Veille CVE

Vendredi 7 août 2026

2 CVE sur 5

Critique 2 Élevée 1 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « WSO2 API Manager » ✕
  1. CVE-2026-3418 9.1 Critique

    WSO2 API Manager · WSO2 Traffic Manager · WSO2 API Control Plane · WSO2 Universal Gateway

    The System REST API accepts user-supplied file uploads without enforcing sufficient validation on the file type or destination, allowing files to be written to arbitrary server-accessible locations. Exploitation requires authenticated administrative access with publisher privileges. Successful exploitation permits an authenticated publisher to upload files to server-accessible locations. Depending on the deployment environment and how uploaded files are handled, this could lead to the execution of uploaded content, potentially resulting in remote code execution.

  2. CVE-2025-14561 9.0 Critique

    WSO2 API Manager · WSO2 API Control Plane · WSO2 Traffic Manager · WSO2 Universal Gateway

    In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants. The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.