Du 12 octobre 2026 au 19 octobre 2026
Les CVE critiques de la semaine
La semaine en trois listes : les vulnérabilités dont la CISA confirme l'exploitation, toutes les CVE que la NVD a classées CRITICAL (CVSS v3 ≥ 9,0) sur les sept derniers jours, et les analyses que nous avons publiées. Commencez par la première : une faille exploitée passe avant un score CVSS plus élevé.
- ajouts au KEV
- 9
- CVE CRITICAL
- 20
- analyses
- 22
Ajoutées au catalogue CISA KEV
60 derniers joursFortinet Multiple Products Path Traversal Vulnerability
Fortinet · Multiple Products
FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands.
Date limite CISA
BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
BeyondTrust · Remote Support
BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance.
Date limite CISA
Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability
Atlassian · Multiple Products
Multiple Atlassian products (Bitbucket Data Center ,Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible and Fisheye) contain a files or directories accessible to external parties vulnerability which could allow an unauthenticated attacker to access specific files within the web application root directory in affected versions.
Date limite CISA
Palo Alto Networks PAN-OS Code Injection Vulnerability
Palo Alto Networks · PAN-OS
Palo Alto Networks PAN-OS contains a code injection vulnerability that could allow an authenticated attacker with network access to execute arbitrary code with root privileges on the firewall.
Date limite CISA
Ahsay AhsayCBS Improper Authentication Vulnerability
Ahsay · AhsayCBS
Ahsay AhsayCBS contains an improper authentication vulnerability that could allow a remote attacker to bypass authentication via manipulation of the random parameter in the API component’s checkSysPwd function. This vulnerability can be chained with CVE-2026-105134.
Date limite CISA
Ahsay AhsayCBS Command Injection Vulnerability
Ahsay · AhsayCBS
Ahsay AhsayCBS contains a command injection vulnerability that could allow a remote attacker to execute operating system commands via manipulation of the random parameter in the Replication Receiver component’s /rps/api/json/UpdateReceivers.do endpoint. This vulnerability can be chained with CVE-2026-105133.
Date limite CISA
Cisco Secure Email Gateway Relative Path Traversal Vulnerability
Cisco · Secure Email Gateway
Cisco Secure Email Gateway contains a relative path traversal vulnerability that could allow an unauthenticated, remote attacker to write arbitrary files on the underlying operating system.
Date limite CISA
Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability
Ivanti · Connect Secure
Ivanti Connect Secure contains an authentication bypass by spoofing vulnerability that allows a remote unauthenticated attacker to execute arbitrary commands.
Date limite CISA
Microsoft Windows Command Injection Vulnerability
Microsoft · Windows
Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.
Date limite CISA
CVE CRITICAL publiées
Critiques et élevées, 14 jours- CVE-2026-1118629.8CVSS 3.1
Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a website if the plugin was activated and directs sites that activated an affected package to treat the website as compromised. The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server. Rank Math identifies three malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker as incident indicators. Only packages obtained during the vendor-confirmed window are claimed as affected; version 3.0.123 alone is not sufficient to establish compromise. Rank Math removed the affected files and released version 3.0.124 as the clean replacement.
- CVE-2026-1122929.8CVSS 3.1
CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete records because shipped PocketBase collections use empty API rules. Attackers can query /api/collections/<name>/records endpoints to steal server_token values and alert_configurations secrets, disable alerting, alter status pages, or delete monitoring data.
- CVE-2026-1119989.8CVSS 3.1
Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.
- CVE-2026-1117049.8CVSS 3.1
LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.
- CVE-2026-1116939.8CVSS 3.1
DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator token and access all protected /webapi routes.
- CVE-2026-1116439.8CVSS 3.1
Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter trustedProxies and webhookApiKey, to access every protected endpoint as the administrator.
- CVE-2026-1112819.8CVSS 3.1
Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen authserverip and authcode, making the jooandiag daemon execute their commands through /bin/sh, giving full device control.
The vulnerability exists within internal components of BeyondTrust’s Remote Support product. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could allow an attacker to perform file operations on the appliance.
- CVE-2026-1110948.1CVSS 3.1
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible
- CVE-2026-11095710.0CVSS 3.1
A vulnerability has been found in Wavlink WL-WN530BE2-A up to M30BE2_V250604. The affected element is the function sub_12580 of the file api.cgi of the component Login Processing. The manipulation of the argument REMOTE_ADDR leads to os command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin is sufficient to fix this issue. You should upgrade the affected component. The vendor confirms: "We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked."
