Veille CVE

Vendredi 18 septembre 2026

2 CVE

Critique 0 Élevée 1 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Red Hat Exploit Intelligence » ✕
  1. CVE-2026-93432 6.1 Moyenne

    Red Hat build of Quarkus 3.27.6.redhat · Red Hat build of Quarkus 3.33.4.redhat · Red Hat Exploit Intelligence · Red Hat build of Apache Camel 4 for Quarkus 3

    A flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability can lead to Cross-Site Scripting (XSS) and JSON Injection, potentially allowing a remote attacker to execute arbitrary code in a user's browser or manipulate data.

  2. CVE-2026-87743 7.5 Élevée

    Red Hat build of Quarkus 3.27.5.SP2 · Red Hat build of Quarkus 3.33.3.SP2 · Red Hat Exploit Intelligence · Red Hat OpenShift Serverless

    A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information.