15 casos · pág. 1/1
The CERT-FR published advisory CERTFR-2026-AVI-1363 on multiple vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE). Exploitation can lead to remote arbitrary code execution, breach of data confidentiality and security policy bypass. The advisory relays the vendor's security bulletin of 21 October 2026 and lists 1…
CERT-FR published advisory CERTFR-2026-AVI-1356 on 21 October 2026 about a vulnerability in the Traefik reverse proxy. It lets an attacker compromise data confidentiality and bypass the security policy. Affected versions are Traefik 3.x before 3.7.16 and Traefik versions before 2.11.60. The advisory does not report exploitation in the wil…
The CERT-FR advisory CERTFR-2026-AVI-1358 reports multiple vulnerabilities in Apache Tomcat. According to the advisory, an attacker could exploit them to breach data confidentiality, bypass the security policy, or trigger an unspecified security issue. The advisory lists nine CVEs and does not report active exploitation. Apache published …
The French national CERT (CERT-FR, part of ANSSI) published a lessons-learned report on application data breaches. It states that in 2025 it tracked nearly 200 data breaches originating from web applications. In many cases the exfiltration relied on low-complexity attacker actions and did not exploit any technical vulnerability. The repor…
CERT-FR advisory CERTFR-2026-AVI-1339 reports multiple vulnerabilities in Stormshield Network Security (SNS). Depending on the flaw, an attacker could compromise data integrity, bypass the security policy or inject indirect remote code through cross-site scripting (XSS). The advisory refers to four Stormshield security bulletins dated 16 …
CERT-FR advisory CERTFR-2026-AVI-1330, published 16 October 2026, reports multiple vulnerabilities in Traefik. Per the advisory, they allow an attacker to compromise data confidentiality and bypass the security policy. All Traefik versions prior to v3.7.15 are affected. The advisory is based on two vendor security bulletins, GHSA-28hp-c82…
CERT-FR advisory CERTFR-2026-AVI-1310 reports multiple vulnerabilities in Citrix products, based on Citrix security bulletins dated 13 October 2026. According to the advisory, some flaws allow an attacker to achieve arbitrary code execution, privilege escalation and remote denial of service. Other listed impacts are data integrity and con…
CERT-FR advisory CERTFR-2026-AVI-1316 reports multiple vulnerabilities across Microsoft products, based on Microsoft security bulletins dated 13 October 2026. According to the advisory, some flaws allow an attacker to achieve remote arbitrary code execution, privilege escalation and remote denial of service. Other listed impacts are data …
CERT-FR advisory CERTFR-2026-AVI-1309 reports a vulnerability in Zabbix that allows an attacker to compromise data confidentiality. The advisory covers several supported branches and refers to the vendor bulletin ZBX-28169, published on 14 October 2026. No CVE identifier, exploitation status, technical detail or attribution is provided in…
CERT-FR advisory CERTFR-2026-AVI-1315 reports multiple vulnerabilities in Microsoft Azure components, published on 14 October 2026. Some of them allow remote arbitrary code execution, privilege escalation, security policy bypass and loss of data confidentiality. Microsoft published the corresponding security bulletins on 13 October 2026. …
CERT-FR advisory CERTFR-2026-AVI-1312 covers a large set of vulnerabilities in Microsoft Office, fixed in Microsoft's 13 October 2026 security updates. Exploitation can lead to remote arbitrary code execution, privilege escalation, security policy bypass and loss of data confidentiality. Microsoft states that CVE-2026-96951 is being activ…
F5 released NGINX 1.30.6 (stable) and 1.31.7 (mainline) on October 14, 2026 to fix five vulnerabilities. Three are memory-corruption bugs that F5 scores 9.2 (Critical) on CVSS v4.0, and they can crash a worker process or, in some conditions, allow code execution. The others are a TLS session-ticket flaw that can bypass client-certificate …
CERT-FR advisory CERTFR-2026-AVI-1313 reports multiple vulnerabilities in Microsoft .NET, ASP.NET Core and .NET Framework, covered by Microsoft's October 13, 2026 security bulletins for 43 CVEs. Some of them allow an attacker to achieve remote arbitrary code execution, privilege escalation and remote denial of service. The advisory also l…
CERT-FR advisory CERTFR-2026-AVI-1314 reports multiple vulnerabilities in Microsoft Windows and related components, covered by Microsoft's October 13, 2026 security bulletins (ADV260001 and dozens of CVEs). Some of them allow remote arbitrary code execution, privilege escalation, remote denial of service, security policy bypass and compro…
Ivanti released its October 2026 security update on 13 October 2026. It fixes the actively exploited Connect Secure zero-day CVE-2026-104935, a spoofing-based authentication bypass that lets remote, unauthenticated attackers execute arbitrary commands (cert.ssi.gouv.fr, darkwebinformer.com). The flaw was discovered by Volexity, which trac…
