Windows AF_UNIX Socket Provider Elevation of Privilege Vulnerability

Use after free in Windows AFUNIX Socket Provider allows an authorized attacker to elevate privileges locally...

CVE-2026-73316 XenForo < 2.3.13 Payment Replay via PayPal REST Payment Provider

XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers can replay a valid webhook payload to trigger duplicate...

Security update for terraform-provider-null

This update for terraform-provider-null fixes the following issues: CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches bsc1278269. CVE-2026-84304: github.com/grpc/grpc-go:...

SUSE-SU-2026:4062-1 Security update for terraform-provider-null

This update for terraform-provider-null fixes the following issues: - CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches bsc1278269. - CVE-2026-84304: github.com/grpc/grpc-g...

CVE-2026-73313: Incorrect Authorization

XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete login as another user by submitting their own registered passkey credential during the WebAuthn assertion step. The passkey verification...

PT-2026-87426

Name of the Vulnerable Software and Affected Versions Windows Storage Management Provider affected versions not specified Description A heap-based buffer overflow occurs in the Windows Storage Management Provider. This issue allows an authorized attacker to elevate privileges locally on the syste...

CVE-2026-73316: Insufficient Verification of Data Authenticity

XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers can replay a valid webhook payload to trigger duplicate...

CVE-2026-75156: Origin Validation Error

Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD idtokens during OAuth login. Deployments are affected only when the FAB auth manager is configured with Azure AD as an OAuth provider. Because the signing keys are fetched from Microsoft's...

PT-2026-88500

Impact The public OIDC login and callback endpoints ran the full flow whether or not OIDC was the instance's active, enabled authentication method, so turning OIDC off in Settings did not stop it issuing sessions. An administrator who disabled the provider still had a working login route. The pat...

PT-2026-87706

Name of the Vulnerable Software and Affected Versions Windows HTTP Print Provider affected versions not specified Description A heap-based buffer overflow exists in the Windows HTTP Print Provider. This issue allows an unauthorized remote attacker to execute arbitrary code over a network,...

PT-2026-87624

Heap-based buffer overflow in Windows HTTP Print Provider allows an authorized attacker to execute code over a network...

PT-2026-87851

Heap-based buffer overflow in Microsoft WDAC OLE DB provider for SQL allows an unauthorized attacker to execute code over a network...

CVE-2026-69389: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Storage Management Provider allows an authorized attacker to elevate privileges locally...

PT-2026-87829

Name of the Vulnerable Software and Affected Versions Windows Storage Management Provider affected versions not specified Description A stack-based buffer overflow occurs in the Windows Storage Management Provider. This issue allows an authorized attacker to elevate privileges locally on the...

CVE-2026-71337: Stack-based Buffer Overflow

Stack-based buffer overflow in Windows Storage Management Provider allows an authorized attacker to elevate privileges locally...

PT-2026-87173

Name of the Vulnerable Software and Affected Versions Apache Airflow FAB provider versions 3.7.3 through 3.8.0 Description An issue exists during OAuth login when the FAB auth manager is configured with Azure AD as an OAuth provider. The software fails to validate the issuer or audience of Azure ...

CVE-2026-69769: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows HTTP Print Provider allows an unauthorized attacker to execute code over a network...

EulerOS 2.0 SP12 : sssd (EulerOS-SA-2026-3389)

According to the versions of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability, where a memory...

CVE-2026-69623: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows HTTP Print Provider allows an authorized attacker to execute code over a network...

CVE-2026-19625: Improper Access Control

When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid tok...