Accueil
Publications CVE
Les vulnérabilités découvertes par notre équipe R&D et publiées en divulgation coordonnée.
2026
High
Microsoft HEVC Video Extension: Two Heap Out-of-Bounds Writes in the Decoder, via a Chroma Format Mismatch and an Unbounded QP Map Index
Jean-Jamil KHALIFÉ
CVE-2026-114165CVE-2026-114167
High
Microsoft Windows Remote Access API: Privilege Escalation to SYSTEM via a User-Controlled Custom Dialer Loaded on Hang-Up
Jean-Jamil KHALIFÉ
CVE-2026-119853
Critical
Microsoft Windows Search: Heap Out-of-Bounds Write in the In-Box HTML Filter via GB18030 Value Conversion
Jean-Jamil KHALIFÉ
CVE-2026-116928
Medium
Silverstripe CMS: Missing canCreate() Check in GridFieldDetailForm leading to Unauthorised Record Creation
Jean-Jamil KHALIFÉ
CVE-2026-88989GHSA-3qh3-54qg-gpq3
Medium
Silverstripe Userforms: Stored Cross-Site Scripting in the Required-Field Label
Jean-Jamil KHALIFÉ
SS-2026-005
Medium
Silverstripe CMS: Incomplete Sanitisation of SVG Data URIs leading to Stored Cross-Site Scripting
Jean-Jamil KHALIFÉ
CVE-2026-88988GHSA-xwg4-8hqh-79jq
High
sgalinski Cookie Consent for TYPO3: SQL Injection in the Backend Consent History Module
Jean-Jamil KHALIFÉ
CVE-2026-112064TYPO3-EXT-SA-2026-029
Critical
Microsoft Windows System Information Console: Heap Out-of-Bounds Write via a Case-Sensitivity Mismatch in .nfo Row Counting
Jean-Jamil KHALIFÉ
CVE-2026-70157
Medium
WordPress core: Private parent-post title disclosure in the attachment edit screen (attachment_submitbox_metadata, unfixed sibling of the r61884 read_post fix)
Jean-Jamil KHALIFÉ
Critical
Microsoft HEVC Video Extension: Heap Out-of-Bounds Write via an Unclamped NumDeltaPocs in st_ref_pic_set
Jean-Jamil KHALIFÉ
CVE-2026-58599
Critical
Microsoft Raw Image Extension: Out-of-Bounds Write in parse_kodak_ifd Reached by RAW Thumbnail Rendering
Jean-Jamil KHALIFÉ
CVE-2026-69649
Medium
TYPO3 CMS: Missing Authorization in the Backend Localization Wizard Leading to Information Disclosure
Jean-Jamil KHALIFÉ
CVE-2026-77132TYPO3-CORE-SA-2026-022
Medium
Contao CMS: Unrestricted Activation Email Resending and Registration Oracle
Jean-Jamil KHALIFÉ
CVE-2026-107843
Critical
Contao Comments Bundle: Zero-Click Stored Cross-Site Scripting in the Back Office Comment List
Jean-Jamil KHALIFÉ
CVE-2026-107845
Medium
Contao CMS: Improper Access Control in the CSV Import Wizard
Jean-Jamil KHALIFÉ
CVE-2026-104882
Medium
Contao CMS: Unauthenticated Path Traversal in the Images Controller
Jean-Jamil KHALIFÉ
CVE-2026-107844
Low
Contao CMS: Cross-Site Request Forgery in Custom Back End Actions
Jean-Jamil KHALIFÉ
CVE-2026-107848
Medium
Contao Newsletter Bundle: Improper Access Control in the Newsletter Module
Jean-Jamil KHALIFÉ
CVE-2026-104881
Medium
Contao CMS: Improper Access Control in the Preview Links Module
Jean-Jamil KHALIFÉ
CVE-2026-107850
Medium
Contao CMS: Stored Cross-Site Scripting in the Front End Search Results
Jean-Jamil KHALIFÉ
CVE-2026-104884
High
Contao CMS: Privilege Escalation to Code Execution through the Theme Import
Jean-Jamil KHALIFÉ
CVE-2026-104883
Critical
Shopware 6: App Script Sandbox Escape leading to Arbitrary PHP and OS Command Execution
Jean-Jamil KHALIFÉ
GHSA-6qhw-38wm-7g7h
High
Shopware 6: Path Traversal via media.fileExtension leading to Remote Code Execution
Jean-Jamil KHALIFÉ
GHSA-p67w-3mq7-rw2g
High
Shopware 6: Pre-Authentication SQL Injection in the Store API
Jean-Jamil KHALIFÉ
GHSA-p37c-pm9p-7vm5
Medium
WordPress core: Unauthenticated post-slug enumeration in redirect_guess_404_permalink (bypass of the CVE-2023-5692 fix)
Jean-Jamil KHALIFÉ
Medium
Grav Form Plugin: Stored Cross-Site Scripting in Radio and Toggle Option Labels
Jean-Jamil KHALIFÉ
CVE-2026-72821
2023
High
Netskope Client Service Local Privilege Escalation (USER to SYSTEM)
Jean-Jamil KHALIFÉ
CVE-2023-2270
Critical
NETGEAR Nighthawk R7000P upnpd Pre-Authentication Stack Buffer Overflow (Remote Code Execution)
Jean-Jamil KHALIFÉ
CVE-2022-48322
2022
High
NETGEAR R6900P and R7000P: post-authentication buffer overflow (PSV-2022-0156)
Jean-Jamil KHALIFÉ
High
NETGEAR Nighthawk R7000P: multiple post-authentication vulnerabilities
Jean-Jamil KHALIFÉ
High
NETGEAR Nighthawk R7000P aws_json Unauthenticated Double Stack Buffer Overflow (Pre-Auth RCE)
Jean-Jamil KHALIFÉ
CVE-2022-48176
High
NETGEAR Multiple Products upnpd Pre-Authentication Buffer Overflow (Pre-Auth RCE)
Jean-Jamil KHALIFÉ
CVE-2022-27643
Aucune advisory ne correspond à votre recherche.
Notre R&D traque les vulnérabilités.
Recherche de 0-day, reverse engineering, divulgation coordonnée : découvrez notre pôle R&D.
Découvrir notre R&D