Cobbler - Authentication Bypass

Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ and possibly even older versions, may be vulnerable to an authentication bypass vulnerability in XMLRPC API /cobblerapi that can result in privilege escalation, data manipulation or exfiltration, and LDAP credential harvesting...

EUVD-2026-61343

Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware component: OID LDAP Server. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle...

EUVD-2026-61342

Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware component: OID LDAP Server. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle...

EUVD-2026-61341

Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware component: OID LDAP Server. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle...

EUVD-2026-61340

Vulnerability in the Oracle Virtual Directory product of Oracle Fusion Middleware component: Virtual Directory Server. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise...

EUVD-2026-61299

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware component: Microsoft Active Directory. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows high privileged attacker with network access via LDAP to...

EUVD-2026-61283

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware component: OUD Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Unified...

EUVD-2026-61465

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware component: OUD Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Unified...

EUVD-2026-61458

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware component: OUD Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Unified...

EUVD-2026-61459

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware component: OUD Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Unified...

EUVD-2026-61446

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware component: OUD Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via LDAP to compromise Oracle Unified...

EUVD-2026-61444

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware component: OUD Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Unified...

EUVD-2026-61445

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware component: OUD Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Unified...

CVE-2026-55106

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the...

CVE-2026-55106

authentik's LDAP Source API diagnostic action bypasses object-level read-authorization, letting unauthenticated clients trigger upstream LDAP queries using the source's bind credentials. The response exposes DNs and attribute names (not values), revealing directory structure, naming conventions, ...

CVE-2026-55106 authentik: Unauthenticated LDAP directory data disclosure

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the...

EUVD-2026-61061

authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an unauthenticated client, can invoke the...

CVE-2026-59825

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldapauthenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULTPARAMS when LDAP authentication uses LDAPTLSNOVERIFY=true, disabling SSL and T...

CVE-2026-59825

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.19 and from 4.5.0 until 4.5.12, Mastodon's app/models/concerns/user/ldapauthenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULTPARAMS when LDAP authentication uses LDAPTLSNOVERIFY=true, disabling SSL and T...

CVE-2026-59825

When LDAP auth uses LDAP_TLS_NO_VERIFY=true, app/models/concerns/user/ldap_authenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULT_PARAMS, disabling SSL/TLS verification globally for puma web processes. This enables MITM attacks against all puma-originated HTTPS requests. Fixed in Mastodon 4.4...