Veille CVE

Lundi 6 juillet 2026

7 CVE

Critique 1 Élevée 2 Moyenne 4 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « git » ✕
  1. CVE-2026-50135 5.5 Moyenne

    gohugoio hugo · Gohugo hugo

    Hugo is a static site generator. From 0.123.0 to 0.161.1, a regression made  RootMappingFs.statRoot  use  Stat  (follows symlinks) instead of  Lstat , so a direct  resources.Get  of a symlink pointing outside its mount returned the target's contents — letting a symlink planted in a local mount (e.g. a vendored  themes/  theme) read arbitrary files accessible to the Hugo user. Go-module themes from GitHub (symlinks stripped) and directory walks were unaffected. Fixed in 0.162.0.

  2. CVE-2026-42341 9.2 Critique

    FOSSBilling

    FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have an unauthenticated payment bypass vulnerability in FOSSBilling's IPN callback endpoint. When the Custom payment adapter is enabled, an attacker can mark any unpaid invoice as paid and credit the associated client account without making an actual payment, by sending a single crafted HTTP request. Version 0.8.0 patches the issue. Some workarounds are available. Disable the Custom payment gateway if not actively needed and/or restrict access to `/ipn.php` at the web server level (e.g., via IP allowlisting), noting that this may interfere with legitimate payment callback processing.

  3. CVE-2026-21384 5.3 Moyenne

    Qualcomm, Inc. Snapdragon · Qualcomm fastconnect 6700 firmware · Qualcomm fastconnect 6900 firmware · Qualcomm fastconnect 7800 firmware

    Memory Corruption when updating prepared commands with invalid port indices based on user space input exceeds supported read client limits.

  4. CVE-2026-21383 7.1 Élevée

    Qualcomm, Inc. Snapdragon · Qualcomm fastconnect 6900 firmware · Qualcomm fastconnect 7800 firmware · Qualcomm lemans au lgit firmware

    Cryptographic Issue when using a static initialization vector for AES-GCM key wrapping, which requires a unique value for each call to ensure security.

  5. CVE-2026-21370 5.3 Moyenne

    Qualcomm, Inc. Snapdragon · Qualcomm fastconnect 6700 firmware · Qualcomm fastconnect 6900 firmware · Qualcomm fastconnect 7800 firmware

    Memory Corruption when validating input batch size and buffer plane count exceeds maximum allowed values.

  6. CVE-2026-4249 8.6 Élevée

    WSO2 Universal Gateway · WSO2 Traffic Manager · WSO2 API Control Plane · WSO2 API Manager

    The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remote attacker to inject malicious JSON data that can lead to a persistent denial of service condition. Successful exploitation of this vulnerability can disrupt the API Gateway, preventing legitimate API traffic from being processed and impacting complete service availability. The denial of service is persistent, requiring manual intervention to restore normal operations.

  7. CVE-2026-44936 5.0 Moyenne

    SUSE Rancher · Suse rancher fleet

    Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.15 forwards Helm authentication credentials (BasicAuth) to any URL specified in the helm.repo field of a fleet.yaml file, allowing attackers able to push to fleet monitored git repos to leak helm access credentials.