CVE Intelligence
Início / CVEs

Base de CVEs

Vulnerabilidades publicadas, com severidade, exploração conhecida e fontes oficiais.

Severidade
Limpar

5 resultado(s)

Exportar esta busca: RSS · CSV · STIX
CVE-2026-92821 Média · 6.8 CWE-393 05/10/2026
Sssd: sssd: access control bypass via premature ldap access rule evaluation
A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory Access Protocol) environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote authenticated user with an expired password using an alternative authentication method, such as SSH public key authentication, can exploit this flaw to bypass access control restrictions and gain unauthorized access to protected systems.
CVE-2026-92834 Média · 6.3 CWE-393 02/10/2026
Apache Thrift: C++ WebSocket server transport does not read a full request length
Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift C++ WebSocket server. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-85483 Média · 6.3 CWE-393 02/10/2026
Apache Thrift: c_glib TZlibTransport reports a full read after a premature stream end
Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-53092 Alta · 7.8 CWE-393 24/06/2026
bpf: Fix linked reg delta tracking when src_reg == dst_reg
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix linked reg delta tracking when src_reg == dst_reg Consider the case of rX += rX where src_reg and dst_reg are pointers to the same bpf_reg_state in adjust_reg_min_max_vals(). The latter first modifies the dst_reg in-place, and later in the delta tracking, the subsequent is_reg_const(src_reg)/reg_const_value(src_reg) reads the post-{add,sub} value instead of the original source. This is problematic since it sets an incorrect delta, which sync_linked_regs() then propagates to linked registers, thus creating a verifier-vs-runtime mismatch. Fix it by just skipping this corner case.
CVE-2025-24531 Média · 6.7 CWE-393 16/01/2026
In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in…
In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered by a smartcard before login), allowing authentication bypass.