CVE-2026-59998

sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory...

CVE-2026-59998

sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory...

UBUNTU-CVE-2026-59998

sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory...

CVE-2026-59998

sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory...

CVE-2026-59998

sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory...

CVE-2026-59998

sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory...

EUVD-2026-42141

sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory...

CVE-2026-59998

sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory...

CVE-2026-59998

OpenSSH sshd (CVE-2026-59998) affects builds before 10.4. The issue is an undocumented security-relevant behavior where GSSAPIStrictAcceptorCheck has no value when the server runs in Windows Active Directory. CVSS v3.1 base score 4.8 (Medium) and impact on confidentiality/integrity (Low) with net...

CVE-2026-59998

sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory...

CVE-2026-59998

sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory...

CVE-2026-59998: Improper Following of Specification by Caller

sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory...

Pardus Domain Joiner 0.5.2 Credential Disclosure

A security vulnerability has been identified in Pardus Domain Joiner version 0.5.2, where Active Directory administrative credentials are passed as plaintext command-line arguments during domain join and domain leave operations...

PT-2026-56289

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 10.4 Description The sshd component contains an undocumented security-relevant behavior where the GSSAPIStrictAcceptorCheck setting is ignored and has no effect when the server is integrated into a Windows Active...

📄 NTLM Relay to Self Attack Module for Active Directory Privilege Escalation

This is a Metasploit module designed for Windows/Active Directory environments that performs an advanced NTLM relay-to-self attack to escalate privileges on a compromised machine...

PYSEC-2026-1463 Infrahub: Deleted and expired API tokens can still authenticate

Impact A bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account can authenticate successfully. Patches This issue is fixed in versions 1.3.9 and 1.4.5 Workarounds...

Backend.AI Missing Authorization vulnerability

Missing Authorization in Lablup's BackendAI allows attackers to takeover all active sessions; Accessing, stealing, or altering any data accessible in the session. This vulnerability exists in all current versions of BackendAI.NOTE: The maintainers of BackendAI do not consider this report to fit...

GO-2026-5892 Casdoor doesn't verify that a JWT used for token exchange is still active in github.com/casdoor/casdoor

Casdoor doesn't verify that a JWT used for token exchange is still active in github.com/casdoor/casdoor...

User accounts disclosed to unauthenticated actors on the LAN

SummaryThe login page discloses all active user accounts to any unauthenticated browsing request originating on the Local Area Network. DetailsStarting the Home Assistant 2023.12 release, the login page returns all currently active user accounts to browsing requests from the Local Area Network...

CVE-2026-14476

A path traversal flaw was found in SSSD's AD GPO provider. The adgpoextractsmbcomponents function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL...