3987 matches found
EUVD-2026-73369
Heap-based buffer overflow in Active Directory Certificate Services AD CS allows an authorized attacker to elevate privileges locally...
CVE-2026-72978
Active Directory Federation Services (AD FS) contains a resource allocation without limits or throttling flaw that allows an unauthorized, network-based attacker to deny service . The impact is limited to availability—no confidentiality or integrity compromise. NVD scores it 7.5 (HIGH) while Micr...
CVE-2026-75156 Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD idtokens during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's...
CVE-2026-75156 Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD idtokens during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's...
EUVD-2026-72933
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD idtokens during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's...
CVE-2026-75156
The apache-airflow-providers-fab package (versions 3.7.3 through 3.8.0) is vulnerable to an Origin Validation Error during OAuth login when configured with Azure AD. The root cause is the failure to validate the issuer or audience of Azure AD id_tokens within the _decode_and_validate_azure_jwt fu...
CVE-2026-75156 Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD idtokens during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's...
Active Directory Certificate Services (AD CS) Information Disclosure Vulnerability
Use of externally-controlled format string in Active Directory Certificate Services AD CS allows an authorized attacker to disclose information over a network...
Active Directory Certificate Services (AD CS) Tampering Vulnerability
Incomplete list of disallowed inputs in Active Directory Certificate Services AD CS allows an authorized attacker to perform tampering over a network...
Active Directory Certificate Services (AD CS) Elevation of Privilege Vulnerability
Heap-based buffer overflow in Active Directory Certificate Services AD CS allows an authorized attacker to elevate privileges locally...
Active Directory Certificate Services (AD CS) Elevation of Privilege Vulnerability
Improper encoding or escaping of output in Active Directory Certificate Services AD CS allows an authorized attacker to elevate privileges locally...
Active Directory Federation Services (AD FS) Denial of Service Vulnerability
Allocation of resources without limits or throttling in Active Directory Federation Services AD FS allows an unauthorized attacker to deny service over a network...
Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network...
Meta Failed to Catch Hundreds of AI Child Abuse Ads. Some Included Images of Real Kids
Images of real children—including a member of a European royal family—were used to create some of the 350 ads containing child sexual abuse. Lawmakers say they plan to investigate...
PT-2026-87743
Improper encoding or escaping of output in Active Directory Certificate Services AD CS allows an authorized attacker to elevate privileges locally...
PT-2026-87625
Incomplete list of disallowed inputs in Active Directory Certificate Services AD CS allows an authorized attacker to perform tampering over a network...
PT-2026-87432
Use of externally-controlled format string in Active Directory Certificate Services AD CS allows an authorized attacker to disclose information over a network...
PT-2026-87211
Name of the Vulnerable Software and Affected Versions Active Directory Certificate Services affected versions not specified Description A heap-based buffer overflow occurs in Active Directory Certificate Services AD CS, which allows an authorized attacker to elevate privileges locally. A heap-bas...
CVE-2026-69395: Use of Externally-Controlled Format String
Use of externally-controlled format string in Active Directory Certificate Services AD CS allows an authorized attacker to disclose information over a network...
CVE-2026-69821: Improper Encoding or Escaping of Output
Improper encoding or escaping of output in Active Directory Certificate Services AD CS allows an authorized attacker to elevate privileges locally...