CVE-2026-95676: Improper Authentication

A missing/improper authentication vulnerability in the WatchGuard AuthPoint Gateway's LDAP Sync first-factor authentication allows a remote attacker to bypass single-factor password verification under non-default operating conditions. Additional authentication factors still apply...

ALSA-2026:70564 Critical: ipa security, bug fix, and enhancement update

AlmaLinux Identity Management IdM is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fixes: ipa: FreeIPA: Unauthenticated DoS in /ipa/i18nmessages via Unbounded Request Body Read CVE-2026-73198 ip...

PT-2026-97314

Name of the Vulnerable Software and Affected Versions WatchGuard AuthPoint Gateway affected versions not specified Description An improper authentication issue exists in the LDAP Sync first-factor authentication. This allows a remote attacker to bypass single-factor password verification when the...

CVE-2026-90462

A flaw was found in SSSD. When configured with the LDAP access provider and ldapaccessorder including ppolicy or lockout, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision,...

CVE-2026-90462 Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization

A flaw was found in SSSD. When configured with the LDAP access provider and ldapaccessorder including ppolicy or lockout, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision,...

EUVD-2026-84537

A flaw was found in SSSD. When configured with the LDAP access provider and ldapaccessorder including ppolicy or lockout, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision,...

CVE-2026-90462 Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization

A flaw was found in SSSD. When configured with the LDAP access provider and ldapaccessorder including ppolicy or lockout, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision,...

CVE-2026-90462

A flaw was found in SSSD. When configured with the LDAP access provider and ldapaccessorder including ppolicy or lockout, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision,...

CVE-2026-90462

A flaw in SSSD occurs when using the LDAP access provider with ldap_access_order containing ppolicy or lockout. A fail-open condition exists in the LDAP ppolicy access check if a user lookup returns zero results, which can incorrectly return success and cache an allow decision. This allows a remo...

CVE-2026-90462

A flaw was found in SSSD. When configured with the LDAP access provider and ldapaccessorder including ppolicy or lockout, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision,...

Security Bulletin: Due to the use of Bouncy Castle for Java, IBM Sterling Control Center is vulnerable to Memory Allocation, Improper Validation, Inadequate Encryption Strength, Inefficient Algorithmic Complexity and LDAP Injection.

Summary Bouncy Castle for Java is used by IBM Sterling Control Center as part of dependency in bcprov-jdk18on-1.81.jar Vulnerability Details CVEID:CVE-2026-12185 DESCRIPTION: In Bouncy Castle for Java before 1.85, BKS/UBER keystore allocates from untrusted lengths before integrity check. This iss...

Linux Distros Unpatched Vulnerability : CVE-2026-90462

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in SSSD. When configured with the LDAP access provider and ldapaccessorder including ppolicy or lockout, a fail-open condition in the LDAP...

LDAP Distinguished Name (DN) injection vulnerability in Apache Shiro

A remote attacker can inject LDAP special characters into the Distinguished Name DN construction in DefaultLdapRealm class. User-supplied username input is directly concatenated into the LDAP DN template without any escaping of RFC 2253 special characters. This allows an attacker to manipulate th...

CVE-2026-90462: Improper Handling of Insufficient Permissions or Privileges

A flaw was found in SSSD. When configured with the LDAP access provider and ldapaccessorder including ppolicy or lockout, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision,...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: bouncycastle (UTSA-2023-002171)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002171 advisory. Bouncy Castle For Java before 1.74 is affected by an LDAP injection vulnerability. The vulnerability only affects applications that use an LDAP CertStore from Bouncy...

PT-2026-96814

Name of the Vulnerable Software and Affected Versions SSSD affected versions not specified Description A flaw exists when the software is configured with the LDAP access provider and the ldap access order variable includes ppolicy or lockout. A fail-open condition occurs during the LDAP ppolicy...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-ldap (UTSA-2026-054076)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054076 advisory. python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of...

log4j-shell-poc-azure

log4j-shell-poc A Proof-Of-Concept for the recently found CVE-...

CLSA-2026-1789959015 TuxCare security update for org.springframework.ldap (1 CVE)

TuxCare rebuilt 10 org.springframework.ldap packages to address 1 CVE. Fixed in 2.3.1.RELEASE-tuxcare.1...

CLEANSTART-2026-EU32419 It was identified that the LDAP client implementation in version 2

Security vulnerability affects the keycloak package. It was identified that the LDAP client implementation in version 2...