Veille CVE

Semaine du 14 septembre au 20 septembre 2026

11 CVE

Critique 1 Élevée 2 Moyenne 8 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Red Hat OpenShift Container Platform 4 » ✕
  1. CVE-2026-75885 9.3 Critique

    Red Hat OpenShift Container Platform 4.12 · Red Hat OpenShift Container Platform 4.13 · Red Hat OpenShift Container Platform 4.14 · Red Hat OpenShift Container Platform 4.15

    A flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where the console pod makes requests to internal services and reflects partial responses to the attacker. Additionally, by sending repeated large requests without a specified content length, an attacker can cause unbounded memory growth, leading to a Denial of Service (DoS).

  2. CVE-2026-81627 8.2 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 8

    A flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset D_LCK protection and injecting code into System Management Mode memory.

  3. CVE-2026-76781 5.5 Moyenne

    Red Hat Hardened Images · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7

    A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a `nextCatalog` element lacks its mandatory `catalog` attribute, leading to the application crashing and causing a Denial of Service (DoS).

  4. CVE-2026-42784 7.4 Élevée

    Red Hat Ansible Automation Platform 2.6 for RHEL 9 · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 9 · Red Hat Cost Management On-Premise 1

    A flaw was found in sequoia-openpgp. The library incorrectly infers key flags for older certificates when a key flags subpacket is missing, leading to a discrepancy in how key capabilities are viewed. This key flag confusion allows an attacker to bypass the back-signature check. Consequently, an attacker can illegitimately bind an arbitrary subkey to their own certificate and forge signatures, completely compromising cryptographic integrity.

  5. CVE-2025-11395 5.5 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 9 · Red Hat Enterprise Linux 8 · Red Hat Hardened Images

    A flaw was found in Podman. If an attacker can pass a crafted tar archive to the `podman load` command, they can create files on the host machine with the privileges of the user running Podman.

  6. CVE-2026-79705 4.5 Moyenne

    Red Hat Hardened Images · Red Hat Ansible Automation Platform 2 · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 8

    A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can escape the target extraction directory and create files outside the intended destination. Buildah itself uses chroot hardening and is not affected.

  7. CVE-2026-79699 4.4 Moyenne

    Red Hat Ansible Automation Platform 2 · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 9

    A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can cause the extraction destination directory to be replaced with an arbitrary file when processed by storage/pkg/archive.UnpackLayer, ApplyLayer, or ApplyUncompressedLayer.

  8. CVE-2026-90996 5.5 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 8

    A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affects the availability of the system responder.

  9. CVE-2026-90995 5.5 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 8

    A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules) responder socket can send a specially crafted protocol request. If the `pam_app_services` configuration is enabled and the service item is omitted from the request, a NULL pointer dereference can occur. This vulnerability leads to a denial of service, causing the PAM responder to crash and disrupt authentication services.

  10. CVE-2026-90994 4.0 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 8

    A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This can trigger an out-of-bounds read, potentially causing the PAM responder to terminate or restart, leading to a local denial of service.

  11. CVE-2026-90463 4.0 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 8

    A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service (DoS) by crashing the NSS responder process. While unprivileged local clients can typically reach the socket, there is no evidence of privilege escalation or reliable data disclosure.