Alertes CVE par stack

Déclare ton stack (Laravel, Node.js, Docker…) et reçois un email dès qu'une faille CVE l'affecte.

S'inscrire gratuitement Se connecter

6,191 CVE trackés

550 Critiques

1,698 High

594 Cette semaine

CVEs récents

Mis à jour quotidiennement via NVD NIST

CVE-2026-75838

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event ha...

NVD

2 weeks ago

CVE-2026-75839 MEDIUM CVSS 4.3

ArcadeDB (com.arcadedb:arcadedb-server) versions <= 26.7.3 contain an insecure direct object reference (IDOR) vulnerability in the Raft cluster-info endpoints (GetClusterHandler and PostBootstrapState...

NVD

2 weeks ago

CVE-2026-75840 HIGH CVSS 7.5

ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expressions to validate package names. Attack...

NVD

2 weeks ago

CVE-2026-75841 MEDIUM CVSS 4.3

ArcadeDB before 26.8.1 contains a denial of service vulnerability in the Cypher range() function that allows authenticated users to exhaust server heap memory. Attackers can submit oversized range() e...

NVD

2 weeks ago

CVE-2026-75842 HIGH CVSS 7.7

ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files. Attackers with read query privi...

NVD

2 weeks ago

CVE-2026-75843 CRITICAL CVSS 9.9

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scri...

NVD

2 weeks ago

CVE-2026-75844 HIGH CVSS 7.1

ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connect...

NVD

2 weeks ago

CVE-2026-75831 HIGH CVSS 7.6

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescap...

NVD

2 weeks ago

CVE-2026-75832 MEDIUM CVSS 4.3

The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in 1.0.15) contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope()...

NVD

2 weeks ago

CVE-2026-75833 MEDIUM CVSS 4.2

The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0's admin-next/API stack) before version 1.0.14 contains an open redirect weakness in SsoController::sanitizeReturnTo(). The function...

NVD

2 weeks ago

CVE-2026-75834 MEDIUM CVSS 5.4

Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). All XSS detection patterns use the PCRE /u (UTF-8)...

NVD

2 weeks ago

CVE-2026-75835 MEDIUM CVSS 4.3

Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize() (AbstractApiController.php). The function fails to consult the calling r...

NVD

2 weeks ago

CVE-2026-75836 HIGH CVSS 8.8

The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.14 fails to enforce the authorize requirement in MenubarController::executeAction(). While the GET /m...

NVD

2 weeks ago

CVE-2026-75837 CRITICAL CVSS 9.1

Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with access[admin...

NVD

2 weeks ago

CVE-2026-75774 LOW CVSS 3.7

A vulnerability was determined in karakeep-app karakeep up to 0.32.0. The impacted element is an unknown function of the file apps/web/server/auth.ts of the component OAuth Sign-In. This manipulation...

Résumé IA :
Une faille d'authentification incorrecte touche le module de connexion OAuth dans le fichier apps/web/server/auth.ts de l'application karakeep jusqu'à la version 0.32.0. Un attaquant distant peut potentiellement contourner le mécanisme d'authentification pour usurper des comptes utilisateurs, bien que l'attaque soit complexe à réaliser.

NVD

2 weeks ago

CVE-2026-75827 HIGH CVSS 8.8

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist. Attackers wit...

NVD

2 weeks ago

CVE-2026-75828 HIGH CVSS 8.7

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated edi...

NVD

2 weeks ago

CVE-2026-75829 HIGH CVSS 8.1

grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() endpoint, allowing attackers with api.pages.write permission to persist pages with process.twig enabled. Attacke...

NVD

2 weeks ago

CVE-2026-75830 HIGH CVSS 7.1

grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy() method. An incomplete fix for GHSA-qjq4-jp5...

NVD

2 weeks ago

CVE-2026-74907 MEDIUM CVSS 5.9

Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attack...

NVD

2 weeks ago

1 2 ... 89 90 91 ... 309 310

Sois alerté dès qu'une faille touche ton stack

Email automatique avec description et recommandation de patch.

Créer un compte gratuit

Alertes CVE par stack

CVEs récents

Sois alerté dès qu'une faille touche ton stack

🍪 Nous utilisons des cookies