CVE-2026-69821: Improper Encoding or Escaping of Output

Improper encoding or escaping of output in Active Directory Certificate Services AD CS allows an authorized attacker to elevate privileges locally...

PT-2026-87432

Use of externally-controlled format string in Active Directory Certificate Services AD CS allows an authorized attacker to disclose information over a network...

CVE-2026-85982: Improper Neutralization of Input During Web Page Generation

The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting XSS issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on...

PT-2026-87173

Name of the Vulnerable Software and Affected Versions Apache Airflow FAB provider versions 3.7.3 through 3.8.0 Description An issue exists during OAuth login when the FAB auth manager is configured with Azure AD as an OAuth provider. The software fails to validate the issuer or audience of Azure ...

CVE-2026-85981: Missing Authentication for Critical Function

The administrative panel of the Auth0 AD/LDAP Connector versions 6.5.0 and earlier listens on the local loopback interface without requiring authentication. This allows a local, low-privileged user or process on the host system to access the panel's management endpoints without credentials. Throu...

CVE-2026-72978: Allocation of Resources Without Limits or Throttling

Allocation of resources without limits or throttling in Active Directory Federation Services AD FS allows an unauthorized attacker to deny service over a network...

EulerOS 2.0 SP12 : sssd (EulerOS-SA-2026-3389)

According to the versions of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory...

ublockdnsclient v0.3.1

uBlockDNS Client uBlockDNS Client is an independent project and is not affiliated with, endorsed by, or related to uBlock Origin or its maintainer. uBlockDNS Client brings DNS-level ad and tracker blocking to your entire device. It uses community-maintained filter lists such as EasyList and...

EUVD-2026-70795

Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-83711

Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-83711

Microsoft Azure Active Directory B2C is affected by an authorization bypass vulnerability caused by a user-controlled key, enabling an unauthorized attacker to elevate privileges over the network. The vulnerability is rated CVSS 3.1 10.0 (Critical) with no privileges required , no user interactio...

PT-2026-85314

Name of the Vulnerable Software and Affected Versions Microsoft Azure Active Directory B2C affected versions not specified Description An authorization bypass exists in cloud identity deployments supporting public-facing authentication flows. This issue occurs due to a user-controlled key, which...

EUVD-2026-70145

Jenkins Microsoft Entra ID previously Azure AD Plugin 710.v0bff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a...

Privilege escalation in azure-ad

azure-ad 710.v0bff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID GUID and its display name. Entra group display names are not globally unique, and unless the tenant restricts it, any tenant member can create a group with an arbitrary display name. This...

Security update for yast2-auth-client

This update for yast2-auth-client fixes the following issue: Update to version 4.7.1. CVE-2026-59681: OS command injection via unsanitized Organizational Unit/dnsHostName in AD join AutoYaST-reachable bsc1272775. Patch Instructions: To install this SUSE update use the SUSE recommended installatio...

SUSE-SU-2026:3914-1 Security update for yast2-auth-client

This update for yast2-auth-client fixes the following issue: Update to version 4.7.1. - CVE-2026-59681: OS command injection via unsanitized Organizational Unit/dnsHostName in AD join AutoYaST-reachable bsc1272775...

CVE-2026-59681

CVE-2026-59681 is an OS command injection in yast2-auth-client (SUSE/YaST). The vulnerable code in Auth::AuthConf (src/lib/auth/authconf.rb) interpolates unsanitized Active Directory configuration values—Organizational Unit , dnsHostName , AD user name, and AD domain name—directly into net ads jo...

TencentOS Server 2: sssd (TSSA-2026:0944)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0944 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

The vulnerability of the Active Directory Certificate Services (AD CS) service, which manages the distribution and usage of certificates, allows a perpetrator to execute arbitrary code.

The vulnerability of the Active Directory Certificate Services AD CS service, which manages distribution and usage of certificates on Windows operating systems, is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

Security update for yast2-auth-client

This update for yast2-auth-client fixes the following issue: Update to version 4.6.3. CVE-2026-59681: OS command injection via unsanitized Organizational Unit/dnsHostName in AD join AutoYaST-reachable bsc1272775. Patch Instructions: To install this SUSE update use the SUSE recommended installatio...