Veille CVE

Lundi 3 août 2026

5 CVE

Critique 2 Élevée 2 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « git » ✕
  1. CVE-2026-51190 9.8 Critique

    The "s init" command in Serverless-Devs @serverless-devs/s <= 3.1.11 passes unsanitized user input to child_process.spawn() with shell: true. A URL ending in ".git" bypasses the only input check, allowing OS command injection when a user runs "s init" with an attacker-controlled argument.

  2. CVE-2025-15630 5.9 Moyenne

    TP-Link Systems Inc. Omada Gateways · TP-Link Systems Inc. Omada Switches · TP Link Systems Inc. Omada Access Points · TP-Link Systems Inc Omada Controllers

    A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimate device completes registration, resulting in provisioning information being delivered to an attacker. Successful exploitation may allow disclosure of provisioning information intended for a legitimate device.

  3. CVE-2026-69097 7.3 Élevée

    gitpython-developers GitPython · Gitpython project gitpython

    GitPython before 3.1.53 fails to properly escape section names in git config files, allowing attackers to inject arbitrary configuration directives through malicious submodule names. Attackers can inject core.sshCommand or other dangerous config keys into the victim's .git/config via create_submodule or clone_from operations, achieving remote code execution when git performs ssh operations.

  4. CVE-2026-0392 7.3 Élevée

    Latvijas Valsts radio un televīzijas centrs (LVRTC) eParakstītājs 3.0

    eParakstītājs 3.0 for Windows before version 1.10.0 retrieves and executes its automatic updates over a channel that is not authenticated or integrity-protected. On each launch the application fetches an update descriptor (XML) over TLS but accepts any TLS certificate (a permissive TrustManager and a HostnameVerifier that always returns true), does not verify any digital signature on the update descriptor, and does not verify the Authenticode signature or a checksum of the downloaded installer before running it. A man-in-the-middle attacker able to redirect www.eparaksts.lv can serve a crafted update descriptor pointing to an attacker-controlled executable, which the client downloads and executes, resulting in arbitrary code execution on the victim host.

  5. CVE-2026-14557 9.1 Critique

    Unknown SoftMarket — Digital Marketplace

    The SoftMarket — Digital Marketplace WordPress plugin through 1.0.0 does not properly validate an authentication token in one branch of its email-verification flow, allowing unauthenticated attackers to obtain a valid session as any verified user by supplying only that user's ID.