation🕵️ Acteurs🌍 Géopolitique📰 News
🛡 Vulnérabilités▾
🛡 Dashboard CVE🗃 Base CVE🔧 Patches⛓ Supply Chain
📋 Conformité▾
📋 Compliance🎯 IOC Tracker📈 Statistiques
📚 Guides🛰 Agent Vigie
← Retour FactualRisk
P0 — Urgence
32
KEV + signal fort
KEV exploité
31
14j: 11 nouveaux
EPSS élevé
5
≥ 0.20 (exploitation probable)
Total findings
210
Top 300 • tri score
⚠️ P0 • CVE-2015-5477 • ISC BIND — ISC BIND Data Processing Errors Vulnerability • P0 • CVE-2015-3306 • ProFTPD ProFTPD — ProFTPD Improper Access Control Vulnerability • P0 • CVE-2016-3081 • Apache Struts — Apache Struts Command Injection Vulnerability • P0 • CVE-2026-71362 • Adobe Commerce and Magento — Adobe Commerce and Magento Incorrect Authorization Vulnerability • P0 • CVE-2026-96951 • Microsoft Windows — Microsoft Windows Command Injection Vulnerability • P0 • CVE-2026-104935 • Ivanti Connect Secure — Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability • P0 • CVE-2026-104286 • Fortinet FortiMail — Fortinet FortiMail Path Traversal Vulnerability • P0 • CVE-2026-76504 • Cisco Catalyst SD-WAN Manager — Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability • P0 • CVE-2026-102489 • Zammad GmbH Zammad — Zammad GmbH Zammad Session Fixation Vulnerability • P0 • CVE-2026-86950 • Apple Multiple Products — Apple Multiple Products Out-of-Bounds Write Vulnerability • P0 • CVE-2026-102490 • Zammad GmbH Zammad — Zammad GmbH Zammad Improper Privilege Management Vulnerability • P0 • CVE-2026-88779 • Citrix NetScaler — Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability • P0 • CVE-2025-39682 • Linux Kernel — Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability • P0 • CVE-2026-87902 • WordPress Core — WordPress Core Remote File Inclusion Vulnerability • P0 • CVE-2026-93616 • Check Point Multiple Products — Check Point Multiple Products Path Traversal Vulnerability • P0 • CVE-2021-3199 • ONLYOFFICE Docs — ONLYOFFICE Docs Server Path Traversal Vulnerability • P0 • CVE-2026-76460 • Cisco Identity Services Engine — Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability • P0 • CVE-2026-85102 • Check Point Multiple Products — Check Point Multiple Products Improper Certificate Validation Vulnerability
World Clocksmaj 1s
Status Sourceslatence
• CISA KEV0.17s
• OSV.dev0.64s
🐙 GHSA1.53s
📋 NVD134.19s
📊 EPSS0.45s
🦠 Ransomware.live11.40s
💣 Exploit-DB0.05s
• AlienVault OTX13.67s
📡 GreyNoise1.62s
🔗 URLhaus0.00s
🗺️ MITRE CVE0.10s
✅ VulnCheck Community1.12s
• Security Social0.13s
• Enhanced Vendor Feeds4.24s
• Press/Buzz11.49s
Tendances 7 jours KEV P0 P1 EPSS↑
Top Vendors
nuget41
go37
Ubuntu21
composer11
pip5
npm5
Citrix3
Linux3
Microsoft2
Zammad GmbH2
Cisco2
Check Point2
Top CWEs
CWE-20012
CWE-41611
CWE-798
CWE-3068
CWE-7877
CWE-4007
CWE-226
CWE-8636
🧩 CMS & E-commerceWordPress, Presta…
WordPress2
Magento1
🌐 Threat Intel — 7 derniers jours
Chargement threat intel…
⌕
P1 P2 KEV only EPSS≥0.20 REMOTE PoC CRITICAL 🆕 Nouveaux
Visible: --
Heatmap CVSS × EPSS (visible)survol = détail CVE
★ Prio CVE Sev CVSS EPSS Score Vendor Produit CWE Description Signaux
P0 CVE-2015-5477 MAJ HIGH 7.5 0.994 269.3 ISC BIND CWE-19 ISC BIND Data Processing Errors Vulnerability KEV EPSS↑ 🦠 RANSOM 🗺 ATT&CK
P0 CVE-2015-3306 MAJ CRITICAL 10.0 0.995 257.4 ProFTPD ProFTPD CWE-284 ProFTPD Improper Access Control Vulnerability KEV EPSS↑ 🗺 ATT&CK
P0 CVE-2016-3081 MAJ HIGH 8.1 0.961 238.9 Apache Struts CWE-77 Apache Struts Command Injection Vulnerability KEV EPSS↑ CWE! 🗺 ATT&CK
P0 CVE-2026-71362 CRITICAL 9.1 0.875 229.6 Adobe Commerce and Magento CWE-863 Adobe Commerce and Magento Incorrect Authorization Vulnerability KEV EPSS↑ 🧩 MAGENTO 🗺 ATT&CK
P0 CVE-2026-96951 NOUVEAU HIGH 8.8 0.000 210.8 Microsoft Windows CWE-77 Microsoft Windows Command Injection Vulnerability KEV CWE! 📣 MÉDIATISÉ ×2 🗺 ATT&CK
P0 CVE-2026-104935 NOUVEAU HIGH 8.6 0.000 204.6 Ivanti Connect Secure CWE-290 Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability KEV 📣 MÉDIATISÉ ×2 🗺 ATT&CK
P0 CVE-2026-104286 MAJ CRITICAL 9.8 0.022 184.4 Fortinet FortiMail CWE-22 Fortinet FortiMail Path Traversal Vulnerability KEV CWE! 🗺 ATT&CK
P0 CVE-2026-76504 CRITICAL 9.8 0.018 179.0 Cisco Catalyst SD-WAN Manager CWE-177 Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability KEV 🗺 ATT&CK
