Filtered by vendor Subscriptions
Total 415747 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-112314 2 Red Hat, Redhat 5 Enterprise Linux, Enterprise Linux, Hardened Images and 2 more 2026-11-12 7.5 High
clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries.
CVE-2026-119079 2 Red Hat, Redhat 5 Enterprise Linux, Enterprise Linux, Hardened Images and 2 more 2026-11-12 7.5 High
decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.
CVE-2026-112323 2 Red Hat, Redhat 5 Enterprise Linux, Enterprise Linux, Hardened Images and 2 more 2026-11-12 7.5 High
The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed.
CVE-2026-112321 2 Red Hat, Redhat 5 Enterprise Linux, Enterprise Linux, Hardened Images and 2 more 2026-11-12 7.5 High
The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures.
CVE-2026-112322 2 Red Hat, Redhat 5 Enterprise Linux, Enterprise Linux, Hardened Images and 2 more 2026-11-12 7.5 High
clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.
CVE-2026-112320 2 Red Hat, Redhat 5 Enterprise Linux, Enterprise Linux, Hardened Images and 2 more 2026-11-12 7.5 High
The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.
CVE-2026-112319 2 Red Hat, Redhat 5 Enterprise Linux, Enterprise Linux, Hardened Images and 2 more 2026-11-12 6.5 Medium
The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding.
CVE-2026-112318 2 Red Hat, Redhat 5 Enterprise Linux, Enterprise Linux, Hardened Images and 2 more 2026-11-12 6.5 Medium
The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code.
CVE-2026-112317 2 Red Hat, Redhat 5 Enterprise Linux, Enterprise Linux, Hardened Images and 2 more 2026-11-12 5.3 Medium
krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures.
CVE-2026-112316 2 Red Hat, Redhat 5 Enterprise Linux, Enterprise Linux, Hardened Images and 2 more 2026-11-12 6.5 Medium
xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure.
CVE-2026-112315 2 Red Hat, Redhat 5 Enterprise Linux, Enterprise Linux, Hardened Images and 2 more 2026-11-12 5.3 Medium
The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages.
CVE-2026-125285 2026-11-12 N/A
Authentication bypass using an alternate path or channel vulnerability in TIBCO TIBCO Platform’s Self-Hosted Control Plane. This issue affects TIBCO Platform’s Self-Hosted Control Plane: from 1 through 1.21.
CVE-2026-126256 1 Fortinet 1 Fortios 2026-11-12 7.4 High
[CVEID]: CVE-2026-126256 [PRODUCT]: Fortinet FortiOS [VERSION]: FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 [PROBLEMTYPE]: Execute unauthorized code or commands [REFERENCES]: https://fortiguard.fortinet.com/psirt/FG-IR-26-270 [DESCRIPTION]: A out-of-bounds read vulnerability in Fortinet FortiOS 8.0.0 through 8.0.1, FortiOS 7.6.0 through 7.6.7, FortiOS 7.4.0 through 7.4.12, FortiOS 7.2.0 through 7.2.13 may allow a remote privileged attacker to execute arbitrary code or command via crafted paquets. [ASSIGNINGCNA]: Fortinet Inc.
CVE-2026-91151 1 Redhat 3 Enterprise Linux, Openshift Devspaces, Rhel Els 2026-11-12 7.3 High
A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the `.ssh` or `authorized_keys` paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system.
CVE-2026-91150 1 Redhat 3 Enterprise Linux, Openshift Devspaces, Rhel Els 2026-11-12 7.5 High
A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a denial of service in the `cockpit-ws` service.
CVE-2026-125870 2026-11-12 4.2 Medium
BookStack before 26.09.3 contains a missing authorization vulnerability in ImageController::checkImagePermission() that allows authenticated non-admin users to bypass page-level content restrictions for images whose owning page has been moved to the recycle bin, because the permission check relies on Page::getPage() which returns null for soft-deleted pages and silently skips the PageView check. Attackers can enumerate sequential image IDs via GET /images/edit/{id} to disclose metadata of restricted images, and users with image-update-all/image-delete-all privileges can rename, replace, or permanently delete images belonging to content they cannot view, persisting the damage even after the page is restored.
CVE-2026-121526 1 Fortinet 1 Fortiauthenticator 2026-11-12 5.8 Medium
A url redirection to untrusted site ('open redirect') vulnerability in Fortinet FortiAuthenticator 8.0.0 through 8.0.3, FortiAuthenticator 6.6.0 through 6.6.10 may allow an unauthenticated attacker to perform an open redirect attack via crafted HTTP requests.
CVE-2026-121527 1 Fortinet 1 Forticlientems 2026-11-12 6.3 Medium
A execution with unnecessary privileges vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.7, FortiClientEMS 7.4.0 through 7.4.1, FortiClientEMS 7.2 all versions may allow an authenticated local attacker with admin privileges to gain root shell access via CLI commands.
CVE-2026-119818 1 Microsoft 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more 2026-11-12 7.8 High
Incorrect authorization in Windows Text Services Framework allows an authorized attacker to elevate privileges locally.
CVE-2026-119847 1 Microsoft 23 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 20 more 2026-11-12 7.8 High
Heap-based buffer overflow in Windows Kerberos allows an authorized attacker to elevate privileges locally.