§ Veille · exploitation active

DERNIÈRE SYNCHRO · 03 juil. 2026, 09:49 · SOURCES PUBLIQUES

CATALOGUE KEV · il y a 59 minutes // SCORES EPSS/CVSS · il y a 59 minutes // VEILLE · il y a 42 minutes // INFRASTRUCTURE C2 · il y a 42 minutes

Liées au ransomware ET forte probabilité d'exploitation (EPSS ≥ 50 %)

CVE-2021-21985 100%

VMware · vCenter Server

CVE-2021-22005 100%

VMware · vCenter Server

CVE-2019-11510 100%

Ivanti · Pulse Connect Secure

CVE-2021-26855 100%

Microsoft · Exchange Server

CVE-2021-34473 100%

Microsoft · Exchange Server

CVE-2019-0708 100%

Microsoft · Remote Desktop Services

CVE-2018-13379 100%

Fortinet · FortiOS

CVE-2021-35464 100%

ForgeRock · Access Management (AM)

CVE-2026-45659 Microsoft · SharePoint Server· Désérialisation de données non fiables 3% 01 juil. 2026 CVE-2026-48558 SimpleHelp · SimpleHelp· CWE-347 1% 29 juin 2026 CVE-2026-20230 Cisco · Unified Communications Manager· Falsification de requête côté serveur (SSRF) 42% 25 juin 2026 CVE-2026-12569 PTC · Windchill and FlexPLM· Validation d’entrée insuffisante 1% 25 juin 2026 CVE-2026-34908 Ubiquiti · UniFi OS· Contrôle d’accès défaillant 2% 23 juin 2026 CVE-2026-34909 Ubiquiti · UniFi OS· Traversée de répertoire 2% 23 juin 2026 CVE-2026-34910 Ubiquiti · UniFi OS· Validation d’entrée insuffisante 79% 23 juin 2026 CVE-2025-67038 Lantronix · EDS5000· Injection de commande système (OS) 1% 23 juin 2026 CVE-2026-20253 Splunk · Enterprise· Authentification manquante 88% 18 juin 2026 CVE-2026-48907 Widget Factory · Joomla Content Editor · Contrôle d’accès défaillant 80% 16 juin 2026 CVE-2026-20262 Cisco · Catalyst SD-WAN Manager· Traversée de répertoire 8% 15 juin 2026 CVE-2026-54420 LiteSpeed · cPanel Plugin· CWE-61 1% 15 juin 2026

Agrégat de sources publiques · titre + extrait + lien vers la source

The Hacker Newsdans 3 heures

PamStealer Uses Fake Maccy Sites and PAM Checks to Steal Mac Login Passwords

Cybersecurity researchers have flagged a new macOS information stealer called PamStealer that employs a series of clever tricks to infect systems and siphon sensitive data. The stealer, discovered by Jamf Threat Labs, i...

@cveNotifyil y a 1 heure

🚨 CVE-2026-9756The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType'...

🚨 CVE-2026-9756The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Headline Block 'linkMetaFieldType' Dynamic Link Attribute in all versions up to, and including, 2.2.1 due to insufficient input sanitiz...

@cveNotifyil y a 1 heure

🚨 CVE-2026-4804The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting via post meta values in all versions up to, and i...

🚨 CVE-2026-4804The Zakra theme for WordPress is vulnerable to Stored Cross-Site Scripting via post meta values in all versions up to, and including, 4.2.0. This is due to the theme registering three post meta fields (zakra_menu_item_color,...

@cveNotifyil y a 1 heure

🚨 CVE-2026-47896Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.N...

🚨 CVE-2026-47896Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library).This issue affects Apache Lucene.Net.Replicator: from 4.8.0-beta00005 through...

@cveNotifyil y a 1 heure

🚨 CVE-2026-35159Dell Client Platform BIOS contains an Authentication Bypass by Primary Weakness vulnerability. An unauthenticated attacker...

🚨 CVE-2026-35159Dell Client Platform BIOS contains an Authentication Bypass by Primary Weakness vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure...

@cveNotifyil y a 1 heure

🚨 CVE-2026-11900The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Insecure Direct Object Reference in versio...

🚨 CVE-2026-11900The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to and including 2.8.16 via the 'data' attribute of the [adinserter] shortcode. This is due to...

@cveNotifyil y a 1 heure

🚨 CVE-2026-11778The The CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x plugin for WordPress is vulnerable to arbitrar...

🚨 CVE-2026-11778The The CURCY – Multi Currency for WooCommerce – Smoothly on WooCommerce 9.x plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.2.14. This is due to the software allo...

@cveNotifyil y a 1 heure

🚨 CVE-2026-11398The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to authorization byp...

🚨 CVE-2026-11398The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.6.1. This is due to the plugin not properly verifying th...

@cveNotifyil y a 1 heure

🚨 CVE-2026-35075An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full acce...

🚨 CVE-2026-35075An unauthenticated remote attacker can recover a default, hard coded password from a firmware image and thus gain full access to all affected devices.🎖@cveNotify

The Registeril y a 2 heures

User swore hacker called General Failure had invaded his PC

Maybe they were looking for Private Data

@cveNotifyil y a 2 heures

🚨 CVE-2026-9230The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass in...

🚨 CVE-2026-9230The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.1.4. This is due to the plugin not properly verifying that a u...

@cveNotifyil y a 2 heures

🚨 CVE-2026-9148The Comments – wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the guest commenter 'Website'...

🚨 CVE-2026-9148The Comments – wpDiscuz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the guest commenter 'Website' field in versions up to, and including, 7.6.56 This is due to insufficient output escaping in the ge...

@cveNotifyil y a 2 heures

🚨 CVE-2026-8804Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive f...

🚨 CVE-2026-8804Puppet resource_api (shipped in Puppet Core 8.x and Puppet Enterprise 2023.8.x and 2025.x) does not preserve the sensitive flag on parameters defined via the resource-api, causing values such as passwords to be stored in cle...

@cveNotifyil y a 2 heures

🚨 CVE-2026-8351The RTMKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Heading widget's 'Background T...

🚨 CVE-2026-8351The RTMKit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Advanced Heading widget's 'Background Text' parameter in versions up to, and including, 2.0.7 This is due to insufficient output escaping o...

@cveNotifyil y a 2 heures

🚨 CVE-2026-47898Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common librar...

🚨 CVE-2026-47898Improper Restriction of XML External Entity Reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library).This issue affects Apache Lucene.Net.Analysis.Common: from 4.8.0-beta00005 before 4.8.0-beta00018...

@cveNotifyil y a 2 heures

🚨 CVE-2026-47897Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.N...

🚨 CVE-2026-47897Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Lucene.Net (Lucene.Net.Replicator library).This issue affects Apache Lucene.Net.Replicator: from 4.8.0-beta00005 before...

@cveNotifyil y a 2 heures

🚨 CVE-2026-14544A flaw was found in HPLIP (HP Linux Imaging and Printing Software). This vulnerability, an incomplete fix for CVE-2026-8631...

🚨 CVE-2026-14544A flaw was found in HPLIP (HP Linux Imaging and Printing Software). This vulnerability, an incomplete fix for CVE-2026-8631, may allow a remote attacker to escalate privileges or achieve arbitrary code execution. This can o...

@cveNotifyil y a 3 heures

🚨 CVE-2026-9547When a libcurl-based application performs transfers via `SCP://` or `SFTP://`and utilizes the `CURLOPT_SSH_KEYFUNCTION` call...

🚨 CVE-2026-9547When a libcurl-based application performs transfers via `SCP://` or `SFTP://`and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept anuntrusted server. This vulnerability occurs when a server presents a...