Veille CVE

Semaine du 14 septembre au 20 septembre 2026

7 CVE

Critique 1 Élevée 1 Moyenne 1 Faible 0 Non évaluée 4 Tri : plus récentes
  1. CVE-2025-39964 5.5 Moyenne Exploitée

    Linux · Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

    In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, concurrent writes may create inconsistencies in the internal socket state. Disallow this by adding a new ctx->write field that indiciates exclusive ownership for writing.

  2. CVE-2026-53266 – Non évaluée Exploitée

    Linux Kernel

    Linux Kernel Out-of-Bounds Write Vulnerability — Linux Kernel contains an out-of-bounds write vulnerability in the ebtables SNAT target which allows an ARP sender hardware address rewrite to write directly into a nonlinear socket-buffer fragment backed by a splice-imported file page. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.

  3. CVE-2025-39682 – Non évaluée Exploitée

    Linux Kernel

    Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability — Linux Kernel contains an improper check for unusual or exceptional conditions vulnerability in the TLS receive path which allows a zero-length record retrieved from the rx_list to bypass the intended recvmsg() record-type handling, potentially causing subsequent TLS records to be processed using incorrect zero-copy and queuing assumptions. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.

  4. CVE-2026-87886 7.8 Élevée Exploitée

    Acronis Backup plugin for cPanel & WHM · Acronis Backup extension for Plesk · Acronis Backup plugin for DirectAdmin · Acronis acronis backup

    Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.3.1021, Acronis Backup extension for Plesk (Linux) before build 1.8.11.638, Acronis Backup plugin for DirectAdmin (Linux) before build 1.2.3.238.

  5. CVE-2026-76460 10.0 Critique Exploitée

    Cisco Identity Services Engine Software · Cisco ISE Passive Identity Connector · Cisco identity services engine · Cisco identity services engine passive identity connector

    A vulnerability in an API of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to bypass authentication. This vulnerability is due to insufficient authentication control on an API endpoint. An attacker could exploit this vulnerability by sending a crafted request to an affected API endpoint. A successful exploit could allow the attacker to gain unauthorized access to the affected device by bypassing the web-based management interface.

  6. CVE-2026-58704 – Non évaluée Exploitée

    Google Pixel

    Google Pixel Improper Authorization Vulnerability — Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges.

  7. CVE-2026-76461 – Non évaluée Exploitée

    Cisco Secure Email Gateway

    Cisco Secure Email Gateway SQL Injection Vulnerability — Cisco AsyncOS software for Cisco Secure Email Gateway (SEG) contains a SQL injection vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary commands with root privileges on the underlying operating system.