Liste Hebdomadaire des CVE Sévères

CVE-2026-8836 - lwIP snmpv3 USM snmp_msg.c snmp_parse_inbound_frame stack-based overflow

CVE-2026-42822 - Azure Local Disconnected Operations (ALDO) Elevation of Privilege Vulnerability

CVE-2026-45829 - ChromaDB Remote Code Injection Vulnerability

CVE-2026-27130 - Dokploy has Command Injection in its Service Operations

CVE-2026-4885 - Piotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload

CVE-2026-8838 - Remote Code Execution via eval() Injection in amazon-redshift-python-driver

CVE-2026-25244 - WebdriverIO has Command Injection in the BrowserStack Service

CVE-2026-7304 - CVE-2026-7304

CVE-2026-2611 - Improper Origin Validation in mlflow/mlflow

CVE-2026-46725 - Remote Code Execution in extension "Content Element Selector" (ceselector)

CVE-2026-41948 - Dify v1.14.1 Path Traversal via Plugin Daemon Internal API Access

CVE-2026-45230 - DumbAssets 1.0.11 Path Traversal File Deletion via /api/delete-file

CVE-2026-41947 - Dify v1.14.1 Authorization Bypass via Trace Configuration Endpoints

CVE-2026-27648 - web_webview has an out-of-bounds write vulnerability

CVE-2026-45495 - Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

CVE-2026-41085 - Thermo Fisher Scientific Torrent Suite Dx Privilege Escalation Vulnerability

CVE-2025-57282 - Ngrok Command Injection Vulnerability

CVE-2026-8851 - SOGo 5.12.7 SQL Injection via addUserInAcls endpoint

CVE-2026-26978 - Free PBX backup: Deserialization of Untrusted Data in admin/modules/backup/Models/BackupSplFileInfo.php

CVE-2026-25781 - kernel_liteos_a has an out-of-bounds write vulnerability

CVE-2026-8827 - SQL Injection in extension "Address List" (tt_address)

CVE-2026-8726 - SQL Injection in extension "News system" (news)

CVE-2026-22810 - Joplin: Path traversal in OneNote importer allows overwriting arbitrary files

CVE-2026-41949 - Dify v1.14.1 Authorization Bypass via File Preview Endpoint

CVE-2026-24792 - web_webview has a Race Condition vulnerability