Veille CVE

Semaine du 12 janvier au 18 janvier 2026

3 CVE

Critique 1 Élevée 0 Moyenne 1 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2026-0976 3.7 Faible

    Red Hat build of Keycloak 26.4.9 · Red Hat Build of Keycloak · Red Hat JBoss Enterprise Application Platform 8 · Red Hat JBoss Enterprise Application Platform Expansion Pack

    A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments, while common reverse proxy configurations may ignore or mishandle them. A remote attacker can craft requests to mask path segments, potentially bypassing proxy-level path filtering. This could expose administrative or sensitive endpoints that operators believe are not externally reachable.

  2. CVE-2026-20805 5.5 Moyenne Exploitée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.

  3. CVE-2025-25249 9.8 Critique Exploitée

    Fortinet FortiSwitchManager · Fortinet FortiOS · Siemens RUGGEDCOM APE1808 · Fortinet fortisase

    A heap-based buffer overflow vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7.2.11, FortiOS 7.0.0 through 7.0.17, FortiOS 6.4 all versions, FortiSwitchManager 7.2.0 through 7.2.6, FortiSwitchManager 7.0.0 through 7.0.5 allows attacker to execute unauthorized code or commands via specially crafted packets