Veille CVE

Recherche « Redhat enterprise linux server »

75 CVE

Critique 11 Élevée 36 Moyenne 26 Faible 2 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Redhat enterprise linux server » ✕
  1. CVE-2026-13097 8.7 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 8.8 Telecommunications Update Service

    A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.

  2. CVE-2026-11861 8.1 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 8.8 Telecommunications Update Service

    A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.

  3. CVE-2026-19550 8.2 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 8.8 Telecommunications Update Service

    A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory.

  4. CVE-2026-18651 5.4 Moyenne

    Red Hat Directory Server 11 · Red Hat Directory Server 12 · Red Hat Directory Server 13 · Red Hat Enterprise Linux 10

    A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed authenticated state on the connection is not reverted. A client that supplies valid credentials for an account that has been administratively locked can continue to use the same connection with that account's privileges, defeating account lock as an access-revocation control.

  5. CVE-2026-15722 7.5 Élevée

    Red Hat Directory Server 11.5 E4S for RHEL 8 · Red Hat Directory Server 11.7 E4S for RHEL 8 · Red Hat Directory Server 11.9 for RHEL 8 · Red Hat Directory Server 12.2 E4S for RHEL 9

    A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation containing a replica ID field with more than 16 digit characters. The overflow occurs during payload decoding, before any authorization check. Stack protectors limit impact to denial of service.

  6. CVE-2026-11770 7.5 Élevée

    Red Hat Directory Server 11.5 E4S for RHEL 8 · Red Hat Directory Server 11.7 E4S for RHEL 8 · Red Hat Directory Server 11.9 for RHEL 8 · Red Hat Directory Server 12.2 E4S for RHEL 9

    A flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.

  7. CVE-2026-66339 6.5 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 8

    A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure.

  8. CVE-2026-66337 6.5 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 8

    A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory.

  9. CVE-2026-59851 8.8 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Hardened Images · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 9

    A flaw was found in libssh. On servers with GSSAPIKeyExchange enabled, the gssapi-keyex path does not verify whether the authenticated Kerberos principal is authorized for the requested local user, allowing authenticated clients to log in as arbitrary users.

  10. CVE-2026-59849 7.5 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Hardened Images · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 9

    A flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.

  11. CVE-2026-59848 5.3 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 9 · Red Hat Hardened Images

    A flaw was found in libssh. A malicious SFTP server can send responses for unknown request IDs that libssh clients keep queued indefinitely, causing unbounded memory growth and client-side denial of service.

  12. CVE-2026-59844 6.5 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 9 · Red Hat Hardened Images

    A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive memory and potentially exhaust it through repeated requests.

  13. CVE-2026-59842 5.3 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Hardened Images · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 9

    A flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small amounts of server memory.

  14. CVE-2026-15370 7.3 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Hardened Images · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 9

    A flaw was found in libssh. During SFTP server directory listing, the longname field is constructed with unsafe concatenation into a fixed-size stack buffer. When a client causes the server to list attacker-controlled filenames, sufficiently long names can overflow that stack buffer and may lead to crashes or possible code execution on the server.

  15. CVE-2026-15041 3.7 Faible

    Red Hat Directory Server 11 · Red Hat Directory Server 12 · Red Hat Directory Server 13 · Red Hat Enterprise Linux 10

    A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp() for comparing password hashes instead of a constant-time comparison function. A remote attacker could potentially use timing measurements of LDAP bind attempts to infer partial hash information, though practical exploitation is extremely difficult due to PBKDF2 computational overhead.

  16. CVE-2026-14969 4.4 Moyenne

    Red Hat Directory Server 11 · Red Hat Directory Server 12 · Red Hat Directory Server 13 · Red Hat Enterprise Linux 10

    A flaw was found in 389-ds-base where the LDBM backend attribute encryption uses a hardcoded static initialization vector for AES-CBC and 3DES-CBC operations, allowing an attacker with privileged filesystem access to detect plaintext equality across encrypted entries by comparing ciphertext blocks.

