Veille CVE

Semaine du 16 février au 22 février 2026

8 CVE

Critique 1 Élevée 3 Moyenne 0 Faible 0 Non évaluée 4 Tri : plus récentes
  1. CVE-2025-68461 – Non évaluée Exploitée

    Roundcube Webmail

    RoundCube Webmail Cross-site Scripting Vulnerability — RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document.

  2. CVE-2025-49113 – Non évaluée Exploitée

    Roundcube Webmail

    RoundCube Webmail Deserialization of Untrusted Data Vulnerability — RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php.

  3. CVE-2026-22769 – Non évaluée Exploitée

    Dell RecoverPoint for Virtual Machines (RP4VMs)

    Dell RecoverPoint for Virtual Machines (RP4VMs) Use of Hard-coded Credentials Vulnerability — Dell RecoverPoint for Virtual Machines (RP4VMs) contains an use of hard-coded credentials vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access to the underlying operating system and root-level persistence.

  4. CVE-2021-22175 – Non évaluée Exploitée

    GitLab GitLab

    GitLab Server-Side Request Forgery (SSRF) Vulnerability — GitLab contains a server-side request forgery (SSRF) vulnerability when requests to the internal network for webhooks are enabled.

  5. CVE-2026-2441 8.8 Élevée Exploitée

    Google Chrome

    Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

  6. CVE-2024-7694 7.2 Élevée Exploitée

    TeamT5 ThreatSonar Anti-Ransomware

    ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on the product platform can upload malicious files, which can be used to execute arbitrary system command on the server.

  7. CVE-2020-7796 9.8 Critique Exploitée

    Synacor zimbra collaboration suite

    Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled.

  8. CVE-2008-0015 8.8 Élevée Exploitée

    Microsoft windows 2003 server · Microsoft windows xp

    Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneRequest ActiveX control in msvidctl.dll in DirectShow, in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted web page, as exploited in the wild in July 2009, aka "Microsoft Video ActiveX Control Vulnerability."