P0 CVE-2026-102489 MAJ CRITICAL 9.8 0.013 178.3 Zammad GmbH Zammad CWE-384 Zammad GmbH Zammad Session Fixation Vulnerability KEV 🗺 ATT&CK
P0 CVE-2026-86950 HIGH 8.8 0.012 177.3 Apple Multiple Products CWE-787 Apple Multiple Products Out-of-Bounds Write Vulnerability KEV CWE! 🗺 ATT&CK
P0 CVE-2026-102490 MAJ HIGH 7.8 0.005 175.5 Zammad GmbH Zammad CWE-269 Zammad GmbH Zammad Improper Privilege Management Vulnerability KEV ⛓ SUPPLY 🗺 ATT&CK
P0 CVE-2026-88779 HIGH 7.5 0.006 168.7 Citrix NetScaler CWE-119 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability KEV CWE! 🗺 ATT&CK
P0 CVE-2025-39682 MAJ CRITICAL 9.8 0.029 167.3 Linux Kernel NVD-CWE-Other Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability KEV 🦠 RANSOM
P0 CVE-2026-87902 HIGH 8.1 0.400 166.6 WordPress Core CWE-98 WordPress Core Remote File Inclusion Vulnerability KEV EPSS↑ 🧩 WORDPRESS 🗺 ATT&CK
P0 CVE-2026-93616 CRITICAL 9.8 0.197 157.4 Check Point Multiple Products CWE-22 Check Point Multiple Products Path Traversal Vulnerability KEV CWE! 🗺 ATT&CK
P0 CVE-2021-3199 MAJ CRITICAL 9.8 0.194 157.0 ONLYOFFICE Docs CWE-22 ONLYOFFICE Docs Server Path Traversal Vulnerability KEV CWE! 🗺 ATT&CK
P0 CVE-2026-76460 MAJ CRITICAL 10.0 0.140 146.8 Cisco Identity Services Engine CWE-648 Cisco Identity Services Engine Incorrect Use of Privileged APIs Vulnerability KEV 🗺 ATT&CK
P0 CVE-2026-85102 CRITICAL 9.8 0.075 137.9 Check Point Multiple Products CWE-295 Check Point Multiple Products Improper Certificate Validation Vulnerability KEV 🗺 ATT&CK
P0 CVE-2026-93952 CRITICAL 10.0 0.011 136.3 Arista VeloCloud Orchestrator CWE-20 Arista VeloCloud Orchestrator Improper Input Validation Vulnerability KEV CWE! 🗺 ATT&CK
P0 CVE-2026-88771 CRITICAL 9.8 0.011 135.1 Citrix NetScaler CWE-20 Citrix NetScaler Improper Input Validation Vulnerability KEV CWE! 🗺 ATT&CK
P0 CVE-2026-94127 CRITICAL 9.8 0.022 131.5 F5 BIG-IP APM CWE-122 F5 BIG-IP APM Heap-based Buffer Overflow Vulnerability KEV 🗺 ATT&CK
P0 CVE-2026-5430 CRITICAL 10.0 0.006 130.7 WSO2 Multiple Products CWE-347 WSO2 Multiple Products Path Traversal Vulnerability KEV 🗺 ATT&CK
P0 CVE-2026-65660 HIGH 8.8 0.021 130.3 Microsoft SharePoint CWE-94 Microsoft SharePoint Code Injection Vulnerability KEV CWE! 🗺 ATT&CK
P0 CVE-2026-85097 NOUVEAU CRITICAL 9.8 0.003 129.2 CWE-434 Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE CWE! 📡 ITW 🧩 WORDPRESS 🗺 ATT&CK
P0 CVE-2026-7273 HIGH 8.8 0.025 125.8 Zyxel GS1900 Series Switches CWE-121 Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability KEV 🗺 ATT&CK
P0 CVE-2026-88772 HIGH 8.1 0.013 125.2 Citrix NetScaler CWE-119 Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability KEV CWE! 🗺 ATT&CK
P0 CVE-2026-53266 HIGH 8.8 0.008 123.8 Linux Kernel NVD-CWE-noinfo Linux Kernel Out-of-Bounds Write Vulnerability KEV 🗺 ATT&CK
P0 CVE-2026-58704 MAJ HIGH 8.8 0.006 123.5 Google Pixel CWE-285 Google Pixel Improper Authorization Vulnerability KEV 🗺 ATT&CK
P0 CVE-2025-39964 HIGH 7.8 0.013 118.3 Linux Kernel CWE-362 Linux Kernel Race Condition Vulnerability KEV
P0 CVE-2023-22894 MAJ HIGH 7.2 0.036 117.5 Strapi Strapi CWE-312 Strapi Cleartext Storage of Sensitive Information Vulnerability KEV 🗺 ATT&CK
P0 CVE-2026-87886 HIGH 7.8 0.002 117.1 Acronis Backup CWE-276 Acronis Backup Incorrect Default Permissions Vulnerability KEV
P1 CVE-2026-67279 MEDIUM 6.5 0.010 110.2 MikroTik RouterOS CWE-841 Mikrotik RouterOS Improper Enforcement of Behavioral Workflow Vulnerability KEV 🗺 ATT&CK
P2 GHSA-p4h8-xg7f-xqrc MAJ HIGH 6.5 0.000 99.0 go github.com/go-vikunja/vikunja CWE-400 Duplicate Advisory: Vikunja: Denial of service via decompression bomb in the data import 🦠 RANSOM 📡 ITW
P2 GHSA-jmr8-r558-3jhx MAJ MEDIUM 4.3 0.000 85.8 go code.vikunja.io/api CWE-522 Duplicate Advisory: Vikunja: TOTP secret is readable after enrollment, no step-up auth 🦠 RANSOM 📡 ITW 🗺 ATT&CK
P0 CVE-2026-106117 HIGH 7.5 0.004 85.5 nuget ImageSharp CWE-787 ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp CWE! 📡 ITW ⛓ SUPPLY 🗺 ATT&CK
P1 CVE-2026-105016 NOUVEAU CRITICAL 9.8 0.000 68.8 nuget Microsoft.Native.Quic.MsQuic.Schannel CWE-122 Microsoft Security Advisory CVE-2026-105016 - Microsoft QUIC Remote Code Execution Vulnerability ⛓ SUPPLY 🗺 ATT&CK
P2 CVE-2026-70035 NOUVEAU HIGH 8.8 0.000 67.8 nuget Microsoft.WindowsDesktop.App.Runtime.win-arm64 CWE-502 Microsoft Security Advisory CVE-2026-70035 - .NET and Visual Studio Remote Code Execution Vulnerability CWE! ⛓ SUPPLY 🗺 ATT&CK
