Veille CVE

Vendredi 2 octobre 2026

19 CVE

Critique 1 Élevée 12 Moyenne 6 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Linux » ✕
  1. CVE-2026-15896 9.1 Critique

    WebRehab Super Forms – Drag & Drop Form Builder

    The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The optional 'file_upload_auth' setting defaults to empty, meaning no authentication is required in the default configuration; enabling this setting mitigates unauthenticated exploitation but does not remediate the path traversal itself. Exploitation on Linux requires a real 13-digit timestamp directory to exist, whereas on Windows the traversal works with any hardcoded 13-digit prefix. However, the plugin's file upload response returns the name of the created directory, which means the vulnerability is exploitable as long as file upload is enabled on the form.

  2. CVE-2026-86344 7.5 Élevée

    Red Hat Directory Server 11 · Red Hat Directory Server 12 · Red Hat Directory Server 13 · Red Hat Enterprise Linux 10

    A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.

  3. CVE-2026-94422 8.8 Élevée

    Fedora · Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 10

    An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.

  4. CVE-2026-79705 4.5 Moyenne

    Red Hat Hardened Images · Red Hat Ansible Automation Platform 2 · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 8

    A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.

  5. CVE-2026-79699 4.4 Moyenne

    Red Hat Ansible Automation Platform 2 · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 9

    A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

  6. CVE-2015-3246 7.4 Élevée Exploitée

    Redhat enterprise linux · Opensuse opensuse · Libuser project libuser

    libuser before 0.56.13-8 and 0.60 before 0.60-7, as used in the userhelper program in the usermode package, directly modifies /etc/passwd, which allows local users to cause a denial of service (inconsistent file state) by causing an error during the modification. NOTE: this issue can be combined with CVE-2015-3245 to gain privileges.

  7. CVE-2026-47595 7.8 Élevée

    NVIDIA GeForce · NVIDIA RTX, Quadro, NVS · NVIDIA Tesla · NVIDIA Guest driver

    NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user can write to read-only memory because the memory's permissions are not preserved. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, information disclosure, and data tampering.

  8. CVE-2026-47594 7.8 Élevée

    NVIDIA GeForce · NVIDIA RTX, Quadro, NVS · NVIDIA Tesla · NVIDIA Guest driver

    NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivileged user may cause a use-after-free condition by issuing a sequence of driver commands. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, data tampering, and information disclosure.

  9. CVE-2026-47592 7.8 Élevée

    NVIDIA GeForce · NVIDIA RTX, Quadro, NVS · NVIDIA Tesla · NVIDIA Guest driver

    NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an unprivileged user could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

  10. CVE-2026-47591 7.8 Élevée

    NVIDIA GeForce · NVIDIA RTX, Quadro, NVS · NVIDIA Tesla · NVIDIA Virtual GPU Manager

    NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass read-only memory protection due to incorrect authorization, enabling write access to memory marked read-only. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

  11. CVE-2026-47590 7.8 Élevée

    NVIDIA GeForce · NVIDIA RTX, Quadro, NVS · NVIDIA Tesla

    NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivileged user may cause a use-after-free condition by issuing a sequence of driver commands. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, and information disclosure.

  12. CVE-2026-47589 7.8 Élevée

    NVIDIA GeForce · NVIDIA RTX, Quadro, NVS · NVIDIA Tesla

    NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an unprivileged user may cause a use-after-free condition by issuing a sequence of driver commands. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service, and information disclosure.

  13. CVE-2026-47588 7.8 Élevée

    NVIDIA RTX, Quadro, NVS · NVIDIA GeForce · NVIDIA Tesla · NVIDIA Guest driver

    NVIDIA GPU Display Driver for Linux contains a vulnerability where an unprivileged user could cause a use-after-free condition by issuing a sequence of driver commands. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, denial of service and information disclosure.

  14. CVE-2026-47572 7.8 Élevée

    NVIDIA GeForce · NVIDIA RTX, Quadro, NVS · NVIDIA Tesla

    NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where a user could cause type confusion. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

  15. CVE-2026-47529 6.7 Moyenne

    NVIDIA GeForce · NVIDIA RTX, Quadro, NVS · NVIDIA Tesla

    NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds write. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

  16. CVE-2026-47527 6.7 Moyenne

    NVIDIA GeForce · NVIDIA RTX, Quadro, NVS · NVIDIA Tesla

    NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the firmware where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

  17. CVE-2026-47525 6.7 Moyenne

    NVIDIA GeForce · NVIDIA RTX, Quadro, NVS · NVIDIA Tesla

    NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an improper validation of an array index. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

  18. CVE-2026-47524 6.7 Moyenne

    NVIDIA GeForce · NVIDIA RTX, Quadro, NVS · NVIDIA Tesla

    NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer where an attacker could cause an out-of-bounds read. A successful exploit of this vulnerability might lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.

  19. CVE-2026-102010 7.0 Élevée

    Red Hat Hardened Images · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7

    A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption.