Veille CVE

Vendredi 16 octobre 2026

3 CVE

Critique 0 Élevée 1 Moyenne 1 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « IBM Db2 » ✕
  1. CVE-2026-109839 3.1 Faible

    IBM Db2 Genius Hub

    IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector in the cryptographic algorithm.

  2. CVE-2026-109838 5.1 Moyenne

    IBM Db2 Genius Hub

    IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryptographic signature.

  3. CVE-2026-65198 8.6 Élevée

    Huawei openUBMC

    Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key (recoverable from the open-source build) can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build customization `manifest/build/customization/default_password.lua` sets `AuthenticationKey == EncryptionKey == 7df2f29369e3ac3245b2c9d46b67a0ecd055197e41808a34ef325db2f6422581` for the iBMC product build, and the community seed `account/manufacture/default_password.lua` sets both to `7a2f5b86f20233ec7b7bef49643fbf34d86d0cbf6f1f8f5c52d4f30d4536938b`. These are shipped constants, not per-unit values, and they are not rotated by the Administrator password reset, so they survive account provisioning. This is especially dangerous considering that SNMP access is mapped to full device administration privileges, including system reset and firmware upgrades.