P2 CVE-2026-70007 NOUVEAU HIGH 8.8 0.000 67.8 nuget Microsoft.WindowsDesktop.App.Runtime.win-arm64 CWE-787 Microsoft Security Advisory CVE-2026-70007 - .NET and Visual Studio Remote Code Execution Vulnerability CWE! ⛓ SUPPLY 🗺 ATT&CK
P2 CVE-2026-87697 NOUVEAU HIGH 8.8 0.000 67.8 nuget Microsoft.WindowsDesktop.App.Runtime.win-arm64 CWE-502 Microsoft Security Advisory CVE-2026-87697 - .NET and Visual Studio Remote Code Execution Vulnerability CWE! ⛓ SUPPLY 🗺 ATT&CK
P2 CVE-2026-96230 NOUVEAU HIGH 8.8 0.000 67.8 nuget Microsoft.AspNetCore.Components.WebAssembly.Server CWE-79 Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability CWE! ⛓ SUPPLY 🗺 ATT&CK
P2 CVE-2026-96224 NOUVEAU HIGH 8.8 0.000 67.8 nuget Microsoft.WindowsDesktop.App.Runtime.win-arm64 CWE-787 Microsoft Security Advisory CVE-2026-96224 - .NET and Visual Studio Remote Code Execution Vulnerability CWE! ⛓ SUPPLY 🗺 ATT&CK
P2 CVE-2026-85363 NOUVEAU HIGH 8.8 0.000 67.8 nuget Microsoft.WindowsDesktop.App.Runtime.win-arm64 CWE-190 Microsoft Security Advisory CVE-2026-85363 - .NET and Visual Studio Remote Code Execution Vulnerability CWE! ⛓ SUPPLY 🗺 ATT&CK
P2 CVE-2026-83520 NOUVEAU HIGH 8.8 0.000 67.8 nuget Microsoft.WindowsDesktop.App.Runtime.win-arm64 CWE-502 Microsoft Security Advisory CVE-2026-83520 - .NET and Visual Studio Remote Code Execution Vulnerability CWE! ⛓ SUPPLY 🗺 ATT&CK
P2 CVE-2026-96235 NOUVEAU HIGH 8.8 0.000 67.8 nuget Microsoft.WindowsDesktop.App.Runtime.win-arm64 CWE-787 Microsoft Security Advisory CVE-2026-96235 - .NET and Visual Studio Remote Code Execution Vulnerability CWE! ⛓ SUPPLY 🗺 ATT&CK
P2 CVE-2026-102870 NOUVEAU HIGH 8.8 0.000 67.8 nuget Microsoft.AspNetCore.Components.WebAssembly.Server CWE-94 Microsoft Security Advisory CVE-2026-102870 - ASP.NET Core Remote Code Execution Vulnerability CWE! ⛓ SUPPLY 🗺 ATT&CK
P1 CVE-2024-56779 MAJ CRITICAL 9.8 0.005 67.4 Ubuntu CWE-401 USN-8921-1: Linux kernel vulnerabilities
P1 CVE-2022-49201 MAJ CRITICAL 9.8 0.005 67.4 Ubuntu CWE-362 USN-8920-1: Linux kernel vulnerabilities
P1 CVE-2022-49149 MAJ CRITICAL 9.8 0.005 67.4 Ubuntu CWE-362 USN-8920-1: Linux kernel vulnerabilities
P2 CVE-2026-88092 NOUVEAU CRITICAL 9.4 0.000 66.4 nuget Microsoft.AspNetCore.App.Runtime.linux-arm CWE-444 Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature Bypass Vulnerability ⛓ SUPPLY
P2 CVE-2022-49114 MAJ HIGH 8.8 0.004 66.2 Ubuntu CWE-416 USN-8923-1: Linux kernel vulnerabilities CWE! 🗺 ATT&CK
P2 CVE-2022-49111 MAJ HIGH 8.8 0.003 66.2 Ubuntu CWE-416 USN-8923-1: Linux kernel vulnerabilities CWE! 🗺 ATT&CK
P2 CVE-2026-108261 NOUVEAU CRITICAL 9.3 0.002 66.0 npm tinacms CWE-346 TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment ⛓ SUPPLY 🗺 ATT&CK
P2 CVE-2026-106445 MAJ CRITICAL 9.2 0.004 65.7 npm handlebars CWE-184 Handlebars: JavaScript Injection via Own Property Check Bypass ⛓ SUPPLY 🗺 ATT&CK
P1 CVE-2026-96587 CRITICAL 10.0 0.003 65.4 CWE-798 Viidure Dashcam Android Application CWE! 🗺 ATT&CK
P2 CVE-2026-70188 NOUVEAU CRITICAL 9.1 0.000 64.6 nuget Microsoft.AspNetCore.App.Runtime.linux-arm CWE-444 Microsoft Security Advisory CVE-2026-70188 - ASP.NET Core Security Feature Bypass Vulnerability ⛓ SUPPLY
P1 CVE-2026-100730 NOUVEAU CRITICAL 9.8 0.006 64.5 CWE-502 Grid Protection Alliance openPDC and openHistorian CWE! 🗺 ATT&CK
P1 CVE-2026-15340 NOUVEAU CRITICAL 9.8 0.006 64.5 CWE-120 Savannah lwIP SMTP client CWE! 🗺 ATT&CK
P2 CVE-2026-108259 NOUVEAU HIGH 8.2 0.003 64.5 npm @tinacms/cli CWE-94 Tina: Code injection via unescaped Git branch name in generated client source CWE! ⛓ SUPPLY 🗺 ATT&CK
P1 CVE-2026-105278 NOUVEAU CRITICAL 9.8 0.003 64.2 CWE-798 Grid Protection Alliance openPDC and openHistorian CWE! 🗺 ATT&CK
P2 CVE-2026-102827 MAJ HIGH 8.1 0.004 64.1 npm simple-git CWE-77 simple-git: unsafe-operations plugin bypass via git long-option abbreviation (--receive-p/--exe) -> command execution (residual of CVE-2026-28291) CWE! ⛓ SUPPLY 🗺 ATT&CK
P2 CVE-2026-70197 NOUVEAU HIGH 8.1 0.000 63.6 nuget Microsoft.NETCore.App.Runtime.win-arm64 CWE-787 Microsoft Security Advisory CVE-2026-70197 - .NET and Visual Studio Remote Code Execution Vulnerability CWE! ⛓ SUPPLY 🗺 ATT&CK
P1 CVE-2026-106358 CRITICAL 9.6 0.004 63.1 CWE-416 Extended Stable Update for Desktop CWE! 🗺 ATT&CK