- CVE-2026-890737.5CVSS 3.1
Insufficient Session Expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- CVE-2026-890688.1CVSS 3.1
Missing critical step in authentication vulnerability in Progress MOVEit Transfer (LDAP module). This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.
- CVE-2026-1106409.8CVSS 3.1
Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell metacharacters or $() substitution into the command string built by createCppCommand() and run via shelljs exec() to execute commands with Node.js process privileges.
- CVE-2026-1106369.8CVSS 3.1
pypdftk through 0.5 contains an OS command injection vulnerability in fill_form(), dump_data_fields(), and pdftk_cmd_util() that builds shell commands from caller-supplied paths. Attackers controlling pdf_path or out_file can inject shell metacharacters interpreted by subprocess.Popen with shell=True to execute OS commands as the Python process.
- CVE-2026-1106359.8CVSS 3.1
webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell metacharacters to execute OS commands as the Node.js process.
- CVE-2020-372829.8CVSS 3.1
office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a crafted fileName to generatePdf() or generateHtml(). Attackers can embed $(...), backticks, or a closing quote with shell metacharacters in the file name, which is concatenated into an unoconv command run via child_process.exec(), executing commands with Node.js process privileges.
- CVE-2026-821109.6CVSS 3.1
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of pathname during a path traversal.
- CVE-2026-821019.6CVSS 3.1
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability.
- CVE-2026-196228.8CVSS 3.1
IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests.
- CVE-2026-1095669.8CVSS 3.1
Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain super-admin access through an AuthSeeder-created admin@laravel account with password admin. The account is seeded by the setup installer and silently re-created on every rpd:make run, letting attackers log in as a global super admin bypassing per-record authorization and tenant scoping.
Source : NIST NVD, sévérité CVSS v3. Les CVE en attente d'analyse NVD, sans score v3, n'apparaissent pas ici. Pourquoi ?
Nos analyses de la semaine
BlogVanus et phpMyFAQ : un jeton admin codé en dur et une passkey enregistrable sans authentification (CVE-2026-111998, CVE-2026-111911)
CVE-2026-111998 et CVE-2026-111911 (9.8) : jeton admin codé en dur dans Vanus, contournement d'authentification WebAuthn dans phpMyFAQ. Ce qu'il faut faire.
WordPress : LearnPress (9.8) et LatePoint (9.1), deux plugins exploitables sans compte — CVE-2026-104736 et CVE-2026-110653
CVE-2026-104736 LearnPress (9.8, injection d'objet PHP) et CVE-2026-110653 LatePoint (9.1, contournement d'OTP) : versions touchées, exposition, mesures.
Secrets codés en dur et API sans authentification : 4 CVE à 9.8 dans LangChat, DataBuff, Simple Admin Core et Misaka Danmu
CVE-2026-111704, 111693, 111690 et 111643 (9.8) : identifiants par défaut, secret JWT public et API ouvertes dans quatre projets open source auto-hébergés.
WordPress : 6 plugins à 9.8 sans authentification (My Calendar, MailOptin, Mang Board, ELEX HelpDesk…)
Six plugins WordPress notés 9.8, exploitables sans compte : My Calendar, MailOptin, Mang Board, ELEX HelpDesk, Theme My Login, Sunshine Photo Cart.
IoT : Wavlink WL-WN530BE2-A (10.0), caméras Jooan JA-A12 et Lantronix XPress-DR en fin de vie
CVE-2026-110957 (10.0) sur Wavlink, CVE-2026-111281 sur caméras Jooan, CVE-2026-109439 sur Lantronix XPress-DR en fin de vie : patcher, isoler ou remplacer.
CVE-2025-61624 Fortinet : une faille MEDIUM au CISA KEV — FortiOS, FortiProxy, FortiPAM, FortiSwitchManager
CVE-2025-61624 (6.5) : path traversal FortiOS, FortiProxy, FortiPAM et FortiSwitchManager, publiée en avril, au CISA KEV en octobre. Versions et correctifs.
BMC Helix Network Management CVE-2026-111283 : contournement d'authentification avec SSO SAML, corrigé en 26.3.01
CVE-2026-111283 (9.0) : avec le SSO SAML configuré, BMC Helix Network Management on-prem accepte l'admin local avec n'importe quel mot de passe.
CVE-2026-102764 BeyondTrust Remote Support : contournement d'authentification au CISA KEV un jour après sa publication
CVE-2026-102764 BeyondTrust Remote Support (9.8) : contournement d'authentification exploité, au CISA KEV dès le lendemain. Versions 26.2.3 et antérieures.
