Liste Hebdomadaire des CVE Sévères

CVE-2026-6195 - Totolink A7100RU CGI cstecgi.cgi setPasswordCfg os command injection

CVE-2026-27681 - SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse

CVE-2026-40288 - PraisonAI: Critical RCE via `type: job` workflow YAML

CVE-2026-6264 - Critical Security fix for the Talend JobServer and Talend Runtime

CVE-2026-22564 - "UniFi Play Improper Access Control SSH Enablement Vulnerability"

CVE-2026-22563 - "UniFi Play PowerAmp and Audio Port Command Injection Vulnerability"

CVE-2026-22562 - "Ubiquiti UniFi Play Path Traversal Remote Code Execution Vulnerability"

CVE-2026-40044 - Pachno 1.0.6 FileCache Deserialization Remote Code Execution

CVE-2026-40042 - Pachno 1.0.6 Wiki TextParser XML External Entity Injection

CVE-2026-23891 - Decidim has a Cross-site scripting (XSS) vulnerability via user name field

CVE-2026-40313 - PraisonAI: ArtiPACKED Vulnerability via GitHub Actions Credential Persistence

CVE-2026-40289 - PraisonAI Browser Server allows unauthenticated WebSocket clients to hijack connected extension sessions

CVE-2026-4365 - LearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion

CVE-2026-6100 - Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure

CVE-2026-6200 - Tenda F456 webtypelibrary formwebtypelibrary stack-based overflow

CVE-2026-6199 - Tenda F456 qossetting fromqossetting stack-based overflow

CVE-2026-6198 - Tenda F456 NatStaticSetting fromNatStaticSetting stack-based overflow

CVE-2026-6197 - Tenda F456 AdvSetWrlsafeset formWrlsafeset stack-based overflow

CVE-2026-6196 - Tenda F456 exeCommand fromexeCommand stack-based overflow

CVE-2026-6194 - Totolink A3002MU HTTP Request formWlanSetup sub_410188 stack-based overflow

CVE-2026-40040 - Pachno 1.0.6 Unrestricted File Upload Remote Code Execution

CVE-2026-32272 - Craft Commerce: Blind SQL Injection via hasVariant/hasProduct

CVE-2026-40287 - PraisonAI has RCE via Automatic tools.py Import

CVE-2026-32316 - jq: Integer overflow in jvp_string_append() allows Heap-based Buffer Overflow

CVE-2026-28291 - simple-git has Command Execution via Option-Parsing Bypass