Veille CVE

Semaine du 26 janvier au 1 février 2026

7 CVE

Critique 4 Élevée 2 Moyenne 0 Faible 0 Non évaluée 1 Tri : plus récentes
  1. CVE-2026-1281 – Non évaluée Exploitée

    Ivanti Endpoint Manager Mobile (EPMM)

    Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability — Ivanti Endpoint Manager Mobile (EPMM) contains a code injection vulnerability that could allow attackers to achieve unauthenticated remote code execution.

  2. CVE-2026-24858 9.8 Critique Exploitée

    Fortinet FortiWeb · Fortinet FortiNAC-F · Fortinet FortiOS · Fortinet FortiAnalyzer

    An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.5, FortiAnalyzer 7.4.0 through 7.4.9, FortiAnalyzer 7.2.0 through 7.2.11, FortiAnalyzer 7.0.0 through 7.0.15, FortiManager 7.6.0 through 7.6.5, FortiManager 7.4.0 through 7.4.9, FortiManager 7.2.0 through 7.2.11, FortiManager 7.0.0 through 7.0.15, FortiNAC-F 7.6.3 through 7.6.5, FortiOS 7.6.0 through 7.6.5, FortiOS 7.4.0 through 7.4.10, FortiOS 7.2.0 through 7.2.12, FortiOS 7.0.0 through 7.0.18, FortiProxy 7.6.0 through 7.6.4, FortiProxy 7.4.0 through 7.4.12, FortiProxy 7.2.0 through 7.2.15, FortiProxy 7.0.0 through 7.0.22, FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow an attacker with a FortiCloud account and a registered device to log into other devices registered to other accounts, if FortiCloud SSO authentication is enabled on those devices.

  3. CVE-2026-21509 7.8 Élevée Exploitée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office LTSC 2021

    Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.

  4. CVE-2026-23760 9.8 Critique Exploitée Rançongiciel

    SmarterTools SmarterMail

    SmarterTools SmarterMail versions prior to build 9511 contain an authentication bypass vulnerability in the password reset API. The force-reset-password endpoint permits anonymous requests and fails to verify the existing password or a reset token when resetting system administrator accounts. An unauthenticated attacker can supply a target administrator username and a new password to reset the account, resulting in full administrative compromise of the SmarterMail instance. NOTE: SmarterMail system administrator privileges grant the ability to execute operating system commands via built-in management functionality, effectively providing administrative (SYSTEM or root) access on the underlying host.

  5. CVE-2026-24061 9.8 Critique Exploitée

    GNU Inetutils · Debian debian linux

    telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.

  6. CVE-2025-52691 10.0 Critique Exploitée Rançongiciel

    SmarterTools SmarterMail

    Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload arbitrary files to any location on the mail server, potentially enabling remote code execution.

  7. CVE-2018-14634 7.8 Élevée Exploitée

    The Linux Foundation kernel · Paloaltonetworks pan-os · F5 big-ip access policy manager · F5 big-ip advanced firewall manager

    An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable.