Veille CVE

Dimanche 14 juin 2026

2 CVE

Critique 0 Élevée 1 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Linux » ✕
  1. CVE-2026-54411 5.9 Moyenne

    Linux-PAM

    Linux-PAM through 1.7.2 contains an observable timing discrepancy (CWE-208) in the pam_userdb module's plaintext-password comparison path in modules/pam_userdb/pam_userdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the plaintext password of a target account by measuring response-timing differences.

  2. CVE-2026-54420 8.5 Élevée Exploitée

    LiteSpeed Technologies cPanel Plugin · Litespeedtech litespeed cpanel plugin · Litespeedtech litespeed whm plugin

    LiteSpeed cPanel plugin before 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS, as exploited in the wild in May 2026.