PT-2026-107174

Name of the Vulnerable Software and Affected Versions SSSD affected versions not specified Description In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control HBAC rules by stripping domain qualifiers and comparing only short usernames. This allows an...

AlmaLinux 9.2 [TuxCare] Security Update: cups / cups-client / cups-devel / cups-filesystem / cups-ipptool / etc (ALMALINUX9.2:CLSA-2026:1780067463)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1780067463 advisory. - OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, CUPS...

Kibana 9.4.x < 9.4.5 / 9.5.x < 9.5.1 Incorrect Authorization (ESA-2026-124)

The version of Kibana installed on the remote host is 9.4.x prior to 9.4.5, or 9.5.x prior to 9.5.1. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-124 advisory. - Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user...

PT-2026-79937

Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A username is not unique across Elasticsearch authentication realms, so two distinct principals that...

CVE-2026-72643 Incorrect Authorization in Kibana Agent Builder Leading to Disclosure and Tampering of Private Agents

Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A username is not unique across Elasticsearch authentication realms, so two distinct principals that...

CVE-2026-72643: Incorrect Authorization

Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A username is not unique across Elasticsearch authentication realms, so two distinct principals that...

CLSA-2026-1779215547 cups: Fix of CVE-2026-27447

CVE-2026-27447: fix authorization bypass via case-insensitive username comparison in scheduler...

CVE-2026-27447

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, CUPS daemon cupsd contains an authorization bypass vulnerability due to case-insensitive username comparison during authorization checks. The vulnerability allows an...

CVE-2024-36469

Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one...

Interledger is Unmaintained

Interledger family of crates is not being actively maintained anymore. The owner of the published crate does not appear to be responsive. There is an outstanding concern around username comparison. This concern may or may not be resolved by bumping up the dependencies of the project...

RUSTSEC-2022-0050 Interledger is Unmaintained

Interledger family of crates is not being actively maintained anymore. The owner of the published crate does not appear to be responsive. There is an outstanding concern around username comparison. This concern may or may not be resolved by bumping up the dependencies of the project...

PT-2022-37421 · Unknown · Interledger

Name of the Vulnerable Software and Affected Versions: Interledger affected versions not specified Description: The Interledger family of crates is no longer actively maintained, and the owner of the published crate is unresponsive. There is a concern regarding username comparison, which may or m...