9332 matches found
CVE-2026-75156
The apache-airflow-providers-fab package (versions 3.7.3 through 3.8.0) is vulnerable to an Origin Validation Error during OAuth login when configured with Azure AD. The root cause is the failure to validate the issuer or audience of Azure AD id_tokens within the _decode_and_validate_azure_jwt fu...
CVE-2026-75156 Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD idtokens during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's...
CVE-2026-73316
XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers can replay a valid webhook payload to trigger duplicate...
Windows Storage Management Provider Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Storage Management Provider allows an authorized attacker to elevate privileges locally...
Windows HTTP Print Provider Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows HTTP Print Provider allows an unauthorized attacker to execute code over a network...
Windows Storage Management Provider Elevation of Privilege Vulnerability
Stack-based buffer overflow in Windows Storage Management Provider allows an authorized attacker to elevate privileges locally...
Windows HTTP Print Provider Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows HTTP Print Provider allows an authorized attacker to execute code over a network...
Windows AF_UNIX Socket Provider Elevation of Privilege Vulnerability
Use after free in Windows AFUNIX Socket Provider allows an authorized attacker to elevate privileges locally...
Microsoft WDAC OLE DB provider for SQL Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft WDAC OLE DB provider for SQL allows an unauthorized attacker to execute code over a network...
CVE-2026-73316 XenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider
XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers can replay a valid webhook payload to trigger duplicate...
Security update for terraform-provider-null
This update for terraform-provider-null fixes the following issues: CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches bsc1278269. CVE-2026-84304: github.com/grpc/grpc-go:...
SUSE-SU-2026:4062-1 Security update for terraform-provider-null
This update for terraform-provider-null fixes the following issues: - CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches bsc1278269. - CVE-2026-84304: github.com/grpc/grpc-g...
CVE-2026-75156: Origin Validation Error
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD idtokens during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's...
EulerOS 2.0 SP12 : sssd (EulerOS-SA-2026-3314)
According to the versions of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory...
PT-2026-88500
Impact The public OIDC login and callback endpoints ran the full flow whether or not OIDC was the instance's active, enabled authentication method, so turning OIDC off in Settings did not stop it issuing sessions. An administrator who disabled the provider still had a working login route. The pat...
PT-2026-87829
Name of the Vulnerable Software and Affected Versions Windows Storage Management Provider affected versions not specified Description A stack-based buffer overflow occurs in the Windows Storage Management Provider. This issue allows an authorized attacker to elevate privileges locally on the...
CVE-2026-70565: Use After Free
Use after free in Windows AFUNIX Socket Provider allows an authorized attacker to elevate privileges locally...
CVE-2026-72933: Heap-based Buffer Overflow
Heap-based buffer overflow in Microsoft WDAC OLE DB provider for SQL allows an unauthorized attacker to execute code over a network...
CVE-2026-73313: Incorrect Authorization
XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete login as another user by submitting their own registered passkey credential during the WebAuthn assertion step. The passkey verification...