Veille CVE

Semaine du 13 juillet au 19 juillet 2026

10 CVE

Critique 6 Élevée 4 Moyenne 0 Faible 0 Non évaluée 0 Tri : plus récentes
  1. CVE-2026-58644 9.8 Critique Exploitée

    Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server 2019 · Microsoft SharePoint Server Subscription Edition · Microsoft sharepoint server

    Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

  2. CVE-2026-25089 9.8 Critique Exploitée

    Fortinet FortiSandbox · Fortinet FortiSandbox Cloud · Fortinet FortiSandbox PaaS

    A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.5, FortiSandbox 4.4.0 through 4.4.8, FortiSandbox 4.2 all versions, FortiSandbox Cloud 5.0.4 through 5.0.5, FortiSandbox PaaS 5.0.4 through 5.0.5 may allow an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests

  3. CVE-2026-39808 9.8 Critique Exploitée

    Fortinet FortiSandbox · Fortinet FortiSandbox PaaS

    A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.8 may allow attacker to execute unauthorized code or commands via <insert attack vector here>

  4. CVE-2026-46817 9.8 Critique Exploitée

    Oracle Corporation Oracle Payments · Oracle e-business suite

    Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments. CVSS 3.1 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

  5. CVE-2023-4346 7.5 Élevée Exploitée

    KNX Association KNX Protocol Connection Authorization Option 1 · Knx connection authorization

    KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and users being unable to reset them to gain access to the device. The BCU key feature on the devices can be used to create a password for the device, but this password can often not be reset without entering the current password. If the device is configured to interface with a network, an attacker with access to that network could interface with the KNX installation, purge all devices without additional security options enabled, and set a BCU key, locking the device. Even if a device is not connected to a network, an attacker with physical access to the device could also exploit this vulnerability in the same way.

  6. CVE-2026-15410 7.2 Élevée Exploitée Rançongiciel

    SonicWall SMA1000 · Sonicwall sma6210 firmware · Sonicwall sma7210 firmware · Sonicwall sma8200v

    Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.

  7. CVE-2026-15409 10.0 Critique Exploitée Rançongiciel

    SonicWall SMA1000 · Sonicwall sma6210 firmware · Sonicwall sma7210 firmware · Sonicwall sma8200v

    A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended location.

  8. CVE-2026-56164 9.8 Critique Exploitée

    Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server 2019 · Microsoft SharePoint Server Subscription Edition · Microsoft sharepoint server

    Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.

  9. CVE-2026-56155 7.8 Élevée Exploitée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows Server 2012 · Microsoft Windows Server 2012 (Server Core installation)

    Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.

  10. CVE-2008-4128 8.1 Élevée Exploitée

    Cisco ios

    Multiple cross-site request forgery (CSRF) vulnerabilities in the HTTP Administration component in Cisco IOS 12.4 on the 871 Integrated Services Router allow remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI. NOTE: some of these details are obtained from third party information.