Veille CVE

Semaine du 18 mai au 24 mai 2026

2 CVE

Critique 1 Élevée 0 Moyenne 0 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « OpenSSL » ✕
  1. CVE-2026-32253 9.8 Critique

    LizardByte Sunshine

    Sunshine is a self-hosted game stream host for Moonlight. In versions prior to 2026.516.143833, the client-certificate authentication can be bypassed because of how OpenSSL verification results are handled. In src/crypto.cpp, the custom verify callback treats X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY, X509_V_ERR_CERT_NOT_YET_VALID, and X509_V_ERR_CERT_HAS_EXPIRED as success. This can allow an untrusted certificate to pass authentication and access protected HTTPS endpoints. This issue has been fixed in version 2026.516.143833.

  2. CVE-2025-14575 1.8 Faible

    Qt

    An Uncontrolled Search Path Element vulnerability in the OpenSSL TLS backend of Qt Network (qtbase) in Qt Qt Framework (Unix) allows a local attacker to load a rogue CA certificate as a trusted system authority via a crafted certificate file placed in the application's working directory.