Veille CVE

Semaine du 5 octobre au 11 octobre 2026

6 CVE

Critique 2 Élevée 4 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « electron » ✕
  1. CVE-2026-108160 7.5 Élevée

    iflytek astron-rpa

    AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious updates by abusing the desktop client's auto-update mechanism. Attackers positioned between the client and server can serve a malicious update manifest and NSIS installer, which electron-updater installs without signature verification, executing code as the desktop user.

  2. CVE-2026-86405 9.8 Critique

    Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module

    Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects PrestaShop Virtual POS Module: from 26.8.1 before 26.9.1.

  3. CVE-2026-8374 8.5 Élevée

    SwitchBot Lock Series Lock · SwitchBot Lock Series Keypad · SwitchBot Lock Series App

    Misuse and misconfiguration in Bluetooth communication in SwitchBot Door Lock Series allows an attacker to bypass the electronic lock and access controls via a manipulated communication protocol.

  4. CVE-2026-85531 9.8 Critique

    Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module

    Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects OpenCart Virtual POS Module: from 26.8.2 before 26.9.1.

  5. CVE-2026-106104 8.7 Élevée

    quasarframework quasar

    Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbounded User-Agent request header to getMatch() in ui/src/plugins/platform/Platform.js, whose browser-detection expressions combined greedy captures with repeated unbounded scans. Platform belongs to autoInstalledPlugins, so this parsing occurs before routing for every SSR request. A crafted unauthenticated request containing repeated version tokens without a terminating Safari token causes super-linear backtracking and blocks the Node.js event loop, delaying every other SSR request. SPA, PWA, Electron, Cordova, Capacitor, browser-extension, and static-site-generation targets are not affected because they do not parse an attacker-controlled request header through this path. This issue is fixed in version 2.23.3.

  6. CVE-2026-105220 7.8 Élevée

    klembot twinejs

    Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories() that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScratchFile IPC bridge to write and open a .bat file, executing code as the user.