CVE-2026-75156

The apache-airflow-providers-fab package (versions 3.7.3 through 3.8.0) is vulnerable to an Origin Validation Error during OAuth login when configured with Azure AD. The root cause is the failure to validate the issuer or audience of Azure AD id_tokens within the _decode_and_validate_azure_jwt fu...

Active Directory Certificate Services (AD CS) Elevation of Privilege Vulnerability

Improper encoding or escaping of output in Active Directory Certificate Services AD CS allows an authorized attacker to elevate privileges locally...

Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability

Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network...

Active Directory Certificate Services (AD CS) Tampering Vulnerability

Incomplete list of disallowed inputs in Active Directory Certificate Services AD CS allows an authorized attacker to perform tampering over a network...

Active Directory Federation Services (AD FS) Denial of Service Vulnerability

Allocation of resources without limits or throttling in Active Directory Federation Services AD FS allows an unauthorized attacker to deny service over a network...

Active Directory Certificate Services (AD CS) Information Disclosure Vulnerability

Use of externally-controlled format string in Active Directory Certificate Services AD CS allows an authorized attacker to disclose information over a network...

Active Directory Certificate Services (AD CS) Elevation of Privilege Vulnerability

Heap-based buffer overflow in Active Directory Certificate Services AD CS allows an authorized attacker to elevate privileges locally...

CVE-2026-75156: Origin Validation Error

Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD idtokens during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's...

CVE-2026-69395: Use of Externally-Controlled Format String

Use of externally-controlled format string in Active Directory Certificate Services AD CS allows an authorized attacker to disclose information over a network...

PT-2026-88454

The administrative panel of the Auth0 AD/LDAP Connector versions 6.5.0 and earlier listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Throu...

CVE-2026-62810: Heap-based Buffer Overflow

Heap-based buffer overflow in Active Directory Certificate Services AD CS allows an authorized attacker to elevate privileges locally...

CVE-2026-85983: Improper Control of Generation of Code

The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the...

EulerOS 2.0 SP12 : sssd (EulerOS-SA-2026-3314)

According to the versions of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory...

CVE-2026-69624: Incomplete List of Disallowed Inputs

Incomplete list of disallowed inputs in Active Directory Certificate Services AD CS allows an authorized attacker to perform tampering over a network...

PT-2026-88455

The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting XSS issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on...

PT-2026-87889

Name of the Vulnerable Software and Affected Versions Active Directory Federation Services affected versions not specified Description An issue exists where resources are allocated without limits or throttling, which allows an unauthorized attacker to cause a denial of service over a network...

PT-2026-87211

Name of the Vulnerable Software and Affected Versions Active Directory Certificate Services affected versions not specified Description A heap-based buffer overflow occurs in Active Directory Certificate Services AD CS, which allows an authorized attacker to elevate privileges locally. A heap-bas...

PT-2026-87743

Improper encoding or escaping of output in Active Directory Certificate Services AD CS allows an authorized attacker to elevate privileges locally...

PT-2026-87625

Incomplete list of disallowed inputs in Active Directory Certificate Services AD CS allows an authorized attacker to perform tampering over a network...

PT-2026-88456

The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the...