https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 10:12:33 +0000 https://db.gcve.eu/vuln/alsa-2026:70564 <p><strong>Affected:</strong> AlmaLinux:9: ipa-client, AlmaLinux:9: ipa-client-common, AlmaLinux:9: ipa-client-encrypted-dns, AlmaLinux:9: ipa-client-epn, AlmaLinux:9: ipa-client-samba, AlmaLinux:9: ipa-common, AlmaLinux:9: ipa-selinux, AlmaLinux:9: ipa-selinux-luna, AlmaLinux:9: ipa-selinux-nfast, AlmaLinux:9: ipa-server and 8 more</p> <p>AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.</p> <p>Security Fix(es):</p> <p>* ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read (CVE-2026-73198) * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read (CVE-2026-73197) * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861) * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147) * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550) * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097) * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578) * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678)</p> <p>Bug Fix(es) and Enhancement(s):</p> <p>* [Cursor Automated] Include latest fixes in python3-ipatests package [AlmaLinux9.8] (JIRA:AlmaLinux-170987) * WebUI Hardening [almalinux-9.8.z] (JIRA:AlmaLinux-238511) * ipa-otpt…</p> <p><strong>Affected:</strong> AlmaLinux:9: ipa-client, AlmaLinux:9: ipa-client-common, AlmaLinux:9: ipa-client-encrypted-dns, AlmaLinux:9: ipa-client-epn, AlmaLinux:9: ipa-client-samba, AlmaLinux:9: ipa-common, AlmaLinux:9: ipa-selinux, AlmaLinux:9: ipa-selinux-luna, AlmaLinux:9: ipa-selinux-nfast, AlmaLinux:9: ipa-server and 8 more</p> <p>AlmaLinux Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.</p> <p>Security Fix(es):</p> <p>* ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read (CVE-2026-73198) * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read (CVE-2026-73197) * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861) * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147) * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550) * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097) * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578) * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678)</p> <p>Bug Fix(es) and Enhancement(s):</p> <p>* [Cursor Automated] Include latest fixes in python3-ipatests package [AlmaLinux9.8] (JIRA:AlmaLinux-170987) * WebUI Hardening [almalinux-9.8.z] (JIRA:AlmaLinux-238511) * ipa-otpt…</p> https://db.gcve.eu/vuln/alsa-2026:70564 https://db.gcve.eu/vuln/fkie_cve-2026-18147 <p>A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim&#39;s authenticated session, potentially leading to full administrative control if an IdM administrator is targeted.</p> <p>A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim&#39;s authenticated session, potentially leading to full administrative control if an IdM administrator is targeted.</p> https://db.gcve.eu/vuln/fkie_cve-2026-18147 https://db.gcve.eu/vuln/ghsa-8gwp-8p3v-22jh <p>A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim&#39;s authenticated session, potentially leading to full administrative control if an IdM administrator is targeted.</p> <p>A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim&#39;s authenticated session, potentially leading to full administrative control if an IdM administrator is targeted.</p> https://db.gcve.eu/vuln/ghsa-8gwp-8p3v-22jh https://db.gcve.eu/vuln/rhsa-2026:70564 <p>FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service</p> <p>FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service</p> https://db.gcve.eu/vuln/rhsa-2026:70564 https://db.gcve.eu/vuln/ubuntu-cve-2026-18147 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: freeipa, Ubuntu:Pro:16.04:LTS: freeipa, Ubuntu:18.04:LTS: freeipa, Ubuntu:20.04:LTS: freeipa, Ubuntu:22.04:LTS: freeipa, Ubuntu:24.04:LTS: freeipa, Ubuntu:26.04:LTS: freeipa</p> <p>A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim&#39;s authenticated session, potentially leading to full administrative control if an IdM administrator is targeted.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: freeipa, Ubuntu:Pro:16.04:LTS: freeipa, Ubuntu:18.04:LTS: freeipa, Ubuntu:20.04:LTS: freeipa, Ubuntu:22.04:LTS: freeipa, Ubuntu:24.04:LTS: freeipa, Ubuntu:26.04:LTS: freeipa</p> <p>A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim&#39;s authenticated session, potentially leading to full administrative control if an IdM administrator is targeted.</p> https://db.gcve.eu/vuln/ubuntu-cve-2026-18147