{ "query": { "page": "24" }, "count": 20, "total": 46824, "page": 24, "limit": 20, "updated": { "cves": "2026-10-06T16:45:50.826Z", "kev": "2026-10-06T17:44:53.087Z", "epss": "2026-10-06T12:57:42.533Z", "breaches": "2026-10-06T12:45:41.825Z", "posts": "2026-10-06T17:45:53.188Z" }, "links": { "web": "https://spydr.io/threats?page=24", "next": "https://spydr.io/threats.json?page=25" }, "warnings": [], "results": [ { "id": "CVE-2026-105621", "url": "https://spydr.io/cve/CVE-2026-105621", "published": "2026-10-06T04:18:05.360Z", "modified": "2026-10-06T14:17:37.943Z", "score": 2.1, "severity": "low", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "vuldb.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": "poc", "vendors": [ "jishenghua" ], "products": [ "jishenghua jshERP" ], "cwes": [ "CWE-266", "CWE-285" ], "description": "A security flaw has been discovered in jishenghua jshERP up to 3.5. Affected is the function updateAccountHeadAndDetail of the file jshERP-boot/src/main/java/com/jsh/erp/service/AccountHeadService.java of the component Financial Receipt Update Handler. Performing a manipulation results in improper authorization. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet." }, { "id": "CVE-2026-105611", "url": "https://spydr.io/cve/CVE-2026-105611", "published": "2026-10-06T04:17:58.950Z", "modified": "2026-10-06T04:18:05.067Z", "score": 2, "severity": "low", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "vuldb.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "chillzhuang" ], "products": [ "chillzhuang SpringBlade" ], "cwes": [ "CWE-266", "CWE-285" ], "description": "A vulnerability was determined in chillzhuang SpringBlade up to 5.0.1. This affects an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/RoleController.java of the component User Detail Endpoint. This manipulation of the argument ID causes improper authorization. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet." }, { "id": "CVE-2026-105610", "url": "https://spydr.io/cve/CVE-2026-105610", "published": "2026-10-06T03:17:01.237Z", "modified": "2026-10-06T13:16:45.657Z", "score": 2, "severity": "low", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "vuldb.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": "poc", "vendors": [ "chillzhuang" ], "products": [ "chillzhuang SpringBlade" ], "cwes": [ "CWE-266", "CWE-285" ], "description": "A vulnerability was found in chillzhuang SpringBlade up to 5.0.1. The impacted element is an unknown function of the file blade-service/blade-system/src/main/java/org/springblade/system/controller/ParamController.java of the component Parameter Submit Management. The manipulation of the argument initPassword results in improper authorization. It is possible to launch the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet." }, { "id": "CVE-2026-105573", "url": "https://spydr.io/cve/CVE-2026-105573", "published": "2026-10-06T03:17:01.033Z", "modified": "2026-10-06T15:04:52.637Z", "score": 2.1, "severity": "low", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "vuldb.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "newbee-ltd" ], "products": [ "newbee-ltd newbee-mall" ], "cwes": [ "CWE-840" ], "description": "A vulnerability was found in newbee-ltd newbee-mall up to 2.7.5. This impacts an unknown function of the file /jshERP-boot/accountHead/updateAccountHeadAndDetail of the component Shopping Cart Quantity Handler. Performing a manipulation of the argument goodsCount results in business logic errors. The attack can be initiated remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet." }, { "id": "CVE-2026-105572", "url": "https://spydr.io/cve/CVE-2026-105572", "published": "2026-10-06T03:17:00.827Z", "modified": "2026-10-06T15:04:52.637Z", "score": 2.1, "severity": "low", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "vuldb.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": "poc", "vendors": [], "products": [ "PickMall Lilishop" ], "cwes": [ "CWE-285", "CWE-639" ], "description": "A vulnerability has been found in PickMall Lilishop up to 4.2.4. This affects an unknown function of the file /buyer/trade/receipt of the component Buyer Invoice List. Such manipulation of the argument memberId leads to authorization bypass. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet." }, { "id": "CVE-2026-105571", "url": "https://spydr.io/cve/CVE-2026-105571", "published": "2026-10-06T02:17:04.613Z", "modified": "2026-10-06T15:04:52.637Z", "score": 5.5, "severity": "medium", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "vuldb.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [], "products": [ "PickMall Lilishop" ], "cwes": [ "CWE-266", "CWE-285" ], "description": "A flaw has been found in PickMall Lilishop up to 4.2.4. The impacted element is an unknown function of the file /buyer/passport/member/bindMobile of the component Mobile Binding. This manipulation of the argument Username causes improper authorization. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet." }, { "id": "CVE-2026-105487", "url": "https://spydr.io/cve/CVE-2026-105487", "published": "2026-10-06T02:17:04.403Z", "modified": "2026-10-06T13:16:45.150Z", "score": 2.1, "severity": "low", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "vuldb.