Liste Hebdomadaire des CVE Sévères

CVE-2026-4254 - Tenda AC8 HTTP Endpoint SysToolChangePwd doSystemCmd stack-based overflow

CVE-2026-4252 - Tenda AC8 IPv6 check_is_ipv6 ip address for authentication

CVE-2026-4312 - DrangSoft｜GCB/FCB Audit Software - Missing Authentication

CVE-2025-69809 - Bareiron P2R3 Memory Corruption Vulnerability

CVE-2025-62319 - Boolean-Based SQL Injection in Multiple Unica Components

CVE-2026-28430 - Chamilo LMS Vulnerable to Unauthenticated SQL Injection in chamiko-lms model.ajax.php

CVE-2026-32267 - Craft CMS Vulnerable to Privilege Escalation/Bypass through UsersController->actionImpersonateWithToken()

CVE-2025-69808 - Bareiron P2R3 Out-of-Bounds Memory Access Denial of Service

CVE-2026-27962 - Authlib JWS JWK Header Injection: Signature Verification Bypass

CVE-2026-23489 - Fields GLPI plugin vulnerable to RCE in dropdown generation

CVE-2026-4227 - LB-LINK BL-WR9000 get_hidessid_cfg sub_44D844 buffer overflow

CVE-2026-4226 - LB-LINK BL-WR9000 get_virtual_cfg sub_44E8D0 stack-based overflow

CVE-2026-4214 - D-Link DNS-1550-04 app_mgr.cgi UPnP_AV_Server_Path_Setting stack-based overflow

CVE-2026-4213 - D-Link DNS-1550-04 gui_mgr.cgi cgi_myfavorite_verify stack-based overflow

CVE-2026-30881 - Chamilo LMS: SQL Injection in the statistics AJAX endpoint

CVE-2026-30875 - Chamilo LMS: Authenticated RCE via H5P Import

CVE-2025-69784 - OpenEDR Kernel Driver DLL Injection Privilege Escalation

CVE-2026-29522 - ZwickRoell Test Data Management < 3.0.8 Path Traversal LFI

CVE-2026-32264 - Craft CMS vulnerable to behavior injection RCE ElementIndexesController and FieldsController

CVE-2026-32263 - Craft CMS vulnerable to behavior injection RCE via EntryTypesController

CVE-2026-32261 - RCE via SSTI for users with permissions to access the Craft CMS Webhooks plugin

CVE-2026-4255 - DLL Injection Privilege Escalation

CVE-2026-0708 - Libucl: libucl: denial of service via embedded null byte in ucl input

CVE-2026-28490 - Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle

CVE-2026-28498 - Authlib: Fail-Open Cryptographic Verification in OIDC Hash Binding