P2 CVE-2017-20285 CRITICAL 9.1 0.003 63.0 Ubuntu CWE-470 USN-8925-1: YAML-LibYAML vulnerabilities
P1 CVE-2026-103630 CRITICAL 9.6 0.003 63.0 CWE-416 Long Term Support Channel Update for ChromeOS CWE! 🗺 ATT&CK
P2 CVE-2026-102266 MAJ CRITICAL 9.1 0.002 62.8 Ubuntu CWE-347 USN-8916-1: PyJWT vulnerabilities 🗺 ATT&CK
P2 CVE-2026-70174 NOUVEAU HIGH 8.8 0.000 62.8 nuget Microsoft.WindowsDesktop.App.Runtime.win-arm64 CWE-358 Microsoft Security Advisory CVE-2026-70174 - .NET and Visual Studio Remote Code Execution Vulnerability ⛓ SUPPLY 🗺 ATT&CK
P2 CVE-2026-102267 MAJ CRITICAL 9.1 0.002 62.8 Ubuntu CWE-200 USN-8916-1: PyJWT vulnerabilities 🗺 ATT&CK
P1 CVE-2026-107406 NOUVEAU CRITICAL 9.5 0.005 62.6 CWE-119 Citrix Patches Critical NetScaler Flaw That Could Enable RCE in SAML Deployments CWE! 🗺 ATT&CK
P2 CVE-2026-95102 CRITICAL 9.4 0.003 61.8 CWE-306 Monta monta.app CWE! 🗺 ATT&CK
P2 CVE-2026-107845 NOUVEAU CRITICAL 9.3 0.003 61.1 composer contao/comments-bundle CWE-79 Contao: Cross-site scripting in the comments bundle CWE! 🗺 ATT&CK
P3 CVE-2026-108260 NOUVEAU HIGH 7.6 0.002 60.9 npm @tinacms/web-components CWE-79 @tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS CWE! ⛓ SUPPLY 🗺 ATT&CK
P1 CVE-2026-102255 NOUVEAU CRITICAL 10.0 0.005 60.6 CWE-441 Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch 🗺 ATT&CK
P3 CVE-2026-91979 NOUVEAU HIGH 0.0 0.004 60.5 go code.vikunja.io/api CWE-400 Vikunja: Denial of service via decompression bomb in the data import 🦠 RANSOM 📡 ITW
P2 CVE-2026-94591 HIGH 8.4 0.001 60.5 CWE-321 Armatura LLC Armatura One ⛓ SUPPLY 🗺 ATT&CK
P3 CVE-2026-100294 HIGH 7.5 0.002 60.3 CWE-798 Anjvision YSSD-RTMP-H5 CWE! ⛓ SUPPLY 🗺 ATT&CK
P3 CVE-2022-49182 MAJ HIGH 7.8 0.003 60.1 Ubuntu CWE-416 USN-8920-1: Linux kernel vulnerabilities CWE! 🗺 ATT&CK
P3 CVE-2024-53194 MAJ HIGH 7.8 0.002 60.1 Ubuntu CWE-416 USN-8921-1: Linux kernel vulnerabilities CWE! 🗺 ATT&CK
P3 CVE-2024-57849 MAJ HIGH 7.8 0.002 60.0 Ubuntu CWE-416 USN-8921-1: Linux kernel vulnerabilities CWE! 🗺 ATT&CK
P3 CVE-2026-96232 NOUVEAU HIGH 7.5 0.000 60.0 nuget Microsoft.WindowsDesktop.App.Runtime.win-arm64 CWE-125 Microsoft Security Advisory CVE-2026-96232 - .NET and Visual Studio Information Disclosure Vulnerability CWE! ⛓ SUPPLY 🗺 ATT&CK
P3 CVE-2026-96233 NOUVEAU HIGH 7.5 0.000 60.0 nuget Microsoft.NETCore.App.Runtime.linux-arm CWE-787 Microsoft Security Advisory CVE-2026-96233 - .NET and Visual Studio Denial of Service Vulnerability CWE! ⛓ SUPPLY 🗺 ATT&CK
P1 CVE-2026-84411 CRITICAL 9.8 0.009 59.9 CWE-191 MikroTik RouterOS 🗺 ATT&CK
P1 CVE-2026-39919 CRITICAL 9.8 0.008 59.7 CWE-122 Ghostscript flaw lets hackers hijack servers via PDF uploads
P1 CVE-2026-100291 CRITICAL 9.8 0.003 59.2 CWE-1188 Anjvision YSSD-RTMP-H5 🗺 ATT&CK
P2 CVE-2026-70175 NOUVEAU HIGH 8.1 0.000 58.6 nuget Microsoft.AspNetCore.App.Runtime.linux-arm CWE-640 Microsoft Security Advisory CVE-2026-70175 - ASP.NET Core Elevation of Privilege Vulnerability ⛓ SUPPLY 🗺 ATT&CK
P2 CVE-2026-106347 HIGH 8.8 0.003 58.2 CWE-416 Extended Stable Update for Desktop CWE! 🗺 ATT&CK
P2 CVE-2026-100292 HIGH 8.8 0.003 58.1 CWE-78 Anjvision YSSD-RTMP-H5 CWE! 🗺 ATT&CK
P2 CVE-2026-55691 MAJ HIGH 8.6 0.005 57.2 composer starcitizenwiki/embedvideo CWE-79 StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template CWE! 🗺 ATT&CK
P3 CVE-2026-96225 NOUVEAU HIGH 7.8 0.000 56.8 nuget Microsoft.NETCore.App.Runtime.linux-arm CWE-59 Microsoft Security Advisory CVE-2026-96225 - .NET and Visual Studio Elevation of Privilege Vulnerability ⛓ SUPPLY
P3 CVE-2026-96231 NOUVEAU HIGH 7.8 0.000 56.8 nuget Microsoft.NETCore.App.Runtime.linux-arm CWE-59 Microsoft Security Advisory CVE-2026-96231 - .NET and Visual Studio Elevation of Privilege Vulnerability ⛓ SUPPLY
P2 CVE-2026-105445 NOUVEAU CRITICAL 9.4 0.000 56.4 CWE-266 Docker Hub flaw let attackers impersonate users, tamper with images 🗺 ATT&CK
P2 CVE-2026-7395 HIGH 8.5 0.002 56.3 CWE-306 Hitachi Energy Asset Suite CWE! 🗺 ATT&CK
P3 CVE-2026-54641 NOUVEAU HIGH 7.7 0.000 56.2 maven io.openremote:openremote-manager CWE-639 OpenRemote has Cross-Realm User Information Disclosure in UserResourceImpl ⛓ SUPPLY 🗺 ATT&CK
P2 CVE-2026-94592 HIGH 8.4 0.001 55.5 CWE-798 Armatura LLC Armatura One CWE! 🗺 ATT&CK
P3 CVE-2026-94204 HIGH 7.5 0.003 55.3 CWE-732 Viidure Dashcam Android Application ⛓ SUPPLY 🗺 ATT&CK