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": "poc", "vendors": [ "yogeshojha" ], "products": [ "yogeshojha reNgine" ], "cwes": [ "CWE-77", "CWE-78" ], "description": "A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomain_discovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance." }, { "id": "CVE-2026-105486", "url": "https://spydr.io/cve/CVE-2026-105486", "published": "2026-10-06T02:17:04.213Z", "modified": "2026-10-06T15:04:52.637Z", "score": 5.5, "severity": "medium", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "vuldb.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "OSSRS" ], "products": [ "OSSRS srs" ], "cwes": [ "CWE-287", "CWE-306" ], "description": "A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and may be used. Upgrading to version 8.0-d0 mitigates this issue. The patch is named bb5fde228f4ca5bd26d96368b61f6e0c21df51df. The affected component should be upgraded." }, { "id": "CVE-2026-105484", "url": "https://spydr.io/cve/CVE-2026-105484", "published": "2026-10-06T02:17:04.040Z", "modified": "2026-10-06T15:04:52.637Z", "score": 10, "severity": "critical", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "vuldb.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": "none", "vendors": [ "TOTOLINK" ], "products": [ "TOTOLINK X6000R" ], "cwes": [ "CWE-77", "CWE-78" ], "description": "A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument file_name leads to os command injection. The attack may be performed from remote." }, { "id": "CVE-2026-104380", "url": "https://spydr.io/cve/CVE-2026-104380", "published": "2026-10-06T02:17:03.910Z", "modified": "2026-10-06T15:03:59.427Z", "score": 5.3, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "score_source": "CISA ADP", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": "none", "vendors": [], "products": [], "cwes": [ "CWE-1385" ], "description": "Punk versions from 0.48 before 0.55 for Perl route Extended CONNECT requests to any GET route without an Origin check in ps_serve_one. On HTTP/2 and HTTP/3 a WebSocket handshake arrives as an Extended CONNECT, which is matched as a GET and so reaches every GET route, API operation and mount. The Origin check runs only when a websocket route matches. On this transport the handler's status is the handshake response, and a 2xx accepts it. A cross-origin page can open a WebSocket to any path and learn from its open or error event whether that path returns 2xx." }, { "id": "CVE-2026-104044", "url": "https://spydr.io/cve/CVE-2026-104044", "published": "2026-10-06T02:17:03.760Z", "modified": "2026-10-06T15:09:20.387Z", "score": 6.2, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "score_source": "redhat.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "Red Hat" ], "products": [ "Red Hat Enterprise Linux 10", "Red Hat Enterprise Linux 6", "Red Hat Enterprise Linux 7", "Red Hat Enterprise Linux 8", "Red Hat Enterprise Linux 9", "Red Hat OpenShift Container Platform 4" ], "cwes": [ "CWE-476" ], "description": "A flaw was found in sssd. A local attacker can trigger a Denial of Service (DoS) by sending a specially crafted Pluggable Authentication Module (PAM) request when passkey authentication is enabled. Due to a missing state validation check in passkey Kerberos handling, the PAM responder dereferences an uninitialized pointer and crashes. This failure disrupts authentication services on the host." }, { "id": "CVE-2026-104043", "url": "https://spydr.io/cve/CVE-2026-104043", "published": "2026-10-06T02:17:03.607Z", "modified": "2026-10-06T15:17:12.117Z", "score": 5.5, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "score_source": "redhat.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": "none", "vendors": [ "Red Hat" ], "products": [ "Red Hat Enterprise Linux 10", "Red Hat Enterprise Linux 6", "Red Hat Enterprise Linux 7", "Red Hat Enterprise Linux 8", "Red Hat Enterprise Linux 9", "Red Hat OpenShift Container Platform 4" ], "cwes": [ "CWE-125" ], "description": "A flaw was found in SSSD. A local attacker with access to the Name Service Switch (NSS) responder UNIX socket can trigger an integer underflow by sending a specially crafted request with an undersized packet header. This issue causes an out-of-bounds memory read during packet parsing, crashing the responder process and resulting in a Denial of Service (DoS)." }, { "id": "CVE-2026-104042", "url": "https://spydr.io/cve/CVE-2026-104042", "published": "2026-10-06T02:17:03.470Z", "modified": "2026-10-06T15:09:20.387Z", "score": 5.5, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "score_source": "redhat.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "Red Hat" ], "products": [ "Red Hat Enterprise Linux 10", "Red Hat Enterprise Linux 6", "Red Hat Enterprise Linux 7", "Red Hat Enterprise Linux 8", "Red Hat Enterprise Linux 9", "Red Hat OpenShift Container Platform 4" ], "cwes": [ "CWE-125" ], "description": "A flaw was found in sssd. A local attacker can cause a Denial of Service (DoS) by sending a crafted Pluggable Authentication Module (PAM) request containing a zero-length authentication token to the responder socket. Due to missing input validation, the service attempts to read beyond buffer boundaries when processing the token, causing the PAM responder to crash." }, { "id": "CVE-2026-104041", "url": "https://spydr.io/cve/CVE-2026-104041", "published": "2026-10-06T02:17:03.327Z", "modified": "2026-10-06T15:09:20.387Z", "score": 5.5, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "score_source": "redhat.