Veille CVE

Mardi 22 septembre 2026

2 CVE

Critique 1 Élevée 1 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « electron » ✕
  1. CVE-2026-12718 9.8 Critique

    Karel Electronic Industry and Trade Inc. KarelIPS

    Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Karel Electronic Industry and Trade Inc. KarelIPS allows Blind SQL Injection. This issue affects KarelIPS: through 22092026. NOTE: The vendor was contacted and it was learned that the product is not supported.

  2. CVE-2026-93922 8.8 Élevée

    siyuan-note siyuan

    SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens, enabling operating system command execution.