Veille CVE

Semaine du 1 juin au 7 juin 2026

5 CVE

Critique 1 Élevée 4 Moyenne 0 Faible 0 Non évaluée 0 Tri : plus récentes
  1. CVE-2026-28318 7.5 Élevée Exploitée

    SolarWinds Serv-U

    SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update

  2. CVE-2026-45247 9.8 Critique Exploitée

    Mirasvit Full Page Cache Warmer for Magento 2 · Mirasvit full page cache warmer

    Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attackers to achieve remote code execution by supplying a crafted serialized PHP object in the CacheWarmer cookie. Attackers can exploit the unrestricted call to PHP's native unserialize() function combined with gadget chains available in Magento and its dependencies to execute arbitrary code on the server.

  3. CVE-2025-48595 8.4 Élevée Exploitée

    Google Android

    In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

  4. CVE-2022-0492 7.8 Élevée Exploitée

    kernel · Netapp h300s firmware · Netapp h410c firmware · Netapp h410s firmware

    A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

  5. CVE-2024-21182 7.5 Élevée Exploitée

    Oracle Corporation WebLogic Server · Oracle weblogic server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle WebLogic Server accessible data. CVSS 3.1 Base Score 7.5 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).