Liste Hebdomadaire des CVE Sévères

CVE-2026-32714 - SciTokens vulnerable to SQL Injection in KeyCache

CVE-2026-3300 - Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field

CVE-2026-4257 - Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality

CVE-2026-31946 - OpenOLAT: Authentication bypass via forged JWT in OIDC implicit flow

CVE-2026-33026 - nginx-ui Backup Restore Allows Tampering with Encrypted Backups

CVE-2026-30880 - baserCMS: OS command injection vulnerability in installer

CVE-2026-34714 - Vim Tabpanel Expression Injection

CVE-2026-30877 - baserCMS: OS Command Injection in the baserCMS Update Functionality

CVE-2026-21861 - baserCMS: OS Command Injection Leading to Remote Code Execution (RCE)

CVE-2026-34558 - CI4MS: Methods Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CVE-2026-34557 - CI4MS: Permissions Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CVE-2026-5156 - Tenda CH22 Parameter QuickIndex formQuickIndex stack-based overflow

CVE-2026-5155 - Tenda CH22 Parameter AdvSetWan fromAdvSetWan stack-based overflow

CVE-2026-5154 - Tenda CH22 Parameter setcfm fromSetCfm stack-based overflow

CVE-2026-5152 - Tenda CH22 createFileName formCreateFileName stack-based overflow

CVE-2026-34040 - Moby: AuthZ plugin bypass with oversized request body

CVE-2026-5130 - Debugger & Troubleshooter <= 1.3.2 - Unauthenticated Privilege Escalation to Administrator via Cookie Manipulation

CVE-2026-28228 - OpenOLAT: Server-Side Template Injection (SSTI) in Velocity templates allows Remote Code Execution

CVE-2026-27018 - Gotenberg: Chromium deny-list bypass via case-insensitive URL scheme

CVE-2025-32957 - baserCMS: unsafe File Upload Leading to Remote Code Execution (RCE)

CVE-2026-31831 - Tautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpoint

CVE-2026-34042 - act: actions/cache server allows malicious cache injection

CVE-2026-32877 - Botan: Heap Buffer Over-read in SM2 Decryption via Undersized C3 Hash Field

CVE-2026-32727 - SciTokens: Authorization Bypass via Path Traversal in Scope Validation

CVE-2026-32716 - SciTokens: Authorization Bypass via Incorrect Scope Path Prefix Checking