  17. CVE-2026-14940 5.3 Moyenne

    Red Hat Directory Server 11 · Red Hat Directory Server 12 · Red Hat Directory Server 13 · Red Hat Enterprise Linux 10

    A heap-buffer-overflow flaw was found in 389 Directory Server (389-ds-base). When normalizing a Distinguished Name (DN) that contains a legacy-quoted value encoding a multivalued nested Relative Distinguished Name (RDN), the server can write past the end of a heap allocation while sorting RDN attribute-value pairs. An unauthenticated remote attacker can trigger this condition by sending an LDAP operation whose DN reaches the DN normalization routine, such as a search with a crafted base DN. This can corrupt heap memory and may cause denial of service.

  18. CVE-2026-13757 6.2 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 9 · Red Hat Cert Manager support for Red Hat OpenShift release 1.17 · Red Hat Cert Manager support for Red Hat OpenShift release 1.18

    A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.

  19. CVE-2026-11820 6.5 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 9 · Redhat enterprise linux

    A flaw was found in the community.general Ansible collection's nexmo module. The module constructs HTTP requests to the Vonage/Nexmo SMS API by encoding API credentials (api_key and api_secret) into URL query parameters and sending them via GET requests. This causes credentials to be exposed in web server access logs, proxy logs, HTTP Referer headers, and network monitoring tools, despite the Ansible argument specification marking these parameters as no_log. An attacker with access to any of these logging or monitoring points can obtain the full API credentials and gain unauthorized access to the victim's Vonage/Nexmo account.

  20. CVE-2026-55653 6.5 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 9

    A flaw was found in OpenSSH. A malicious SSH server can exploit a double free vulnerability in the Diffie-Hellman Group Exchange (DH-GEX) client path. This occurs during FIPS (Federal Information Processing Standards) mode known-group validation when the client processes attacker-controlled DH-GEX group parameters. Successful exploitation leads to client-side process termination, resulting in a Denial of Service (DoS).

  21. CVE-2026-11791 5.0 Moyenne

    Red Hat Directory Server 11 · Red Hat Directory Server 12 · Red Hat Directory Server 13 · Red Hat Enterprise Linux 10

    A flaw was found in 389 Directory Server. During schema reload, the attr_syntax_swap_ht() function unconditionally frees attribute syntax information nodes, bypassing the refcount-based deferred deletion used elsewhere in the attribute syntax subsystem. If an administrator triggers schema reload while concurrent LDAP query traffic is active, worker threads may access freed memory, resulting in use-after-free or double-free and a denial of service (server crash).

  22. CVE-2026-12528 5.4 Moyenne

    Red Hat Directory Server 11 · Red Hat Directory Server 12 · Red Hat Directory Server 13 · Red Hat Enterprise Linux 10

    A flaw was found in 389 Directory Server in the __aclp__normalize_acltxt() function of aclparse.c. A malformed ACI (Access Control Instruction) string can trigger heap-buffer-overflow writes and reads during ACI parsing. The function fails to validate that the ACI keyword has sufficient length after whitespace stripping, leading to a 1-byte out-of-bounds write and subsequent out-of-bounds reads. An authenticated user with write access to the aci attribute could send a crafted ACI value to silently corrupt heap memory in the directory server process.

  23. CVE-2026-44172 9.1 Critique

    MariaDB server · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Hardened Images

    MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9.

  24. CVE-2026-11793 4.9 Moyenne

    Red Hat Directory Server 11 · Red Hat Directory Server 12 · Red Hat Directory Server 13 · Red Hat Enterprise Linux 10

    A stack buffer overflow flaw was found in 389 Directory Server. The checkPrefix() function in pw.c copies an attacker-controlled algorithm ID into a 256-byte stack buffer without bounds checking when parsing reversible-encrypted attribute values. An attacker with Directory Manager privileges can crash the LDAP server by storing a crafted credential with an oversized algorithm ID. FORTIFY_SOURCE mitigates this to denial of service only.

