Exploitation active — CVE exploitées in-the-wild

ITW / KEV actifs

exploitation confirmée

GreyNoise trending

scan massif actif

PoC publics

dans la période

Exploit-DB nouveaux

PoC RSS

📡 ITW confirmé

CVE-2026-60004NOUVEAUKEVITW

Gitea / GiteaCVSS 9.8EPSS 0.824Score 281

Gitea Code Injection Vulnerability

CVE-2026-8037KEVITW

Progress / LoadMasterCVSS 9.8EPSS 0.996Score 253

Progress LoadMaster Command Injection Vulnerability

CVE-2021-23758MAJKEVITW

Ajax.NET Professional / Ajax.NET ProfessionalCVSS 9.8EPSS 0.836Score 244

Ajax.NET Professional Deserialization of Untrusted Data Vulnerability

CVE-2026-63077KEVITW

JetBrains / TeamCityCVSS 9.8EPSS 0.847Score 235

JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

CVE-2019-1068MAJKEVITW

Microsoft / SQL ServerCVSS 8.8EPSS 0.528Score 234

Microsoft SQL Server Remote Code Execution Vulnerability

CVE-2026-34486KEVITW

Apache / TomcatCVSS 7.5EPSS 0.986Score 233

Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

CVE-2026-72898KEVITW

Metabase / MetabaseCVSS 10.0EPSS 0.792Score 230

Metabase SQL Injection Vulnerability

CVE-2026-21962MAJKEVITW

Oracle / HTTP Server and Oracle Weblogic Server Proxy Plug-inCVSS 10.0EPSS 0.420Score 228

Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability

CVE-2026-33824KEVITW

Microsoft / Internet Key Exchange (IKE) Service ExtensionsCVSS 9.8EPSS 0.727Score 216

Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability

CVE-2023-49105MAJKEVITW

ownCloud / ownCloudCVSS 9.8EPSS 0.412Score 191

ownCloud Improper Authentication Vulnerability

CVE-2026-59310KEVITW

Broadcom / VMware vCenterCVSS 9.8EPSS 0.459Score 189

Broadcom VMware vCenter Path Traversal Vulnerability

CVE-2026-18577KEVITW

N-able / N-centralCVSS 8.1EPSS 0.541Score 183

N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

CVE-2026-9198KEVITW

IBM / LangflowCVSS 9.8EPSS 0.347Score 175

IBM Langflow Code Injection Vulnerability

CVE-2026-55040KEVITW

Microsoft / SharePointCVSS 9.1EPSS 0.397Score 172

Microsoft SharePoint Weak Authentication Vulnerability

CVE-2026-18556KEVITW

N-able / N-centralCVSS 7.4EPSS 0.402Score 163

N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

CVE-2026-64849KEVITW

MLflow / MLflowCVSS 9.3EPSS 0.164Score 160

MLflow Server-Side Request Forgery Vulnerability

CVE-2026-73570MAJKEVITW

Synacor / Zimbra Collaboration Suite (ZCS)CVSS 8.9EPSS 0.015Score 148

Zimbra Collaboration Suite (ZCS) OS Command Injection Vulnerability

CVE-2025-62593KEVITW

Ray-Project / RayCVSS 8.8EPSS 0.169Score 148

Ray-Project Ray Code Injection Vulnerability

CVE-2026-65400KEVITW

Apple / macOSCVSS 9.8EPSS 0.099Score 146

Apple macOS Improper Authentication Vulnerability

CVE-2026-8452MAJKEVITW

Citrix / NetScaler ADC and NetScaler GatewayCVSS 9.8EPSS 0.016Score 136

Citrix NetScaler ADC and NetScaler Gateway Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability

📡 GreyNoise — Scans massifs actifs

GreyNoise non configuré — ajoutez GREYNOISE_API_KEY pour voir les scans massifs actifs.

💣 Exploit-DB — PoC publics récents

[remote] CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE

📅 25 August 2026CVE-2026-42167EDB-52658

CVE-2026-42167 - ProFTPD mod_sql post-authentication SQLi - RCE

[remote] PCMan 2.0.7 - Buffer Overflow

📅 18 August 2026EDB-52657

PCMan 2.0.7 - Buffer Overflow

[dos] NanaZip 6.5 - DoS

📅 18 August 2026EDB-52656

NanaZip 6.5 - DoS

[webapps] flyto-core 2.26.7 - Arbitrary File Write

📅 18 August 2026EDB-52655

flyto-core 2.26.7 - Arbitrary File Write

[webapps] Nodemailer 9.0.0 - File Read/ SSRF

📅 18 August 2026EDB-52654

Nodemailer 9.0.0 - File Read/ SSRF

[webapps] Linuxfabrik monitoring_plugins_6.0.0 - SSRF

📅 18 August 2026EDB-52653

Linuxfabrik monitoring_plugins_6.0.0 - SSRF

[dos] NanaZip 6.5 - DoS

📅 17 August 2026EDB-52652

NanaZip 6.5 - DoS

[webapps] flyto_core 2.26.7 - Server-Side Request Forgery

📅 17 August 2026EDB-52651

flyto_core 2.26.7 - Server-Side Request Forgery

[webapps] Probo 0.222.2 - IDOR

📅 17 August 2026EDB-52650

Probo 0.222.2 - IDOR

[webapps] webpack_devserver 5.2.5 - CSRF

📅 17 August 2026EDB-52649

webpack_devserver 5.2.5 - CSRF

[remote] phpSysInfo 3.4.5 - IP Allowlist Bypass

📅 17 August 2026EDB-52648

phpSysInfo 3.4.5 - IP Allowlist Bypass

[dos] Nmap 7.99 - Extension Header Integer Underflow

📅 17 August 2026EDB-52647

Nmap 7.99 - Extension Header Integer Underflow

[webapps] Duplicati 2.2.0.3 - JWT Signing Key Leak

📅 17 August 2026EDB-52646

Duplicati 2.2.0.3 - JWT Signing Key Leak

[webapps] Joomla JCE_2.9.15 - Remote Code Execution

📅 17 August 2026EDB-52645

Joomla JCE_2.9.15 - Remote Code Execution

[remote] ipTIME A3004T - Remote Code Execution

📅 17 August 2026EDB-52644

ipTIME A3004T - Remote Code Execution

[remote] D-Link DNS_340L - OS Command Injection

📅 17 August 2026EDB-52643

D-Link DNS_340L - OS Command Injection

[webapps] WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload

📅 17 August 2026EDB-52642

WooCommerce 1.5.0 - Unauthenticated Arbitrary File Upload

[webapps] Apache Gravitino 1.2.1 - SSRF

📅 11 August 2026EDB-52641

Apache Gravitino 1.2.1 - SSRF

[webapps] Blocksy Companion 2.1.46 - RCE

📅 11 August 2026EDB-52640

Blocksy Companion 2.1.46 - RCE

[remote] PraisonAI praisonaiagents 1.6.77 - Remote Code Execution

📅 11 August 2026EDB-52639

PraisonAI praisonaiagents 1.6.77 - Remote Code Execution

🔬 CVEs avec PoC connu

CVE-2026-35397MAJPoC

pip / jupyter-serverCVSS 7.1EPSS 0.006Score 56

Jupyter Server: Path Traversal via incorrect startswith() root directory check allows access to sibling directories

L'écosystème