P2 CVE-2026-95372 HIGH 8.3 0.004 55.3 CWE-416 Long Term Support Channel Update for ChromeOS CWE! 🗺 ATT&CK
P3 CVE-2022-49170 MAJ HIGH 7.8 0.003 55.1 Ubuntu CWE-129 USN-8920-1: Linux kernel vulnerabilities
P2 CVE-2026-102324 HIGH 8.3 0.003 55.1 CWE-416 Long Term Support Channel Update for ChromeOS CWE! 🗺 ATT&CK
P3 CVE-2024-53214 MAJ HIGH 7.8 0.003 55.1 Ubuntu CWE-129 USN-8921-1: Linux kernel vulnerabilities
P3 CVE-2024-56570 MAJ HIGH 7.8 0.002 55.1 Ubuntu NVD-CWE-noinfo USN-8921-1: Linux kernel vulnerabilities
P3 CVE-2026-70186 NOUVEAU HIGH 7.5 0.000 55.0 nuget Microsoft.AspNetCore.App.Runtime.linux-arm CWE-833 Microsoft Security Advisory CVE-2026-70186 - ASP.NET Core Denial of Service Vulnerability ⛓ SUPPLY 🗺 ATT&CK
P3 CVE-2026-70179 NOUVEAU HIGH 7.5 0.000 55.0 nuget Microsoft.AspNetCore.Authentication.Negotiate CWE-290 Microsoft Security Advisory CVE-2026-70179 - ASP.NET Core Elevation of Privilege Vulnerability ⛓ SUPPLY 🗺 ATT&CK
P3 CVE-2026-96959 NOUVEAU HIGH 7.5 0.000 55.0 nuget System.Security.Cryptography.Xml CWE-770 Microsoft Security Advisory CVE-2026-96959 - .NET and Visual Studio Denial of Service Vulnerability ⛓ SUPPLY
P3 CVE-2026-96236 NOUVEAU HIGH 7.5 0.000 55.0 nuget Microsoft.AspNetCore.App.Runtime.linux-arm CWE-770 Microsoft Security Advisory CVE-2026-96236 - ASP.NET Core Denial of Service Vulnerability ⛓ SUPPLY
P3 CVE-2026-69651 NOUVEAU HIGH 7.5 0.000 55.0 nuget Microsoft.NETCore.App.Runtime.linux-arm CWE-407 Microsoft Security Advisory CVE-2026-69651 - .NET and Visual Studio Denial of Service Vulnerability ⛓ SUPPLY
P3 CVE-2026-96960 NOUVEAU HIGH 7.5 0.000 55.0 nuget System.Security.Cryptography.Xml CWE-405 Microsoft Security Advisory CVE-2026-96960 - .NET and Visual Studio Denial of Service Vulnerability ⛓ SUPPLY
P3 CVE-2026-96958 NOUVEAU HIGH 7.5 0.000 55.0 nuget System.Security.Cryptography.Xml CWE-407 Microsoft Security Advisory CVE-2026-96958 - .NET and Visual Studio Denial of Service Vulnerability ⛓ SUPPLY
P3 CVE-2026-84008 NOUVEAU HIGH 7.5 0.000 55.0 nuget System.Security.Cryptography.Pkcs CWE-407 Microsoft Security Advisory CVE-2026-84008 - .NET Denial of Service Vulnerability ⛓ SUPPLY
P3 CVE-2026-58280 NOUVEAU HIGH 7.5 0.000 55.0 nuget Microsoft.NETCore.App.Runtime.linux-arm CWE-674 Microsoft Security Advisory CVE-2026-58280 - .NET and Visual Studio Denial of Service Vulnerability ⛓ SUPPLY
P3 CVE-2026-70183 NOUVEAU HIGH 7.5 0.000 55.0 nuget Microsoft.AspNetCore.App.Runtime.linux-arm CWE-362 Microsoft Security Advisory CVE-2026-70183 - ASP.NET Core Security Feature Bypass Vulnerability ⛓ SUPPLY
P3 CVE-2026-70181 NOUVEAU HIGH 7.5 0.000 55.0 nuget Microsoft.AspNetCore.App.Runtime.linux-arm CWE-770 Microsoft Security Advisory CVE-2026-70181 - ASP.NET Core Denial of Service Vulnerability ⛓ SUPPLY
P3 CVE-2026-70159 NOUVEAU HIGH 7.5 0.000 55.0 nuget Microsoft.AspNetCore.SignalR.Common CWE-770 Microsoft Security Advisory CVE-2026-70159 - ASP.NET Core Denial of Service Vulnerability ⛓ SUPPLY
P3 CVE-2026-96222 NOUVEAU HIGH 7.4 0.000 54.4 nuget System.Security.Cryptography.Xml CWE-295 Microsoft Security Advisory CVE-2026-96222 - .NET Spoofing Vulnerability ⛓ SUPPLY
P2 CVE-2026-104629 NOUVEAU HIGH 8.8 0.003 53.2 CWE-470 Grid Protection Alliance openPDC and openHistorian
P2 CVE-2026-100298 HIGH 8.8 0.003 53.1 CWE-522 Anjvision YSSD-RTMP-H5 🗺 ATT&CK
P2 CVE-2026-100293 HIGH 8.8 0.002 53.0 CWE-347 Anjvision YSSD-RTMP-H5 🗺 ATT&CK
P2 CVE-2026-74580 MAJ HIGH 8.8 0.001 53.0 — AI-Found Linux Kernel Flaw Gives Local Users Root, and Can Break a Guest Out to the Host
P2 CVE-2026-92817 NOUVEAU HIGH 8.8 0.000 52.8 CWE-863 Inductive Automation Ignition Software
P3 CVE-2026-55692 MAJ HIGH 7.5 0.005 50.6 composer starcitizenwiki/embedvideo CWE-79 StarCitizenWiki Extension Embed Video: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled CWE! 🗺 ATT&CK
P3 CVE-2026-55690 MAJ HIGH 7.5 0.005 50.6 composer starcitizenwiki/embedvideo CWE-79 StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception text CWE! 🗺 ATT&CK
P3 CVE-2026-85790 NOUVEAU MEDIUM 5.9 0.000 50.4 nuget Microsoft.Native.Quic.MsQuic.Schannel CWE-416 Microsoft Security Advisory CVE-2026-85790 - .NET Information Disclosure Vulnerability CWE! ⛓ SUPPLY 🗺 ATT&CK
P3 CVE-2026-105281 NOUVEAU HIGH 7.5 0.003 50.4 CWE-306 Grid Protection Alliance openPDC and openHistorian CWE! 🗺 ATT&CK
