14785 matches found
CVE-2026-68757
A user with access to a valid SAML response may impersonate another user under specific conditions...
EUVD-2026-57253
A user with access to a valid SAML response may impersonate another user under specific conditions...
EUVD-2026-57230
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS getconditionvalues folds attacker-controlled request headers from HeaderMap into server-derived userid, username, principaltype, groups, versionid, signatureversion, jwt:, and ldap: condition keys, allowin...
PT-2026-71112
A user with access to a valid SAML response may impersonate another user under specific conditions...
PT-2026-71089
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS get condition values folds attacker-controlled request headers from HeaderMap into server-derived userid, username, principaltype, groups, versionid, signatureversion, jwt:, and ldap: condition keys,...
PT-2026-71298
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 could allow a remote attacker to access sensitive information due to an inconsistent interpretation of an HTTP request by a reverse prox...
PT-2026-71303
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 Reverse Proxy in certain configurations may provide weaker than expected cryptographic validation of user supplied data...
PT-2026-71300
Name of the Vulnerable Software and Affected Versions IBM Security Verify Access versions 10.0 through 10.0.9.2 IBM Verify Identity Access versions 11.0 through 11.0.3 IBM Verify Identity Access Container versions 11.0 through 11.0.3 IBM Security Verify Access Container versions 10.0 through...
PT-2026-71208
In Kong Mesh running in universal mode with a MeshIdentity whose SPIFFE ID path template derives from the dataplane's kuma.io/workload label, the XDS authenticator in kuma-cp validates that label only when the dataplane token is bound to a workload. Workload binding is optional, so a dataplane...
PT-2026-71294
IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 is vulnerable to a denial of service attack...
DEBIAN-CVE-2026-19550
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied...
CVE-2026-19550
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied...
UBUNTU-CVE-2026-19550
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied...
EUVD-2026-56977
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied...
CVE-2026-19550
A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied...
CVE-2026-62869
CVE-2026-62869 affects Azure Entra ID and related services (Azure Active Directory, Entra ID, Entra Provisioning Service, SRE Agent, etc.). The root cause is insufficient verification of data authenticity, enabling an authorized attacker to perform network spoofing. Affected components include Az...
CVE-2026-62869 Azure Entra ID Spoofing Vulnerability
...
CVE-2026-62839 Microsoft SharePoint Server Spoofing Vulnerability
...
CVE-2026-64897
CVE-2026-64897 describes an XSS vulnerability in Microsoft Office SharePoint Server due to improper neutralization of input during web page generation. An authorized attacker could spoof users over the network. Documents indicate the flaw and its impact as spoofing, with CVSSv3.1 base score 4.6 (...