  25. CVE-2026-11790 4.9 Moyenne

    Red Hat Directory Server 11 · Red Hat Directory Server 12 · Red Hat Directory Server 13 · Red Hat Enterprise Linux 10

    A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from stored password hashes. A privileged attacker who can modify a user's password hash can cause excessive CPU consumption during authentication, resulting in denial of service.

  26. CVE-2026-11789 6.5 Moyenne

    Red Hat Directory Server 11 · Red Hat Directory Server 12 · Red Hat Directory Server 13 · Red Hat Enterprise Linux 10

    A flaw was found in 389 Directory Server. The SMD5 password storage plugin performs unsigned integer underflow when computing salt length from a crafted password hash shorter than 16 bytes, causing a buffer over-read that crashes the LDAP server during authentication.

  27. CVE-2026-11788 7.5 Élevée

    Red Hat Directory Server 11.5 E4S for RHEL 8 · Red Hat Directory Server 11.7 E4S for RHEL 8 · Red Hat Directory Server 11.9 for RHEL 8 · Red Hat Directory Server 12.2 E4S for RHEL 9

    A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure.

  28. CVE-2026-11787 6.3 Moyenne

    Red Hat Directory Server 11 · Red Hat Directory Server 12 · Red Hat Directory Server 13 · Red Hat Enterprise Linux 10

    A flaw was found in 389 Directory Server. The ldap_utf8prev() function reads bytes before the start of a buffer without bounds checking, causing a heap buffer over-read in string filter parsing that may influence internal filter processing behavior.

  29. CVE-2026-11786 6.5 Moyenne

    Red Hat Directory Server 11 · Red Hat Directory Server 12 · Red Hat Directory Server 13 · Red Hat Enterprise Linux 10

    A flaw was found in 389 Directory Server. The LDIF parser reads past the end of a heap buffer when processing attribute types with trailing semicolons during database import, causing an out-of-bounds read detectable under memory instrumentation.

  30. CVE-2026-11785 4.3 Moyenne

    Red Hat Directory Server 11 · Red Hat Directory Server 12 · Red Hat Directory Server 13 · Red Hat Enterprise Linux 10

    A flaw was found in 389 Directory Server. A type confusion in the SSO token extended operation handler causes partial stack address information to be disclosed in LDAP responses to authenticated users.

  31. CVE-2026-11611 6.5 Moyenne

    Red Hat Directory Server 11 · Red Hat Directory Server 12 · Red Hat Directory Server 13 · Red Hat Enterprise Linux 10

    A flaw was found in 389 Directory Server. The Content Synchronization persistent search plugin allows unbounded memory growth when an authenticated client stops reading sync responses, enabling denial of service. Additional race conditions in plugin thread lifecycle can cause crashes during connection teardown or shutdown.

  32. CVE-2026-50264 7.8 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 7 Extended Lifecycle Support · Red Hat Enterprise Linux 8

    An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may be used to crash the server, or for privilege escalation if the X server runs as root.

  33. CVE-2026-50263 5.5 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION · Red Hat Enterprise Linux 7 Extended Lifecycle Support

    A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to information disclosure.

  34. CVE-2026-50262 5.5 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION · Red Hat Enterprise Linux 7 Extended Lifecycle Support

    An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size validation check can read a client-controlled number of bytes, exceeding the request buffer, leading to information disclosure. A write path also exists but requires byte-swapped clients which is disabled by default.

  35. CVE-2026-50261 7.8 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION · Red Hat Enterprise Linux 7 Extended Lifecycle Support

    A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second client connection while changing those counters. This may be used to crash the server, or for privilege escalation if the X server runs as root.

  36. CVE-2026-50260 7.8 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION · Red Hat Enterprise Linux 7 Extended Lifecycle Support

    A use-after-free flaw was found in the X.Org X server and Xwayland in FreeCounter(). A client that sets up multiple SyncCounters and awaits on those triggers can trigger a use-after-free when destroying those counters via a second client connection. This may be used to crash the server, or for privilege escalation if the X server runs as root.

