CVE-2026-13097 Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore

A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to...

RockyLinux 10 : yggdrasil (RLSA-2026:57126)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:57126 advisory. crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-33810 Tenable has extracted the precedin...

AlmaLinux 10 : yggdrasil (ALSA-2026:57126)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:57126 advisory. crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application CVE-2026-33810 Tenable has extracted the preceding...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

Important: Red Hat Security Advisory: yggdrasil security update

An update for yggdrasil is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

GHSA-JFJ5-WRJ9-63X4 langgraph-api: Incomplete assistant authorization in LangGraph Server run creation

Summary In affected versions of langgraph-api the LangGraph Server runtime, the run-creation path authorized the assistant attached to a run using a different authorization event than the rest of the assistant-handling code paths. Direct assistant reads and cron creation dispatch the...

ALSA-2026:57126 Important: yggdrasil security update

yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker. Security Fixes: crypto/x509: golang: Go crypto/x509: Certificate...

RHEL 10 : yggdrasil (RHSA-2026:57126)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:57126 advisory. yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child worker...

GHSA-VJF8-9FX6-MV6X Triton VM Soundness Vulnerability due to Missing Constraint

The instruction spongeabsorbmem Triton VM fails to verify that hashed values come from the claimed memory location. Malicious provers can substitute arbitrary data instead of actual memory contents. Any application using instruction spongeabsorbmem to hash memory data can be given a proof for a...

Triton VM Soundness Vulnerability due to Missing Constraint

The instruction spongeabsorbmem Triton VM fails to verify that hashed values come from the claimed memory location. Malicious provers can substitute arbitrary data instead of actual memory contents. Any application using instruction spongeabsorbmem to hash memory data can be given a proof for a...

crypto/x509: Incorrect enforcement of email constraints in crypto/x509

A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly...

crypto/x509: Incorrect enforcement of email constraints in crypto/x509

A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly...

Apache Tomcat: Apache Tomcat: Security constraint bypass due to improper access control

A flaw was found in Apache Tomcat. This improper access control and incorrect authorization vulnerability allows an attacker to bypass security constraints. This occurs when a security constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path, potential...

CVE-2026-71193

A flaw was found in OpenStack Designate. When the AttributeFilter scheduler is enabled with multiple DNS pools, an authenticated tenant can bypass zone ownership checks by scheduling a zone to a different pool. The database uniqueness constraint on zone names is pool-scoped, and the...

python-cryptography: python-cryptography: python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees

A flaw was found in python-cryptography. This vulnerability arises from incorrect handling of wildcard Domain Name System DNS names during certificate validation. Specifically, the verifier may accept a certificate with a broad wildcard DNS name e.g., .example.com even when a more restrictive nam...

crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application

A flaw was found in the crypto/x509 package within Go golang. When verifying a certificate chain, excluded DNS Domain Name System constraints are not correctly applied to wildcard DNS Subject Alternative Names SANs if the case of the SAN differs from the constraint. This oversight could allow an...

crypto/x509: Incorrect enforcement of email constraints in crypto/x509

A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly...

CVE-2026-72650

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user who is authorized to read alerting rules in a single Kibana space could retrieve alerting rule executio...

EUVD-2026-58267

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no access to, via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A user who is authoriz...

CVE-2026-72666 Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Query Execution on Managed Hosts

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to unauthorized query execution against Elastic Agents that are assigned to a Kibana space the requesting user has no access to, via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. A user who is authoriz...