Veille CVE

Mardi 28 avril 2026

11 CVE

Critique 1 Élevée 8 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Linux » ✕
  1. CVE-2026-7324 7.3 Élevée

    Mozilla Firefox · Mozilla Thunderbird · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6

    Memory safety bugs present in Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.1 and Thunderbird 150.0.1.

  2. CVE-2026-7323 7.3 Élevée

    Mozilla Firefox · Mozilla Thunderbird · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support

    Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Thunderbird 150.0.1, and Thunderbird 140.10.1.

  3. CVE-2026-7322 7.3 Élevée

    Mozilla Firefox · Mozilla Thunderbird · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support

    Memory safety bugs present in Thunderbird ESR 140.10.0 and Thunderbird 150.0.0. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Firefox ESR 115.35.1, Thunderbird 150.0.1, and Thunderbird 140.10.1.

  4. CVE-2026-7320 7.5 Élevée

    Mozilla Firefox · Mozilla Thunderbird · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support

    Information disclosure due to incorrect boundary conditions in the Audio/Video component. This vulnerability was fixed in Firefox 150.0.1, Firefox ESR 140.10.1, Firefox ESR 115.35.1, Thunderbird 150.0.1, and Thunderbird 140.10.1.

  5. CVE-2026-41607 6.5 Moyenne

    Apache Software Foundation Apache Thrift · Red Hat Multicluster Global Hub 1.3.4 · Red Hat Multicluster Global Hub 1.4.5 · Red Hat Multicluster Global Hub 1.6.5

    Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

  6. CVE-2026-41606 5.3 Moyenne

    Apache Software Foundation Apache Thrift · Red Hat Multicluster Global Hub 1.3.4 · Red Hat Multicluster Global Hub 1.4.5 · Red Hat Multicluster Global Hub 1.6.5

    Uncontrolled Recursion vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

  7. CVE-2026-41605 7.3 Élevée

    Apache Software Foundation Apache Thrift · Red Hat Multicluster Global Hub 1.3.4 · Red Hat Multicluster Global Hub 1.4.5 · Red Hat Multicluster Global Hub 1.6.5

    Integer Overflow or Wraparound vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

  8. CVE-2026-41604 8.2 Élevée

    Apache Software Foundation Apache Thrift · Red Hat Multicluster Global Hub 1.3.4 · Red Hat Multicluster Global Hub 1.4.5 · Red Hat Multicluster Global Hub 1.6.5

    Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.

  9. CVE-2025-48431 7.5 Élevée

    Apache Software Foundation Apache Thrift · Red Hat Cryostat 4 on RHEL 9 · Red Hat Advanced Cluster Management for Kubernetes 2.14 · Red Hat Advanced Cluster Management for Kubernetes 2.15

    Mismatched Memory Management Routines vulnerability in Apache Thrift c_glib language bindings. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue. Description: Specially crafted requests can crash an c_glib-based Thrift server with a clean but fatal "free(): invalid pointer" error message.

  10. CVE-2026-40976 9.1 Critique

    Spring Boot · Red Hat AMQ Broker 7 · Red Hat AMQ Clients · Red Hat build of Apache Camel for Spring Boot 4

    In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable, it must: be a servlet-based web application; have no Spring Security configuration of its own and rely on the default web security filter chain; depend on spring-boot-actuator-autoconfigure; not depend on spring-boot-health. If any of the above does not apply, the application is not vulnerable. Affected: Spring Boot 4.0.0–4.0.5; upgrade to 4.0.6 or later per vendor advisory.

  11. CVE-2026-40975 7.5 Élevée

    Spring Boot · Red Hat HawtIO HawtIO 4.4.0 · Red Hat build of Apache Camel 4.18.1 for Spring Boot 3.5.14 · Red Hat Data Grid 8.6.1

    Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used for secrets as they are numeric values with a predictable range. Affected: Spring Boot 4.0.0–4.0.5 (fix 4.0.6), 3.5.0–3.5.13 (fix 3.5.14), 3.4.0–3.4.15 (fix 3.4.16), 3.3.0–3.3.18 (fix 3.3.19), 2.7.0–2.7.32 (fix 2.7.33); random value property source / weak PRNG for secrets. Versions that are no longer supported are also affected per vendor advisory.