Veille CVE
Semaine du 7 septembre au 13 septembre 2026
14 CVE
-
GitLab · Gitlab gitlab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.
-
ConnectWise ScreenConnect
ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability — ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation.
-
JFrog Artifactory
JFrog Artifactory Improper Authentication Vulnerability — JFrog Artifactory contains an improper authentication vulnerability that could return an internal anonymous-user token to an unauthenticated caller when anonymous access is disabled, potentially exposing sensitive resources.
-
JFrog Artifactory
JFrog Artifactory Incorrect Authorization Vulnerability — JFrog Artifactory contains an incorrect authorization vulnerability that leads to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.
-
Mikrotik RouterOS
RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticated SSH session to reach the RouterOS login helper.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)
-
MikroTik RouterOS
MikroTik RouterOS Missing Authentication for Critical Function Vulnerability — MikroTik RouterOS contains a missing authentication for critical function vulnerability which allows kernel memory disclosure and denial of service in the btest service.
-
Google Chrome
Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)
-
Fortinet FortiSwitchManager · Fortinet FortiOS · Siemens RUGGEDCOM APE1808 · Fortinet fortisase
A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets
-
Cisco Secure Firewall Management Center (FMC) and Security Cloud Control (SCC) Firewall Management
Cisco Firewall Management Center Authentication Bypass Using an Alternate Path or Channel Vulnerability — Cisco Secure Firewall Management Center (FMC) Software and Cisco Security Cloud Control (SCC) Firewall Management contain an authentication Bypass using an alternate path or channel vulnerability that could allow an unauthenticated, remote attacker to bypass authentication and execute script files on an affected device to obtain root access to the underlying operating system.
-
Citrix NetScaler
Citrix NetScaler Authentication Bypass Using an Alternate Path or Channel Vulnerability — Citrix NetScaler ADC and NetScaler Gateway contain an authentication-bypass vulnerability involving an alternate path or channel. When the NetScaler appliance is configured as an AAA virtual server or as a Gateway (SSL VPN, ICA Proxy, CVPN, or RDP Proxy), an unauthenticated remote threat actor may be able to bypass authentication.
-
N-able N-central
N-able N-central Static Code Injection Vulnerability — N-able N-central contains a static code injection vulnerability that could allow for pre-authentication remote code execution.
-
Microsoft Windows
Microsoft Windows Heap-Based Buffer Overflow Vulnerability — Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.
-
Microsoft Windows
Microsoft Windows Link Following Vulnerability — Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.
-
Adobe Commerce and Magento
Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability — Adobe Commerce and Magento Open Source contain an improper neutralization of special elements used in a template engine vulnerability that could allow an attacker to execute arbitrary code.