  37. CVE-2026-50259 7.8 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION · Red Hat Enterprise Linux 7 Extended Lifecycle Support

    A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow. This may be used to crash the server, or for privilege escalation if the X server runs as root.

  38. CVE-2026-50258 7.8 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION · Red Hat Enterprise Linux 7 Extended Lifecycle Support

    A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. The X server has multiple stack buffers sized XkbMaxShiftLevel * XkbNumKbdGroups but CheckKeyTypes() does not verify or clamp non-canonical key types to XkbMaxShiftLevel. A client can change key types to excessive shift levels and trigger stack overflows. This is caused by an incomplete fix of CVE-2025-26597. This may be used to crash the server, or for privilege escalation if the X server runs as root.

  39. CVE-2026-50257 7.8 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION · Red Hat Enterprise Linux 7 Extended Lifecycle Support

    A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence, causing the use-after-free. This may be used to crash the server, or for privilege escalation if the X server runs as root.

  40. CVE-2026-50256 7.8 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION · Red Hat Enterprise Linux 7 Extended Lifecycle Support

    A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks. This may be used to crash the server, or for privilege escalation if the X server runs as root.

  41. CVE-2026-48710 6.5 Moyenne Exploitée

    Kludex starlette · Red Hat AI Inference Server 3.3 · Red Hat Ansible Automation Platform 2.6 · Red Hat Ansible Automation Platform 2.7

    Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) could therefore be bypassed. Users should upgrade to a version greater than or equal to version 1.0.1, which validates the `Host` header against the grammar of RFC 9112 §3.2 / RFC 3986 §3.2.2 when constructing `request.url` and falls back to `scope["server"]` for malformed values.

  42. CVE-2026-9064 7.5 Élevée

    Red Hat Directory Server 11.5 E4S for RHEL 8 · Red Hat Directory Server 11.7 E4S for RHEL 8 · Red Hat Directory Server 11.9 for RHEL 8 · Red Hat Directory Server 12.2 E4S for RHEL 9

    A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service.

  43. CVE-2026-34002 9.1 Critique

    Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION · Red Hat Enterprise Linux 7 Extended Lifecycle Support · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

    A flaw was found in the X.Org X server. This vulnerability, an out-of-bounds read, affects the XKB (X Keyboard Extension) modifier map handling. An attacker with access to the X11 server can exploit this by sending a malformed request, which causes the server to read beyond its intended memory boundaries. This can lead to the exposure of sensitive information or cause the server to crash, resulting in a denial of service.

  44. CVE-2026-34000 9.1 Critique

    Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION · Red Hat Enterprise Linux 7 Extended Lifecycle Support · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

    A flaw was found in the X.Org X server. This out-of-bounds read vulnerability in the XKB geometry processing, specifically within the `CheckSetGeom()` and `XkbAddGeomKeyAlias` functions, allows an attacker to read uninitialized or out-of-bounds memory. An attacker with a connection to the X11 server, either locally or remotely, can exploit this without user interaction. This could lead to the disclosure of memory contents or cause a denial of service by crashing the server.

  45. CVE-2026-3832 3.7 Faible

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 9 · Red Hat Cert Manager support for Red Hat OpenShift release 1.17

    A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted Online Certificate Status Protocol (OCSP) response during a TLS handshake. Due to a logic error in how gnutls processes multi-record OCSP responses, a client with OCSP verification enabled may incorrectly accept a revoked server certificate, potentially leading to a compromise of trust.

  46. CVE-2026-34486 7.5 Élevée Exploitée

    Apache Software Foundation Apache Tomcat · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 7 Extended Lifecycle Support

    Missing Encryption of Sensitive Data vulnerability in Apache Tomcat due to the fix for CVE-2026-29146 allowing the bypass of the EncryptInterceptor. This issue affects Apache Tomcat: 11.0.20, 10.1.53, 9.0.116. Users are recommended to upgrade to version 11.0.21, 10.1.54 or 9.0.117, which fix the issue.

