https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-28T10:12:43.281522+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/alsa-2026:70564 ALSA-2026:70564 — Critical: ipa security, bug fix, and enhancement update 2026-09-28T10:12:43.322208+00:00

Affected: AlmaLinux:9: ipa-client, AlmaLinux:9: ipa-client-common, AlmaLinux:9: ipa-client-encrypted-dns, AlmaLinux:9: ipa-client-epn, AlmaLinux:9: ipa-client-samba, AlmaLinux:9: ipa-common, AlmaLinux:9: ipa-selinux, AlmaLinux:9: ipa-selinux-luna, AlmaLinux:9: ipa-selinux-nfast, AlmaLinux:9: ipa-server and 8 more

AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es):

* ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read (CVE-2026-73198) * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read (CVE-2026-73197) * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861) * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147) * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550) * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097) * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578) * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678)

Bug Fix(es) and Enhancement(s):

* [Cursor Automated] Include latest fixes in python3-ipatests package [AlmaLinux9.8] (JIRA:AlmaLinux-170987) * WebUI Hardening [almalinux-9.8.z] (JIRA:AlmaLinux-238511) * ipa-otpt…

 https://db.gcve.eu/vuln/fkie_cve-2026-73197 fkie_cve-2026-73197 2026-09-28T10:12:43.322312+00:00

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.

 https://db.gcve.eu/vuln/ghsa-m6vw-rcwj-pg9q GHSA-m6vw-rcwj-pg9q 2026-09-28T10:12:43.322344+00:00

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.

 https://db.gcve.eu/vuln/rhsa-2026:70564 RHSA-2026:70564 — Red Hat Security Advisory: ipa security, bug fix, and enhancement update 2026-09-28T10:12:43.322365+00:00

FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service

 https://db.gcve.eu/vuln/ubuntu-cve-2026-73197 UBUNTU-CVE-2026-73197 2026-09-28T10:12:43.322400+00:00

Affected: Ubuntu:Pro:14.04:LTS: freeipa, Ubuntu:Pro:16.04:LTS: freeipa, Ubuntu:18.04:LTS: freeipa, Ubuntu:20.04:LTS: freeipa, Ubuntu:22.04:LTS: freeipa, Ubuntu:24.04:LTS: freeipa, Ubuntu:26.04:LTS: freeipa

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.