Veille CVE

Mercredi 12 août 2026

3 CVE sur 11

Critique 3 Élevée 1 Moyenne 7 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Php php » ✕
  1. CVE-2026-67285 9.2 Critique

    joomshaper.com SP Page Builder extension for Joomla

    Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0 - An unauthenticated attacker can perform includes to arbitrary PHP files that are accessible by the system.

  2. CVE-2026-18391 9.8 Critique

    Unknown WooCommerce Subscriptions

    The WooCommerce Subscriptions WordPress plugin before 9.1.0 does not validate user input before unserializing it on stores with High-Performance Order Storage enabled, leading to a PHP Object Injection issue which unauthenticated users can escalate to Remote Code Execution via a gadget chain present in the bundled dependencies.

  3. CVE-2026-15039 9.8 Critique

    Unknown giftware

    The giftware WordPress plugin before 4.2.10 does not validate the type of uploaded files in one of its upload paths, allowing unauthenticated users to upload arbitrary files, including PHP code, which can lead to remote code execution.