Veille CVE

Août 2026

7 CVE

Critique 4 Élevée 2 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2026-72530 9.0 Critique Exploitée

    TrueConf Server · Trueconf trueconf server

    A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier could use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system.

  2. CVE-2026-66384 5.3 Moyenne Exploitée

    jfrog artifactory

    An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.

  3. CVE-2026-68820 7.0 Élevée Exploitée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

  4. CVE-2026-65660 8.8 Élevée Exploitée

    Microsoft SharePoint Enterprise Server 2016 · Microsoft SharePoint Server 2019 · Microsoft SharePoint Server Subscription Edition · Microsoft sharepoint server

    Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  5. CVE-2026-72898 10.0 Critique Exploitée

    Metabase · Metabase metabase

    Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

  6. CVE-2026-65400 9.8 Critique Exploitée

    Apple macOS

    An authentication issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, macOS Tahoe 26.7. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials.

  7. CVE-2026-5430 10.0 Critique Exploitée

    WSO2 Universal Gateway · WSO2 Traffic Manager · WSO2 API Control Plane · WSO2 API Manager

    The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access. Successful exploitation of this vulnerability may result in unauthorized access to the system, including the potential compromise of administrative accounts and full account takeover. The CVSS score is adjusted to 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) in single-tenant deployments, reflecting that the impact is contained within a single security authority boundary.