CVE-2026-78628

The Okta Credential Provider for Windows does not validate a serialized credential buffer before interpreting it as a Kerberos logon structure. The buffer size and packed string offsets are not checked. Processing a malformed buffer can cause the credential provider process to terminate...

CVE-2026-78628 Improper Input Validation in the Okta Credential Provider for Windows

The Okta Credential Provider for Windows does not validate a serialized credential buffer before interpreting it as a Kerberos logon structure. The buffer size and packed string offsets are not checked. Processing a malformed buffer can cause the credential provider process to terminate...

CVE-2026-78628

The Okta Credential Provider for Windows contains an improper input validation vulnerability. The software fails to validate the buffer size and packed string offsets of a serialized credential buffer before interpreting it as a Kerberos logon structure . Processing a malformed buffer can cause t...

CVE-2026-57866 Apache Impala: Secrets Exfiltration via SSRF

Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the aigeneratetext function can exfiltrate secrets provided by the credential providers configured in the hadoop.security.credential.provider.path property of...

CVE-2026-57866 Apache Impala: Secrets Exfiltration via SSRF

Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the aigeneratetext function can exfiltrate secrets provided by the credential providers configured in the hadoop.security.credential.provider.path property of...

CVE-2026-57866

Apache Impala versions 4.4.x and 4.5.x are vulnerable to a Server Side Request Forgery (SSRF) . Authenticated users authorized to execute the ai_generate_text() function can exfiltrate secrets from credential providers defined in the hadoop.security.credential.provider.path property of core-site....

PT-2026-88923

Server side request forgery in Apache Impala versions 4.4.x and 4.5.x. Authenticated Impala users with permissions to execute the ai generate text function can exfiltrate secrets provided by the credential providers configured in the hadoop.security.credential.provider.path property of...

EUVD-2026-73035

Heap-based buffer overflow in Windows Credential Providers allows an authorized attacker to elevate privileges locally...

Chromium: CVE-2026-76037 Link following in CredentialProvider

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Malicious Package

Overview @depup/aws-sdkcredential-provider-process is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

Malicious code in @depup/aws-sdk__credential-provider-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b8db6e7dceac14f7371e7884b9252f3d3c39f37263839bb043b09354d5d2a0d @depup/aws-sdkcredential-provider-process is a republished fork of the official @aws-sdk/credential-provider-process package. It preserves AWS author...

MAL-2026-13623 Malicious code in @depup/aws-sdk__credential-provider-process (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b8db6e7dceac14f7371e7884b9252f3d3c39f37263839bb043b09354d5d2a0d @depup/aws-sdkcredential-provider-process is a republished fork of the official @aws-sdk/credential-provider-process package. It preserves AWS author...

CVE-2026-19139

Race in CredentialProvider in Google Chrome on Windows prior to 151.0.7922.109 allowed a local attacker to perform OS-level privilege escalation via a malicious file. Chromium security severity: High...

CVE-2026-19139

A race condition in the CredentialProvider component of Google Chrome on Windows (versions prior to 151.0.7922.109 ) allows a local attacker to achieve OS-level privilege escalation by using a malicious file. This vulnerability affects Microsoft Edge as well, as it ingests the Chromium project. I...

KLA91189 Multiple vulnerabilities in Google Chrome

Multiple vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in WebGL can be exploited remotely to execute arbitrary...

Chromium: CVE-2026-14124 Inappropriate implementation in CredentialProvider

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Linux Distros Unpatched Vulnerability : CVE-2026-14124

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Inappropriate implementation in CredentialProvider in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege...

CVE-2026-14124

Inappropriate implementation in CredentialProvider in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation via a malicious file. Chromium security severity: Low...

CVE-2026-14124

Inappropriate implementation in CredentialProvider in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation via a malicious file. Chromium security severity: Low...

CVE-2026-14124

A flaw in the CredentialProvider component of the Chromium browser (used in Google Chrome on Windows) allows a local attacker to achieve OS-level privilege escalation by using a malicious file. The vulnerability was addressed in Chromium 150.0.7871.47 . Exploitation details are not provided in th...