Veille CVE

Semaine du 2 février au 8 février 2026

6 CVE

Critique 0 Élevée 0 Moyenne 0 Faible 0 Non évaluée 6 Tri : plus récentes
  1. CVE-2026-24423 – Non évaluée Exploitée Rançongiciel

    SmarterTools SmarterMail

    SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability — SmarterTools SmarterMail contains a missing authentication for critical function vulnerability in the ConnectToHub API method. This could allow the attacker to point the SmarterMail instance to a malicious HTTP server which serves the malicious OS command and could lead to command execution.

  2. CVE-2025-11953 – Non évaluée Exploitée

    React Native Community CLI

    React Native Community CLI OS Command Injection Vulnerability — React Native Community CLI contains an OS command injection vulnerability which could allow unauthenticated network attackers to send POST requests to the Metro Development Server and run arbitrary executables via a vulnerable endpoint exposed by the server. On Windows, attackers can also execute arbitrary shell commands with fully controlled arguments.

  3. CVE-2025-64328 – Non évaluée Exploitée

    Sangoma FreePBX

    Sangoma FreePBX OS Command Injection Vulnerability — Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to potentially obtain remote access to the system as an asterisk user.

  4. CVE-2025-40551 – Non évaluée Exploitée

    SolarWinds Web Help Desk

    SolarWinds Web Help Desk Deserialization of Untrusted Data Vulnerability — SolarWinds Web Help Desk contains a deserialization of untrusted data vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. This could be exploited without authentication.

  5. CVE-2021-39935 – Non évaluée Exploitée

    GitLab Community and Enterprise Editions

    GitLab Community and Enterprise Editions Server-Side Request Forgery (SSRF) Vulnerability — GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API.

  6. CVE-2019-19006 – Non évaluée Exploitée

    Sangoma FreePBX

    Sangoma FreePBX Improper Authentication Vulnerability — Sangoma FreePBX contains an improper authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services provided by the FreePBX admin.