P3 CVE-2026-57440 MAJ HIGH 7.5 0.003 50.3 composer starcitizenwiki/embedvideo CWE-79 Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled CWE! 🗺 ATT&CK
P3 CVE-2026-105133 HIGH 7.3 0.004 49.3 CWE-287 Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge CWE! 🗺 ATT&CK
P3 CVE-2019-25777 HIGH 7.3 0.003 49.2 Ubuntu CWE-502 USN-8925-1: YAML-LibYAML vulnerabilities CWE! 🗺 ATT&CK
P2 CVE-2026-100296 HIGH 8.1 0.003 49.0 CWE-754 Anjvision YSSD-RTMP-H5 🗺 ATT&CK
P3 CVE-2026-96229 NOUVEAU MEDIUM 6.5 0.000 49.0 nuget Microsoft.WindowsDesktop.App.Runtime.win-arm64 CWE-183 Microsoft Security Advisory CVE-2026-96229 - .NET and Visual Studio Information Disclosure Vulnerability ⛓ SUPPLY 🗺 ATT&CK
P3 CVE-2026-70194 NOUVEAU MEDIUM 6.5 0.000 49.0 nuget Microsoft.NETCore.App.Runtime.linux-arm CWE-295 Microsoft Security Advisory CVE-2026-70194 - .NET and Visual Studio Security Feature Bypass Vulnerability ⛓ SUPPLY 🗺 ATT&CK
P2 CVE-2026-39460 NOUVEAU HIGH 8.1 0.003 49.0 CWE-522 Red Lion Controls N-Tron 700 Series 🗺 ATT&CK
P3 CVE-2026-94593 HIGH 7.8 0.001 46.9 CWE-532 Armatura LLC Armatura One 🗺 ATT&CK
P3 CVE-2026-108258 NOUVEAU MEDIUM 6.9 0.004 46.8 pip shiny CWE-22 Shiny for Python has path traversal in bookmark restore CWE! 🗺 ATT&CK
P3 CVE-2024-8176 HIGH 7.5 0.014 46.6 CWE-674 Hitachi Energy REB500 🗺 ATT&CK
P3 CVE-2026-101104 HIGH 7.7 0.003 46.5 CWE-862 Meari IoT Cloud Platform OpenAPI Service
P3 CVE-2024-53187 MAJ MEDIUM 5.5 0.002 46.3 Ubuntu CWE-190 USN-8920-1: Linux kernel vulnerabilities CWE! 🗺 ATT&CK
P3 CVE-2026-107805 NOUVEAU HIGH 7.5 0.004 45.5 go github.com/0xJacky/Nginx-UI CWE-400 Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage 🗺 ATT&CK
P3 CVE-2026-66822 NOUVEAU MEDIUM 5.9 0.000 45.4 nuget Microsoft.NETCore.App.Runtime.linux-arm CWE-201 Microsoft Security Advisory CVE-2026-66822 - .NET and Visual Studio Information Disclosure Vulnerability ⛓ SUPPLY 🗺 ATT&CK
P3 CVE-2026-70162 NOUVEAU MEDIUM 5.9 0.000 45.4 nuget System.Security.Cryptography.Pkcs CWE-405 Microsoft Security Advisory CVE-2026-70162 - .NET Denial of Service Vulnerability ⛓ SUPPLY 🗺 ATT&CK
P3 CVE-2026-70196 NOUVEAU MEDIUM 5.9 0.000 45.4 nuget Microsoft.AspNetCore.App.Runtime.linux-arm CWE-407 Microsoft Security Advisory CVE-2026-70196 - ASP.NET Core Denial of Service Vulnerability ⛓ SUPPLY
P3 CVE-2026-97363 HIGH 7.5 0.003 45.4 CWE-307 Monta monta.app 🗺 ATT&CK
P3 GHSA-p2vv-wrh8-x466 MAJ HIGH 7.5 0.000 45.0 go code.vikunja.io/api CWE-307 Duplicate Advisory: Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords 🗺 ATT&CK
P3 GHSA-37rx-7pj5-p885 MAJ HIGH 7.5 0.000 45.0 go code.vikunja.io/api CWE-200 Duplicate Advisory: Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level 🗺 ATT&CK
P3 CVE-2026-97212 HIGH 7.3 0.002 44.1 CWE-613 Monta monta.app
P3 CVE-2026-64893 HIGH 7.3 0.001 43.9 CWE-319 Johnson Controls EasyIO Neo Series EC and CW Controllers
P3 CVE-2018-13093 MAJ MEDIUM 5.5 0.017 43.1 Ubuntu CWE-476 USN-8924-1: Linux kernel vulnerabilities
P3 CVE-2026-107606 NOUVEAU MEDIUM 6.2 0.000 42.2 CWE-306 Swann Communications SWIFI-SE2KIC CWE! 🗺 ATT&CK
P3 CVE-2026-107607 NOUVEAU MEDIUM 6.2 0.000 42.2 CWE-306 Swann Communications SWIFI-SE2KIC CWE! 🗺 ATT&CK
P3 CVE-2026-107605 NOUVEAU MEDIUM 6.2 0.000 42.2 CWE-306 Swann Communications SWIFI-SE2KIC CWE! 🗺 ATT&CK
P3 CVE-2026-96234 NOUVEAU MEDIUM 5.3 0.000 41.8 nuget Microsoft.WindowsDesktop.App.Runtime.win-arm64 CWE-346 Microsoft Security Advisory CVE-2026-96234 - .NET and Visual Studio Information Disclosure Vulnerability ⛓ SUPPLY 🗺 ATT&CK
P3 GHSA-86xp-94pg-8r6r MAJ MEDIUM 5.3 0.000 41.8 nuget Microsoft.AspNetCore.SignalR.Protocols.MessagePack CWE-1325 Microsoft Security Advisory CVE-2026-92707 - ASP.NET Core Denial of Service Vulnerability ⛓ SUPPLY
P3 CVE-2023-20585 MAJ MEDIUM 5.6 0.001 41.7 Ubuntu CWE-788 USN-8918-1: Linux kernel (Azure) vulnerabilities
P3 CVE-2026-49264 NOUVEAU MEDIUM 6.1 0.000 41.6 pip oauthlib CWE-79 Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation CWE! 🗺 ATT&CK
P3 CVE-2026-32645 NOUVEAU MEDIUM 6.0 0.001 41.1 CWE-798 Red Lion Controls N-Tron 700 Series CWE! 🗺 ATT&CK
P3 CVE-2026-100299 MEDIUM 6.8 0.001 40.9 CWE-1391 Anjvision YSSD-RTMP-H5 🗺 ATT&CK
P3 CVE-2026-49265 NOUVEAU MEDIUM 6.8 0.000 40.8 pip oauthlib CWE-208 Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)
P3 CVE-2026-96613 MEDIUM 6.5 0.002 39.3 CWE-862 Meari IoT Cloud Platform OpenAPI Service 🗺 ATT&CK
P3 CVE-2026-93474 MEDIUM 6.5 0.002 39.2 CWE-522 Monta monta.app 🗺 ATT&CK
P3 GHSA-hjx8-qv73-f7cm MAJ MEDIUM 6.5 0.000 39.0 go code.vikunja.io/api CWE-613 Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed
P3 GHSA-4hv6-xc92-j86g MAJ MEDIUM 6.5 0.000 39.0 go code.vikunja.io/api CWE-613 Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes 🗺 ATT&CK
P3 GHSA-c2g7-39fr-cp8q MAJ HIGH 6.5 0.000 39.0 go code.vikunja.io/api CWE-770 Duplicate Advisory: Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API 🗺 ATT&CK
P3 GHSA-55p4-8j34-jv53 MAJ HIGH 6.5 0.000 39.0 go code.vikunja.io/api CWE-400 Duplicate Advisory: Vikunja: Unbounded CSV row cardinality permits API process termination 🗺 ATT&CK
P3 GHSA-jfw3-2gcf-23r5 MAJ HIGH 6.5 0.000 39.0 go code.vikunja.io/api CWE-674 Duplicate Advisory: Vikunja: Unbounded nested task-filter recursion permits API process termination 🗺 ATT&CK
P3 GHSA-69rj-q3v9-vffp MAJ HIGH 6.5 0.000 39.0 go code.vikunja.io/api CWE-400 Duplicate Advisory: Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification
P3 CVE-2026-27873 MEDIUM 5.6 0.001 38.7 CWE-798 Johnson Controls EasyIO FG CWE! 🗺 ATT&CK
P3 CVE-2026-15952 MEDIUM 6.4 0.001 38.5 CWE-732 ABB Protection and Control IED Manager PCM600 🗺 ATT&CK
P3 CVE-2026-64892 MEDIUM 6.3 0.002 38.1 CWE-200 Johnson Controls EasyIO Neo Series EC and CW Controllers 🗺 ATT&CK
P3 CVE-2026-100295 MEDIUM 6.3 0.002 38.0 CWE-489 Anjvision YSSD-RTMP-H5 🗺 ATT&CK
P3 CVE-2026-107844 NOUVEAU MEDIUM 5.3 0.003 37.2 composer contao/core-bundle CWE-22 Contao: Path traversal in the images controller CWE! 🗺 ATT&CK
P3 CVE-2026-85479 NOUVEAU MEDIUM 5.3 0.003 37.1 CWE-306 Grid Protection Alliance openPDC and openHistorian CWE! 🗺 ATT&CK
P3 CVE-2026-100297 MEDIUM 5.3 0.002 37.0 CWE-918 Anjvision YSSD-RTMP-H5 CWE! 🗺 ATT&CK
P3 CVE-2026-11796 MEDIUM 5.1 0.002 35.9 CWE-306 Hitachi Energy Asset Suite CWE! 🗺 ATT&CK
P3 CVE-2026-15953 MEDIUM 5.0 0.001 35.1 CWE-22 ABB Protection and Control IED Manager PCM600 CWE! 🗺 ATT&CK
P3 CVE-2026-27872 MEDIUM 5.6 0.001 33.7 CWE-269 Johnson Controls EasyIO FG 🗺 ATT&CK
P3 CVE-2026-15830 MAJ MEDIUM 5.3 0.011 33.1 pip django CWE-674 Django GeoDjango vulnerable to denial of service through deeply nested geometry collections
P3 GHSA-pjr3-86v4-5p7w MAJ MEDIUM 5.4 0.000 32.4 go code.vikunja.io/api CWE-269 Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)
P3 GHSA-fprf-r6rv-xg99 MAJ MEDIUM 5.4 0.000 32.4 go code.vikunja.io/api CWE-863 Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants
P3 CVE-2017-5967 MAJ MEDIUM 4.0 0.003 32.4 Ubuntu CWE-200 USN-8924-1: Linux kernel vulnerabilities
P3 CVE-2026-107842 NOUVEAU MEDIUM 5.3 0.003 32.1 composer contao/core-bundle CWE-200 Contao: Protected page content is disclosed to anonymous visitors after contao.search.index_protected is disabled
P3 CVE-2026-107843 NOUVEAU MEDIUM 5.3 0.003 32.1 composer contao/core-bundle CWE-204 Contao: The registration module re-sends activation mails 🗺 ATT&CK
P3 CVE-2026-107804 NOUVEAU MEDIUM 5.3 0.002 32.1 go github.com/0xJacky/Nginx-UI CWE-346 Nginx UI: Bundled reverse proxy can bypass IP allowlists and enable shared login lockout 🗺 ATT&CK
P3 CVE-2026-101022 NOUVEAU MEDIUM 4.3 0.002 31.0 CWE-918 Grid Protection Alliance openPDC and openHistorian CWE! 🗺 ATT&CK
P3 CVE-2026-107848 NOUVEAU LOW 3.5 0.001 26.1 composer contao/core-bundle CWE-352 Contao: Cross-site request forgery in custom backend actions CWE! 🗺 ATT&CK
P3 CVE-2026-107850 NOUVEAU MEDIUM 4.3 0.002 26.0 composer contao/core-bundle CWE-639 Contao: Improper access control in the preview links module 🗺 ATT&CK
P3 CVE-2026-107851 NOUVEAU MEDIUM 4.3 0.002 26.0 composer contao/core-bundle CWE-524 Contao: Improper access control in the table access voter 🗺 ATT&CK
P3 GHSA-vcgv-7rvm-m3vp MAJ MEDIUM 4.3 0.000 25.8 go code.vikunja.io/api CWE-200 Duplicate Advisory: Vikunja: Link-share token can enumerate users through the v2 API
P3 GHSA-2922-qgfj-pr7v MAJ MEDIUM 4.3 0.000 25.8 go code.vikunja.io/api CWE-200 Duplicate Advisory: Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project
P3 GHSA-phph-c358-5mwm MAJ MEDIUM 4.3 0.000 25.8 go code.vikunja.io/api CWE-863 Duplicate Advisory: Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)
