Veille CVE

Novembre 2025

11 CVE

Critique 3 Élevée 1 Moyenne 1 Faible 0 Non évaluée 6 Tri : plus récentes
  1. CVE-2021-26829 5.4 Moyenne Exploitée

    Scadabr scadabr

    OpenPLC ScadaBR through 0.9.1 on Linux and through 1.12.4 on Windows allows stored XSS via system_settings.shtm.

  2. CVE-2025-61757 – Non évaluée Exploitée

    Oracle Fusion Middleware

    Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability — Oracle Fusion Middleware contains a missing authentication for critical function vulnerability, allowing unauthenticated remote attackers to take over Identity Manager.

  3. CVE-2025-13223 – Non évaluée Exploitée

    Google Chromium V8

    Google Chromium V8 Type Confusion Vulnerability — Google Chromium V8 contains a type confusion vulnerability that allows for heap corruption.

  4. CVE-2025-58034 – Non évaluée Exploitée

    Fortinet FortiWeb

    Fortinet FortiWeb OS Command Injection Vulnerability — Fortinet FortiWeb contains an OS command Injection vulnerability that may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTTP requests or CLI commands.

  5. CVE-2025-64446 9.8 Critique Exploitée

    Fortinet FortiWeb

    A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an attacker to execute administrative commands on the system via crafted HTTP or HTTPS requests.

  6. CVE-2025-62215 7.0 Élevée Exploitée

    Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 version 22H3

    Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.

  7. CVE-2025-12480 9.1 Critique Exploitée

    TrioFox · Gladinet triofox

    Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete.

  8. CVE-2025-9242 9.8 Critique Exploitée

    WatchGuard Fireware OS · Watchguard fireware

    An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code. This vulnerability affects both the mobile user VPN with IKEv2 and the branch office VPN using IKEv2 when configured with a dynamic gateway peer. If the Firebox was previously configured with the mobile user VPN with IKEv2 or a branch office VPN using IKEv2 to a dynamic gateway peer, and both of those configurations have since been deleted, that Firebox may still be vulnerable if a branch office VPN to a static gateway peer is still configured.

  9. CVE-2025-21042 – Non évaluée Exploitée

    Samsung Mobile Devices

    Samsung Mobile Devices Out-of-Bounds Write Vulnerability — Samsung mobile devices contain an out-of-bounds write vulnerability in libimagecodec.quram.so. This vulnerability could allow remote attackers to execute arbitrary code.

  10. CVE-2025-48703 – Non évaluée Exploitée

    CWP Control Web Panel

    CWP Control Web Panel OS Command Injection Vulnerability — CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.

  11. CVE-2025-11371 – Non évaluée Exploitée

    Gladinet CentreStack and Triofox

    Gladinet CentreStack and Triofox Files or Directories Accessible to External Parties Vulnerability — Gladinet CentreStack and Triofox contains a files or directories accessible to external parties vulnerability that allows unintended disclosure of system files.