Veille CVE

Samedi 5 septembre 2026

19 CVE

Critique 1 Élevée 6 Moyenne 10 Faible 2 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2026-75485 5.5 Moyenne

    Red Hat Advanced Cluster Management for Kubernetes 2.11 · Red Hat Advanced Cluster Management for Kubernetes 2.13 · Red Hat Advanced Cluster Management for Kubernetes 2.14 · Red Hat Advanced Cluster Management for Kubernetes 2.15

    A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. The cluster Proxy object is dumped in raw form, bypassing the oc inspect redaction that would normally sanitize sensitive fields. This exposes proxy basic-auth credentials in the must-gather archive, potentially disclosing sensitive authentication information to anyone with access to the archive.

  2. CVE-2026-73834 5.5 Moyenne

    Red Hat Advanced Cluster Management for Kubernetes 2.11 · Red Hat Advanced Cluster Management for Kubernetes 2.13 · Red Hat Advanced Cluster Management for Kubernetes 2.14 · Red Hat Advanced Cluster Management for Kubernetes 2.15

    A flaw was found in the must-gather component of Red Hat Advanced Cluster Management for Kubernetes. Certain ACM wrapper Custom Resources that embed Secret data are collected without redaction. When an administrator runs must-gather, credentials and tokens are captured in cleartext in the resulting archive, potentially exposing sensitive information to anyone with access to the archive.

  3. CVE-2026-85225 7.3 Élevée

    code-projects Doctor Appointment System

    A vulnerability was identified in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient_login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

  4. CVE-2026-85207 3.5 Faible

    itsourcecode Online Medicine Delivery System

    A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q=orderdetails. Such manipulation of the argument location leads to cross site scripting. The attack may be launched remotely. The exploit is publicly available and might be used.

  5. CVE-2026-85309 5.3 Moyenne

    Supsystic Ultimate Maps by Supsystic

    Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Maps by Supsystic: from n/a through 1.5.3.

  6. CVE-2026-85305 5.4 Moyenne

    SEOPress

    Server-Side Request Forgery (SSRF) vulnerability in SEOPress allows Server Side Request Forgery. This issue affects SEOPress: from n/a through 10.1.

  7. CVE-2026-84847 7.5 Élevée

    brightvesseldev Quick Event Manager

    Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions.

  8. CVE-2026-84812 7.1 Élevée

    wordplus BP Better Messages

    Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions.

  9. CVE-2026-84774 6.1 Moyenne

    VeronaLabs WP Statistics

    Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions.

  10. CVE-2026-84766 5.9 Moyenne

    WP Manage Ninja FluentBooking Pro

    Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions.

  11. CVE-2026-84758 6.5 Moyenne

    Strategy11 Team Business Directory

    Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions.

  12. CVE-2026-84753 9.8 Critique

    WPFunnels Mail Mint

    Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions.

  13. CVE-2026-85137 7.3 Élevée

    SeaCMS

    A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacms_locoy_news.php of the component Locoy Collector. The manipulation of the argument pwd leads to code injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

  14. CVE-2026-85106 6.3 Moyenne

    NousResearch hermes-agent

    A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.tsx of the component Link Title Fetch. Such manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

  15. CVE-2026-81773 7.1 Élevée

    Saturday Drive Ninja Forms File Uploads Extension

    Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions.

  16. CVE-2026-81281 6.5 Moyenne

    silverks Graphene

    Subscriber Cross Site Scripting (XSS) in Graphene <= 2.9.4 versions.

  17. CVE-2026-85030 3.7 Faible

    HKUDS AI-Trader

    A vulnerability has been found in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df. The affected element is an unknown function of the file service/server/routes_agent.py of the component selfRegister API Endpoint. Such manipulation of the argument initial_balance leads to business logic errors. The attack may be launched remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. profit_percent_for_display() divides by INITIAL_CAPITAL + deposited, and challenge scoring's return_pct also normalises against the attacker-inflated starting_cash. So an inflated initial_balance does not yield artificial percent returns - it inflates the absolute cash/equity column only, which is a cosmetic/leaderboard-gaming concern in a simulated game.

  18. CVE-2026-84886 5.3 Moyenne

    simular-ai Agent-S

    A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file gui_agents/s1/utils/ocr_server.py of the component OCR HTTP API. Executing a manipulation of the argument img_bytes can lead to resource consumption. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

  19. CVE-2026-84841 7.3 Élevée

    tsi-coop tsi-dpdp-cms

    A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results in client-side enforcement of server-side security. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 0.5.1 is able to resolve this issue. It is recommended to upgrade the affected component.