Veille CVE

Semaine du 15 juin au 21 juin 2026

5 CVE

Critique 3 Élevée 1 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2026-48939 9.8 Critique Exploitée

    icagenda.com iCagenda extension for Joomla · Joomlic icagenda

    A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.

  2. CVE-2026-48908 9.8 Critique Exploitée

    joomshaper.net SP Page Builder extension for Joomla · Ollyo sp page builder

    A vulnerability in SP Page Builder for Joomla allows unauthenticated users to upload arbitrary files, ultimately resulting in the upload and execution of PHP code.

  3. CVE-2026-12569 9.8 Critique Exploitée Rançongiciel

    PTC Windchill PDMLink · PTC FlexPLM

    A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill PDMlink and PTC FlexPLM. The vulnerability may be exploited through the deserialization of untrusted data.  * This advisory also applies to all CPS versions * The identified vulnerability also impacts Windchill and FlexPLM releases prior to 11.0 M030

  4. CVE-2026-7273 8.8 Élevée Exploitée

    Zyxel GS1900-48HPv2 firmware · Zyxel GS1900-8 firmware · Zyxel GS1900-8HP firmware · Zyxel GS1900-10HP firmware

    A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

  5. CVE-2026-20262 6.5 Moyenne Exploitée

    Cisco Catalyst SD-WAN Manager

    A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system. This vulnerability exists because the affected software does not properly validate user-supplied input during a file upload process. An attacker could exploit this vulnerability by sending a crafted HTTP request to an affected API endpoint of the affected system. A successful exploit could allow the attacker to create or overwrite any file on the underlying operating system. This file could later be used to elevate to root. To exploit this vulnerability, the attacker must have valid credentials with at least a lower-privileged, single-task user account.