Veille CVE

Semaine du 14 septembre au 20 septembre 2026

10 CVE

Critique 0 Élevée 8 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « electron » ✕
  1. CVE-2026-93923 8.8 Élevée

    siyuan-note siyuan

    SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with full system access.

  2. CVE-2026-93922 8.8 Élevée

    siyuan-note siyuan

    SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens, enabling operating system command execution.

  3. CVE-2026-54642 5.3 Moyenne

    cubecart v6

    CubeCart is an ecommerce software solution. Prior to 6.7.5, the reset_id download-counter action and delete_card stored-payment-card action in admin/sources/orders.index.inc.php use state-changing GET requests and are omitted from the protection map in admin/skins/default/csrf.inc.php. A remote attacker can induce an authenticated administrator to issue one of these requests without a validated session token, causing unintended resets of electronic download usage counters or deletion of stored customer payment-card tokens. This issue is fixed in version 6.7.5.

  4. CVE-2026-92986 8.8 Élevée

    siyuan-note siyuan

    SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the Electron renderer with access to child_process for command execution.

  5. CVE-2026-92985 8.8 Élevée

    siyuan-note siyuan

    SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files with unescaped HTML in bookmark attributes that execute scripts in the Electron renderer with access to child_process for command execution.

  6. CVE-2026-86585 7.7 Élevée

    Fermax Electronica S.A.U. DUOX PLUS monitor firmware (VEO Wi-Fi range)

    The lack of signature verification of firmware update packages in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, allows an attacker who controls the delivery of an update to install unauthorised firmware.

  7. CVE-2026-86474 7.7 Élevée

    Fermax Electronica S.A.U. DUOX PLUS monitor firmware (VEO Wi-Fi range)

    The lack of TLS certificate validation when downloading firmware updates in VEO and VEO-XS Wi-Fi monitors, in versions prior to 01.48.001, allows an attacker to perform man-in-the-middle attacks on the update channel.

  8. CVE-2026-86443 6.9 Moyenne

    Fermax Electronica S.A.U. DuoxMe

    Cleartext storage of sensitive information in the DuoxMe application for Android, in versions prior to 4.3.4, allows an attacker with local access to the device to retrieve the credentials stored by the application and impersonate the user account.

  9. CVE-2026-85628 7.0 Élevée

    Fermax Electronica S.A.U. DuoxMe · Fermax Electronica S.A.U. DUOX PLUS monitor firmware (VEO Wi-Fi range)

    Transmission of the home Wi-Fi credentials without encryption during the pairing process between the DuoxMe application and VEO and VEO-XS Wi-Fi monitors, in versions prior to 4.3.4 of the application and 01.50.001 of the monitor firmware, allows an attacker on the Wi-Fi Direct network to intercept the network password.

  10. CVE-2026-92299 7.4 Élevée

    Jitsi @jitsi/electron-sdk

    @jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMedia() picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop thumbnails at arbitrary resolution without user consent or operating system permission prompts.