Atlassian Data Center CVE-2026-21589 au CISA KEV : lecture de fichiers sans authentification sur 8 produits
CVE-2026-21589 (7.5) au CISA KEV : lecture de fichiers sans authentification sur Jira, Confluence, Bitbucket, Bamboo, Crowd. Échéance au 18 octobre.
Archon, JuggleIM, Agora Project : trois outils auto-hébergés à 9.8, une API d'agent IA ouverte à tous
CVE-2026-111322, 111329, 63146 (9.8) : Archon expose un agent IA sans authentification, JuggleIM recrée son admin par défaut, Agora Project corrigé en 26.10.0.
Palo Alto PAN-OS CVE-2026-0322 au CISA KEV : RCE root via l'interface de management
CVE-2026-0322 (7.2) : RCE root sur PAN-OS via l'interface de management, pour un attaquant authentifié. Au CISA KEV le 14 octobre, échéance au 17. Que faire.
npm et PyPI : 6 paquets avec injection de commande shell notée 9.8 (office-converter, webp-converter, pypdftk…)
Six paquets npm et PyPI (office-converter, webp-converter, pypdftk, doc-recog, whisper-node, transcribe2texts) passent des chemins au shell. Tous notés 9.8.
Juniper Junos OS : CVE-2026-101950 (SVR sur SRX) et CVE-2026-102178 (BGP flowspec), deux failles 9.8
Junos OS : débordement de tas dans SVR sur SRX (CVE-2026-101950) et de pile dans BGP flowspec (CVE-2026-102178), notés 9.8. Bulletins JSA et mesures d'attente.
Cisco Secure Email Gateway CVE-2026-76519 au CISA KEV : un email suffit pour passer root
CVE-2026-76519 (9.8) : une pièce jointe piégée suffit à écrire des fichiers et exécuter des commandes root sur Cisco Secure Email Gateway via AMP. Au CISA KEV.
AhsayCBS CVE-2026-105133 et 105134 au CISA KEV : une chaîne sur le serveur de sauvegarde
AhsayCBS : contournement d'authentification CVE-2026-105133 et injection CVE-2026-105134, chaînables, au CISA KEV. Passe en 10.3.4, isole la console.
Windows Shell CVE-2026-96951 au CISA KEV : contournement d'une fonction de sécurité, échéance le 16
CVE-2026-96951 : injection de commande dans Windows Shell, exploitée selon la CISA, échéance le 16 octobre. Sans score NVD : comment prioriser, quoi surveiller.
Wazuh CVE-2026-74040 : un worker compromis prend le master et tous les agents, corrigé en 4.14.8
CVE-2026-74040 (9.1) : un worker Wazuh compromis écrase des fichiers du master et obtient une RCE root sur le manager et chaque agent. Corrigé en 4.14.8.
Ivanti Connect Secure CVE-2026-104935 au CISA KEV : exécution de commandes sans authentification
CVE-2026-104935 : contournement d'authentification dans Ivanti Connect Secure, exploité, échéance CISA le 16 octobre. Sans score NVD : que vérifier sur tes VPN.
IBM DataStage et WebSphere Liberty : CVE-2026-82110, 82101 et 93895, trois failles critiques en deux jours
IBM : deux traversées de chemin 9.6 dans DataStage on Cloud Pak for Data 5.4.0.0 (RCE et DoS) et un contournement des contrôles gRPC 9.1 dans WebSphere Liberty.
Adobe Commerce et AEM : CVE-2026-100133 et 106629, deux XSS stockées notées 9.3
CVE-2026-100133 (Adobe Commerce) et CVE-2026-106629 (Experience Manager) : deux XSS stockées notées 9.3, scope changé. Pourquoi ce score, et que faire.
Routeurs Netcore NR268 et Wavlink WL-WN530BE1-A : CVE-2026-108929 et CVE-2026-109108 (9.9)
Deux CVE 9.9 sur des routeurs : injection d'argument DDNS sur Netcore NR268, injection de commande VPN sur Wavlink. Pas de correctif NVD : isoler et remplacer.
Rapyd Admin CVE-2026-109566 et Grav Login OAuth CVE-2026-109321 : des identifiants prévisibles
Rapyd Admin (corrigé en 9.20.0) recrée un super-admin par défaut, Grav Login OAuth (corrigé en 1.4.3) dérive ses mots de passe. Deux CVE critiques à traiter.