Veille CVE

Semaine du 20 octobre au 26 octobre 2025

8 CVE

Critique 1 Élevée 3 Moyenne 0 Faible 0 Non évaluée 4 Tri : plus récentes
  1. CVE-2025-59287 9.8 Critique Exploitée

    Microsoft Windows Server 2012 · Microsoft Windows Server 2012 (Server Core installation) · Microsoft Windows Server 2012 R2 · Microsoft Windows Server 2012 R2 (Server Core installation)

    Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.

  2. CVE-2025-54236 – Non évaluée Exploitée

    Adobe Commerce and Magento

    Adobe Commerce and Magento Improper Input Validation Vulnerability — Adobe Commerce and Magento Open Source contain an improper input validation vulnerability that could allow an attacker to take over customer accounts through the Commerce REST API.

  3. CVE-2025-61932 – Non évaluée Exploitée

    Motex LANSCOPE Endpoint Manager

    Motex LANSCOPE Endpoint Manager Improper Verification of Source of a Communication Channel Vulnerability — Motex LANSCOPE Endpoint Manager contains an improper verification of source of a communication channel vulnerability allowing an attacker to execute arbitrary code by sending specially crafted packets.

  4. CVE-2025-61884 7.5 Élevée Exploitée Rançongiciel

    Oracle Corporation Oracle Configurator · Oracle configurator

    Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Runtime UI). Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Configurator. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Configurator accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

  5. CVE-2025-33073 8.8 Élevée Exploitée

    Microsoft Windows 10 Version 1507 · Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2

    Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.

  6. CVE-2022-48503 8.8 Élevée Exploitée

    Apple macOS · Apple tvOS · Apple Safari · Apple watchOS

    The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing web content may lead to arbitrary code execution.

  7. CVE-2025-2747 – Non évaluée Exploitée

    Kentico Xperience CMS

    Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability — Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.

  8. CVE-2025-2746 – Non évaluée Exploitée

    Kentico Xperience CMS

    Kentico Xperience CMS Authentication Bypass Using an Alternate Path or Channel Vulnerability — Kentico Xperience CMS contains an authentication bypass using an alternate path or channel vulnerability that could allow an attacker to control administrative objects.