Veille CVE

Semaine du 8 juin au 14 juin 2026

7 CVE

Critique 2 Élevée 0 Moyenne 0 Faible 0 Non évaluée 5 Tri : plus récentes
  1. CVE-2026-35273 9.8 Critique Exploitée Rançongiciel

    Oracle Corporation PeopleSoft Enterprise PeopleTools · Oracle peoplesoft enterprise peopletools

    Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Updates Environment Management). Supported versions that are affected are 8.61 and 8.62. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. Successful attacks of this vulnerability can result in takeover of PeopleSoft Enterprise PeopleTools. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

  2. CVE-2026-10520 – Non évaluée Exploitée

    Ivanti Sentry

    Ivanti Sentry OS Command Injection Vulnerability — Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors.

  3. CVE-2026-7473 – Non évaluée Exploitée

    Arista Extensible Operating System

    Arista Extensible Operating System Incomplete Comparison with Missing Factors Vulnerability — Arista Extensible Operating System (EOS) contains an incomplete comparison with missing factors vulnerability when the switch incorrectly decapsulate and forwards other unexpected tunneled packet with a destination IP matching its configured decapsulation IP.

  4. CVE-2026-20245 – Non évaluée Exploitée

    Cisco Catalyst SD-WAN Manager

    Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability — Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system.

  5. CVE-2026-11645 – Non évaluée Exploitée

    Google Chromium V8

    Google Chromium V8 Out-of-Bounds Read and Write Vulnerability — Google Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

  6. CVE-2026-50751 9.3 Critique Exploitée Rançongiciel

    checkpoint Quantum Security Gateway · checkpoint Spark Firewalls · Checkpoint gaia os · Checkpoint gaia embedded

    A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange allows an unauthenticated remote attacker to bypass user authentication and establish a remote access VPN connection without a valid user password.

  7. CVE-2026-42271 – Non évaluée Exploitée

    BerriAI LiteLLM

    BerriAI LiteLLM Command Injection Vulnerability — BerriAI LiteLLM contains a command injection vulnerability that could allow any authenticated user, including holders of low-privilege internal-user keys, to run arbitrary commands on the host.