Veille CVE

Dimanche 18 octobre 2026

3 CVE sur 98

Critique 3 Élevée 22 Moyenne 66 Faible 6 Non évaluée 1 Exploitées (KEV) Tri : plus récentes
  1. CVE-2026-18516 9.6 Critique

    Arcadia Technology, LLC Crafty Controller

    An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection

  2. CVE-2026-109321 9.1 Critique

    getgrav grav-plugin-login-oauth

    Grav Login OAuth plugin (grav-plugin-login-oauth) before 1.4.3 provisions OAuth accounts as ordinary Grav users with a deterministic <provider>.<id> username and an unsalted MD5 hash of the provider identifier as the password, without disabling password login. Unauthenticated remote attackers who learn or guess a provider identifier can reproduce these credentials and log in, gaining administrative control of privileged accounts.

  3. CVE-2026-108707 9.8 Critique

    WuKongOpenSource Wukong_HRM

    Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.