Liste Hebdomadaire des CVE Sévères

CVE-2026-30921 - OneUptime Synthetic Monitor RCE via exposed Playwright browser object

CVE-2026-30887 - OneUptime Affected by Unsandboxed Code Execution in Probe Allows Any Project Member to Achieve RCE

CVE-2025-41709 - Command injection in power analyzer via Modbus-TCP and Modbus-RTU

CVE-2026-0953 - Tutor LMS Pro <= 3.9.5 - Authentication Bypass via Social Login

CVE-2026-30240 - Budibase PWA ZIP Upload Path Traversal Allows Reading Arbitrary Server Files Including All Environment Secrets

CVE-2026-30869 - SiYuan has a Path Traversal in /export Endpoint Allows Arbitrary File Read and Secret Leakage

CVE-2026-28431 - Misskey lacks proper authorization checks and input validation

CVE-2026-27685 - Insecure Deserialization in SAP NetWeaver Enterprise Portal Administration

CVE-2025-11158 - Hitachi Vantara Pentaho Data Integration & Analytics - Missing Authorization

CVE-2026-31816 - Budibase Universal Auth Bypass via Webhook Query Param Injection

CVE-2026-30862 - Critical Stored XSS & Privilege Escalation in Appsmith

CVE-2026-3815 - UTT HiPER 810G formApMail strcpy buffer overflow

CVE-2026-3814 - UTT HiPER 810G getOneApConfTempEntry strcpy buffer overflow

CVE-2026-25737 - Budibase Arbitrary File Upload Leading to Multiple Critical Vulnerabilities (SSRF, Stored XSS)

CVE-2026-3288 - ingress-nginx rewrite-target nginx configuration injection

CVE-2025-69219 - Apache Airflow Providers Http: Unsafe Pickle Deserialization in apache-airflow-providers-http leading to RCE via HttpOperator

CVE-2026-25045 - Budibase Critical Privilege Escalation & IDOR via Missing RBAC on User Role Management (Creator-Role)

CVE-2026-30920 - OneUptime has broken access control in GitHub App installation flow that allows unauthorized project binding

CVE-2026-25041 - Budibase has a Command Injection in PostgreSQL Dump Command

CVE-2026-0846 - Arbitrary File Read via Absolute Path Input in nltk.util.filestring()

CVE-2026-28513 - Pocket ID: OIDC authorization code validation uses AND instead of OR, allowing cross-client token exchange

CVE-2025-15568 - Command Injection Vulnerability on TP-Link Archer AXE75

CVE-2026-31802 - node-tar Symlink Path Traversal via Drive-Relative Linkpath

CVE-2025-68402 - FreshRSS has an authentication bypass due to truncated bcrypt hash [edge branch]

CVE-2026-28693 - ImageMagick has an integer overflow in DIB coder can result in out of bounds read or write