  47. CVE-2025-32463 7.8 Élevée Exploitée

    Sudo project Sudo · Canonical ubuntu linux · Debian debian linux · Opensuse leap

    Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.

  48. CVE-2023-6915 5.5 Moyenne

    Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7

    A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may allow an attacker using this library to cause a denial of service problem due to a missing check at a function return.

  49. CVE-2022-0492 7.8 Élevée Exploitée

    kernel · Netapp h300s firmware · Netapp h410c firmware · Netapp h410s firmware

    A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.

  50. CVE-2021-4034 7.8 Élevée Exploitée Rançongiciel

    polkit · Polkit project polkit · Redhat enterprise linux server update services for sap solutions · Redhat enterprise linux

    A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

  51. CVE-2019-8506 8.8 Élevée Exploitée

    Apple iOS · Apple tvOS · Apple watchOS · Apple Safari

    A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.

  52. CVE-2018-14634 7.8 Élevée Exploitée

    The Linux Foundation kernel · Paloaltonetworks pan-os · F5 big-ip access policy manager · F5 big-ip advanced firewall manager

    An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. An unprivileged local user with access to SUID (or otherwise privileged) binary could use this flaw to escalate their privileges on the system. Kernel versions 2.6.x, 3.10.x and 4.14.x are believed to be vulnerable.

  53. CVE-2016-9079 7.5 Élevée Exploitée

    Mozilla Firefox · Mozilla Firefox ESR · Mozilla Thunderbird · Debian debian linux

    A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows. This vulnerability affects Firefox < 50.0.2, Firefox ESR < 45.5.1, and Thunderbird < 45.5.1.

  54. CVE-2017-11292 8.8 Élevée Exploitée

    Adobe Flash Player version 27.0.0.159 and earlier · Adobe flash player desktop runtime · Adobe flash player · Redhat enterprise linux desktop

    Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the calculation of an array index. This can lead to type confusion, and successful exploitation could lead to arbitrary code execution.

  55. CVE-2017-8291 7.8 Élevée Exploitée

    Artifex ghostscript · Debian debian linux · Redhat enterprise linux desktop · Redhat enterprise linux eus

    Artifex Ghostscript through 2017-04-26 allows -dSAFER bypass and remote command execution via .rsdparams type confusion with a "/OutputFile (%pipe%" substring in a crafted .eps document that is an input to the gs program, as exploited in the wild in April 2017.

  56. CVE-2016-8735 9.8 Critique Exploitée

    Apache Software Foundation Apache Tomcat · Apache tomcat · Canonical ubuntu linux · Netapp 7-mode transition tool

    Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an attacker can reach JMX ports. The issue exists because this listener wasn't updated for consistency with the CVE-2016-3427 Oracle patch that affected credential types.

  57. CVE-2016-4171 9.8 Critique Exploitée

    Adobe flash player · Redhat enterprise linux desktop · Redhat enterprise linux server · Redhat enterprise linux workstation

    Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors, as exploited in the wild in June 2016.

  58. CVE-2016-4117 9.8 Critique Exploitée Rançongiciel

    Adobe flash player · Redhat enterprise linux desktop · Redhat enterprise linux server · Redhat enterprise linux server from rhui

    Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.

  59. CVE-2015-8651 8.8 Élevée Exploitée

    Adobe air sdk · Adobe air sdk \& compiler · Adobe flash player · Adobe air

    Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adobe AIR SDK before 20.0.0.233, and Adobe AIR SDK & Compiler before 20.0.0.233 allows attackers to execute arbitrary code via unspecified vectors.