P3 GHSA-ccgq-fx7h-2v4c MAJ MEDIUM 4.3 0.000 25.8 go code.vikunja.io/api CWE-639 Duplicate Advisory: Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)
P3 CVE-2026-94594 MEDIUM 4.0 0.001 24.1 CWE-532 Armatura LLC Armatura One 🗺 ATT&CK
P3 CVE-2026-50343 LOW 0.0 0.003 8.4 — GPZ: Windows Exploitation Techniques: Dangling COM Object Registrations PoC 🗺 ATT&CK
P3 CVE-2026-66804 LOW 0.0 0.003 8.4 — GPZ: Windows Exploitation Techniques: Dangling COM Object Registrations PoC 🗺 ATT&CK
P3 CVE-2026-72065 NOUVEAU LOW 0.0 0.007 0.9 Ubuntu — USN-8917-1: Linux kernel vulnerabilities
P3 CVE-2026-91973 NOUVEAU MEDIUM 0.0 0.007 0.8 go code.vikunja.io/api CWE-307 Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords 🗺 ATT&CK
P3 CVE-2026-91972 NOUVEAU HIGH 0.0 0.006 0.8 go code.vikunja.io/api CWE-307 Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited 🗺 ATT&CK
P3 CVE-2026-91968 NOUVEAU HIGH 0.0 0.004 0.5 go code.vikunja.io/api CWE-674 Vikunja: Unbounded nested task-filter recursion permits API process termination
P3 CVE-2026-91971 NOUVEAU HIGH 0.0 0.004 0.5 go code.vikunja.io/api CWE-400 Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification
P3 CVE-2026-91985 NOUVEAU HIGH 0.0 0.004 0.5 go code.vikunja.io/api CWE-200 Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level 🗺 ATT&CK
P3 CVE-2026-73557 MAJ MEDIUM 0.0 0.004 0.5 pip vllm CWE-362 vLLM: Incomplete CVE-2025-62164 remediation can be bypassed by concurrent prompt parts
P3 CVE-2026-91970 NOUVEAU HIGH 0.0 0.004 0.5 go code.vikunja.io/api CWE-770 Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API
P3 CVE-2026-91969 NOUVEAU HIGH 0.0 0.003 0.4 go code.vikunja.io/api CWE-400 Vikunja: Unbounded CSV row cardinality permits API process termination
P3 CVE-2026-91982 NOUVEAU MEDIUM 0.0 0.003 0.4 go code.vikunja.io/api CWE-312 Vikunja: TOTP secret is readable after enrollment, no step-up auth 🗺 ATT&CK
P3 CVE-2026-91981 NOUVEAU MEDIUM 0.0 0.003 0.4 go code.vikunja.io/api CWE-200 Vikunja: Link-share token can enumerate users through the v2 API 🗺 ATT&CK
P3 CVE-2026-91980 NOUVEAU MEDIUM 0.0 0.003 0.4 go code.vikunja.io/api CWE-200 Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project
P3 CVE-2026-91983 NOUVEAU MEDIUM 0.0 0.003 0.4 go code.vikunja.io/api CWE-863 Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)
P3 CVE-2026-91984 NOUVEAU MEDIUM 0.0 0.003 0.3 go code.vikunja.io/api CWE-639 Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)
P3 CVE-2024-56552 MAJ LOW 0.0 0.001 0.2 Ubuntu — USN-8918-1: Linux kernel (Azure) vulnerabilities
P3 GHSA-m687-p538-r5hp MAJ HIGH 0.0 0.000 0.0 go code.vikunja.io/api CWE-942 Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted 🗺 ATT&CK
P3 GHSA-fmmf-xq98-g327 MAJ MEDIUM 0.0 0.000 0.0 go code.vikunja.io/api CWE-863 Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check
P3 GHSA-w2ch-4xgr-22ww MAJ LOW 0.0 0.000 0.0 go code.vikunja.io/api CWE-285 Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal
P3 GHSA-8wvg-r2j4-3737 MAJ MEDIUM 0.0 0.000 0.0 go code.vikunja.io/api CWE-200 Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint 🗺 ATT&CK
P3 GHSA-3hc7-r24j-rpwc MAJ MEDIUM 0.0 0.000 0.0 go code.vikunja.io/api CWE-200 Vikunja: Cross-project task disclosure through subtask expansion
P3 GHSA-g38j-7v97-x298 MAJ MEDIUM 0.0 0.000 0.0 go code.vikunja.io/api CWE-862 Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID 🗺 ATT&CK
--
--
Détails
🦠 Exploitation
🌍 Géo/Acteurs
🗺 ATT&CK
📋 Compliance
🎫 Ticket
CVE
--
Priority
--
CVSS / EPSS / Score
--
CVSS Vector
--
CWE
--
Vendor / Product
--
Source(s)
--
Publié
--
Description
--
Score breakdown
--
Références
--
Ransomware
—
Gang
—
In-the-Wild
—
GreyNoise
—
Exploit-DB
—
OTX Pulses
—
PoC public
—
Supply Chain
—
URLhaus URLs
—
PhishTank
—
IOC Count
—
Liens d'exploitation
Threat Actor
—
Pays d'origine
—
Campagne
—
Recherche contextuelle
Techniques ATT&CK associées
Tactiques
Liens MITRE
Obligations réglementaires déclenchées
Actions recommandées
Template ticket JIRA / ServiceNow — copier/coller dans votre ITSM
--

L'écosystème

Digimoove ESN Paris — Cyber · Cloud · Automatisation IA · Observabilité NAIvigate Veille & formation IA FactualRisk est une marque de l'écosystème Digimoove
Raccourcis: / recherche • Esc fermer • f fullscreen • clic ligne = détails • CVE/CVSS = NVD • ★ = watchlist