Veille CVE

Semaine du 7 septembre au 13 septembre 2026

7 CVE

Critique 4 Élevée 3 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes
  1. CVE-2026-85706 10.0 Critique Exploitée

    GitLab · Gitlab gitlab

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.7 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that, under certain conditions, an unauthenticated user could have read arbitrary files from the GitLab server due to improper path confinement and missing authentication enforcement in the repository commits API.

  2. CVE-2026-85102 9.8 Critique Exploitée

    checkpoint Quantum Security Gateway · Checkpoint gaia embedded · Checkpoint gaia os

    Improper certificate trust validation during VPN negotiation in Check Point Quantum Security Gateway may allow an unauthenticated remote attacker to execute arbitrary code on the Gateway.

  3. CVE-2026-87491 8.8 Élevée Exploitée

    Google Chrome

    Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

  4. CVE-2026-84869 9.9 Critique Exploitée

    ConnectWise ScreenConnect

    A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

  5. CVE-2026-85880 7.8 Élevée Exploitée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

  6. CVE-2026-81963 7.8 Élevée Exploitée

    Microsoft Windows 11 Version 23H2 · Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2 · Microsoft Windows 11 version 26H1

    Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.

  7. CVE-2026-75650 10.0 Critique Exploitée

    Adobe Commerce · Adobe Commerce B2B · Adobe Magento Open Source · Adobe magento

    Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.