  60. CVE-2015-5287 7.8 Élevée Exploitée

    Redhat automatic bug reporting tool · Oracle linux · Redhat enterprise linux · Redhat enterprise linux desktop

    The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain privileges via a symlink attack on a file with a predictable name, as demonstrated by /var/tmp/abrt/abrt-hax-coredump or /var/spool/abrt/abrt-hax-coredump.

  61. CVE-2015-4902 5.3 Moyenne Exploitée

    Oracle jdk · Oracle jre · Redhat satellite · Redhat enterprise linux desktop

    Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.

  62. CVE-2015-4495 8.8 Élevée Exploitée

    Mozilla firefox · Mozilla firefox os · Oracle solaris · Canonical ubuntu linux

    The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and a native setter, as exploited in the wild in August 2015.

  63. CVE-2015-5477 7.5 Élevée Exploitée

    Juniper junos · Fedoraproject fedora · Redhat enterprise linux · Redhat enterprise linux aus

    named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

  64. CVE-2014-7169 9.8 Critique Exploitée

    Gnu bash · Arista eos · Oracle linux · Qnap qts

    GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.

  65. CVE-2014-6271 9.8 Critique Exploitée

    Gnu bash · Arista eos · Oracle linux · Qnap qts

    GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.

  66. CVE-2014-0196 5.5 Moyenne Exploitée

    Linux linux kernel · Debian debian linux · Redhat enterprise linux · Redhat enterprise linux eus

    The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.

  67. CVE-2014-0160 7.5 Élevée Exploitée

    Openssl openssl · Filezilla-project filezilla server · Siemens application processing engine firmware · Siemens cp 1543-1 firmware

    The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys, related to d1_both.c and t1_lib.c, aka the Heartbleed bug.

  68. CVE-2014-0502 8.8 Élevée Exploitée

    adobe flash_player · adobe air · adobe air_sdk · Adobe flash player

    Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK & Compiler before 4.0.0.1628 allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in February 2014.

  69. CVE-2014-0497 9.8 Critique Exploitée

    adobe flash_player · Adobe flash player · Google chrome · Redhat enterprise linux desktop

    Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.

  70. CVE-2013-0641 7.8 Élevée Exploitée

    Adobe acrobat · Adobe acrobat reader · Redhat enterprise linux desktop · Redhat enterprise linux eus

    Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute arbitrary code via a crafted PDF document, as exploited in the wild in February 2013.

  71. CVE-2013-0640 7.8 Élevée Exploitée

    Adobe acrobat · Adobe acrobat reader · Opensuse opensuse · Suse linux enterprise desktop

    Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document, as exploited in the wild in February 2013.

  72. CVE-2012-1535 7.8 Élevée Exploitée

    Adobe flash player · Redhat enterprise linux desktop · Redhat enterprise linux server · Redhat enterprise linux workstation

    Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted SWF content, as exploited in the wild in August 2012 with SWF content in a Word document.

  73. CVE-2012-1823 9.8 Critique Exploitée

    Php php · Fedoraproject fedora · Debian debian linux · Hp hp-ux

    sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing command-line options in the query string, related to lack of skipping a certain php_getopt for the 'd' case.

  74. CVE-2011-3544 9.8 Critique Exploitée

    Oracle jdk · Oracle jre · Canonical ubuntu linux · Redhat satellite with embedded oracle

    Unspecified vulnerability in the Java Runtime Environment component in Oracle Java SE JDK and JRE 7 and 6 Update 27 and earlier allows remote untrusted Java Web Start applications and untrusted Java applets to affect confidentiality, integrity, and availability via unknown vectors related to Scripting.

  75. CVE-2010-3904 7.8 Élevée Exploitée

    Linux linux kernel · Opensuse opensuse · Suse linux enterprise desktop · Suse linux enterprise real time extension

    The rds_page_copy_user function in net/rds/page.c in the Reliable Datagram Sockets (RDS) protocol implementation in the Linux kernel before 2.6.36 does not properly validate addresses obtained from user space, which allows local users to gain privileges via crafted use of the sendmsg and recvmsg system calls.