Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2025-9317 | 8.3 high | 0.00% | no CPE yet | The vulnerability, if exploited, could allow a miscreant with read access to Edge Project files or Edge Offline Cache files to reverse engineer Edge users' app-native or Active Directory passwords through computational brute-forcing of weak hashes. | 18 Oct |
| CVE-2026-19550 | 8.2 high | 0.00% | redhat, freeipa, enterprise_linux | A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory. | Mon 26 Oct |
| CVE-2026-22061 | 8.2 high | 0.00% | no CPE yet | Trident versions v25.02.1 through v26.06.1 are susceptible to a vulnerability that could allow an authenticated attacker with access to debug logs to view LUKS passphrases or SMB Active Directory credentials. | 16 Oct |
| CVE-2026-11861 | 8.1 high | 0.00% | freeipa, redhat, enterprise_linux | A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain. | Tue 27 Oct |
| CVE-2026-60998 | 8.0 high | 0.00% | oracle, identity_manager_connector | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Microsoft Active Directory). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Difficult to exploit vulnerability allows high privileged attacker with network access via LDAP to compromise Oracle Identity Manager Connector. While the vulnerability is in Oracle Identity Manager Connector, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Identity Manager Connector. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H). | 22 Oct |
| CVE-2026-54115 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 | Integer overflow or wraparound in Windows Active Directory allows an authorized attacker to elevate privileges locally. | Wed 28 Oct |
| CVE-2026-55001 | 7.8 high | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2016 | Improper certificate validation in Windows Active Directory allows an authorized attacker to elevate privileges locally. | Wed 28 Oct |
| CVE-2020-25720 | 7.5 high | 0.00% | no CPE yet | A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator owns the object due to the lack of an Access Control List (ACL) at the time of creation and later being recognized as the 'creator owner.' The retained significant rights of the delegated administrator may not be well understood, potentially leading to unintended privilege escalation or security risks. | 21 Oct |
| CVE-2026-83666 | 7.0 high | 0.00% | no CPE yet | Concurrent execution using shared resource with improper synchronization ('race condition') in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally. | 19 Oct |
| CVE-2026-14867 | 6.8 medium | 0.00% | arcinfo, pcvue | Credentials of built-in users are insecurely stored in the User directory of PcVue projects, all versions prior to 17.0.0. A local attacker could retrieve users’ credentials. Active Directory accounts are not affected by this vulnerability. | Sun 25 Oct |
| CVE-2026-48918 | 6.6 medium | 0.00% | jenkins, active_directory | Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default. | 14 Oct |
| CVE-2026-48919 | 6.6 medium | 0.00% | jenkins, active_directory | Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation. | 14 Oct |
| CVE-2026-59998 | 6.5 medium | 0.00% | openbsd, openssh | sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory. | Sun 25 Oct |
| CVE-2026-32072 | 6.2 medium | 0.00% | microsoft, windows_10_1607, windows_10_1809, windows_10_21h2 | Improper authentication in Windows Active Directory allows an unauthorized attacker to perform spoofing locally. | Mon 26 Oct |
| CVE-2026-34294 | 5.9 medium | 0.00% | oracle, identity_manager_connector | Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Microsoft Active Directory). The supported version that is affected is 12.2.1.4.0. Difficult to exploit vulnerability allows low privileged attacker with network access via LDAP to compromise Oracle Identity Manager Connector. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Identity Manager Connector accessible data as well as unauthorized read access to a subset of Oracle Identity Manager Connector accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N). | Mon 26 Oct |
| CVE-2026-10759 | 5.5 medium | 0.00% | no CPE yet | A flaw in Portal for ArcGIS could allow LDAP injection through administrative functionality that constructs Active Directory or LDAP search queries without sufficient input neutralization. An authenticated administrator could supply crafted input that modifies the intended LDAP query and causes unintended directory operations. | Mon 26 Oct |
| CVE-2026-85916 | 5.5 medium | 0.00% | microsoft, windows_11_23h2, windows_11_24h2, windows_11_25h2 | Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information locally. | 16 Oct |
| CVE-2026-65777 | 5.3 medium | 0.00% | microsoft, windows 11 version 23h2, windows 11 version 24h2, windows 11 version 25h2 | Inadequate encryption strength in Windows Active Directory allows an authorized attacker to bypass a security feature over a network. | Wed 28 Oct |
| CVE-2026-107370 | 5.3 medium | 0.00% | no CPE yet | When a username for an Active Directory connection is a domain without a local part, the auth0-lock library initiates the authentication transaction with a GET request instead of a POST request. As a result, user-submitted form data is appended to the URL as query string parameters. | 15 Oct |
| CVE-2026-50684 | 4.8 medium | 0.00% | microsoft, windows 10 version 1607, windows 10 version 1809, windows server 2012 | Improper neutralization of input during web page generation ('cross-site scripting') in Active Directory Federation Services (AD FS) allows an authorized attacker to perform spoofing over a network. | Wed 28 Oct |
| CVE-2026-83646 | 4.8 medium | 0.00% | no CPE yet | Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an authorized attacker to perform spoofing over a network. | 19 Oct |
| CVE-2025-35054 | 4.8 medium | 0.00% | newforma, project_center | Newforma Info Exchange (NIX) stores credentials used to configure NPCS in 'HKLM\Software\WOW6432Node\Newforma\<version>\Credentials'. The credentials are encrypted but the encryption key is stored in the same registry location. Authenticated users can access both the credentials and the encryption key. If these are Active Directory credentials, an attacker may be able to gain access to additional systems and resources. | 8 Oct |
| CVE-2026-110804 | 4.3 medium | 0.00% | devolutions, devolutions_server | Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user with PAM checkout access to delete arbitrary Active Directory groups or retain elevated privileges via client-supplied JIT elevation settings in a checkout update request. | Fri 23 Oct |
| CVE-2026-59269 | 3.8 low | 0.00% | no CPE yet | A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially gain elevated permissions in the clusters, only if all the following conditions were true: the Pinniped Supervisor server is running with an ActiveDirectoryIdentityProvider resource configured; the ActiveDirectoryIdentityProvider.spec.groupSearch.attributes.groupName is empty; the attacker gains the ability to edit some part of the distinguished name (DN) of group entries in the Active Directory (AD) server's database for groups to which they belong; the configured group search parameters cause the edited group to be included in the group search results for the user; and the attacker knows the password for an AD user who belongs to the edited AD group. Affected versions: Pinniped (go.pinniped.dev) v0.11.0 through v0.46.0 inclusive; fixed in v0.47.0. | Sun 25 Oct |
| CVE-2026-57288 | 3.7 low | 0.00% | jenkins, active_directory | Jenkins Active Directory Plugin 2.41.1 and earlier does not escape the user name before building the LDAP search filter in the Windows native (ADSI) authentication path, allowing unauthenticated attackers to inject LDAP wildcard characters to enumerate directory entries and to authenticate as a matching user whose password they know without knowing their exact user name. | Sun 25 Oct |
75 of 75 · Previous
Download these 75 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.