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": "poc", "vendors": [ "Red Hat" ], "products": [ "Red Hat Enterprise Linux 10", "Red Hat Enterprise Linux 6", "Red Hat Enterprise Linux 7", "Red Hat Enterprise Linux 8", "Red Hat Enterprise Linux 9", "Red Hat OpenShift Container Platform 4" ], "cwes": [ "CWE-770" ], "description": "A flaw was found in SSSD. An unprivileged local user can repeatedly request lookups for nonexistent entries through the Name Service Switch (NSS) responder. Because the negative cache does not limit the total number of stored entries and only removes expired records when an existing key is rechecked, the cache can grow without bound. This behavior can lead to memory exhaustion, resulting in a Denial of Service (DoS) as the responder becomes unresponsive or terminates." }, { "id": "CVE-2026-104040", "url": "https://spydr.io/cve/CVE-2026-104040", "published": "2026-10-06T02:17:03.177Z", "modified": "2026-10-06T15:09:20.387Z", "score": 4.4, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L", "score_source": "redhat.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": "none", "vendors": [ "Red Hat" ], "products": [ "Red Hat Enterprise Linux 10", "Red Hat Enterprise Linux 6", "Red Hat Enterprise Linux 7", "Red Hat Enterprise Linux 8", "Red Hat Enterprise Linux 9", "Red Hat OpenShift Container Platform 4" ], "cwes": [ "CWE-140" ], "description": "A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol (OData) queries. A low-privileged local user can exploit this flaw by submitting a crafted search request, altering query filters to broaden user or group searches. This can lead to information disclosure by retrieving unintended directory objects, as well as a Denial of Service (DoS) through excessive processing and cache population." }, { "id": "CVE-2026-104039", "url": "https://spydr.io/cve/CVE-2026-104039", "published": "2026-10-06T02:17:03.013Z", "modified": "2026-10-06T15:09:20.387Z", "score": 4.7, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "score_source": "redhat.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "Red Hat" ], "products": [ "Red Hat Enterprise Linux 10", "Red Hat Enterprise Linux 6", "Red Hat Enterprise Linux 7", "Red Hat Enterprise Linux 8", "Red Hat Enterprise Linux 9", "Red Hat OpenShift Container Platform 4" ], "cwes": [ "CWE-825" ], "description": "A flaw was found in SSSD. A local user can cause a denial of service (DoS) by disrupting system authentication services. When handling Generic Security Services Application Programming Interface (GSSAPI) authentication in the Pluggable Authentication Module (PAM) responder, cached connection state is freed upon completion without clearing the reference pointer. An attacker can exploit this by sending an additional request over the same connection, causing the service to access invalid memory and unexpectedly terminate." }, { "id": "CVE-2026-92821", "url": "https://spydr.io/cve/CVE-2026-92821", "published": "2026-10-06T01:16:36.280Z", "modified": "2026-10-06T15:17:20.197Z", "score": 6.8, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "score_source": "redhat.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": "none", "vendors": [ "Red Hat" ], "products": [ "Red Hat Enterprise Linux 10", "Red Hat Enterprise Linux 6", "Red Hat Enterprise Linux 7", "Red Hat Enterprise Linux 8", "Red Hat Enterprise Linux 9", "Red Hat OpenShift Container Platform 4" ], "cwes": [ "CWE-393" ], "description": "A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory Access Protocol) environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote authenticated user with an expired password using an alternative authentication method, such as SSH public key authentication, can exploit this flaw to bypass access control restrictions and gain unauthorized access to protected systems." }, { "id": "CVE-2026-105472", "url": "https://spydr.io/cve/CVE-2026-105472", "published": "2026-10-06T01:16:35.017Z", "modified": "2026-10-06T15:04:52.637Z", "score": 2.1, "severity": "low", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "vuldb.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "girishsaraf" ], "products": [ "girishsaraf Online-Appointment-Booking-System" ], "cwes": [ "CWE-74", "CWE-89" ], "description": "A weakness has been identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. The affected element is an unknown function of the file book.php of the component Booking Handler. This manipulation of the argument Doctor/appointment causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet." }, { "id": "CVE-2026-104038", "url": "https://spydr.io/cve/CVE-2026-104038", "published": "2026-10-06T01:16:34.853Z", "modified": "2026-10-06T15:09:20.387Z", "score": 5.9, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "score_source": "redhat.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "Red Hat" ], "products": [ "Red Hat Enterprise Linux 10", "Red Hat Enterprise Linux 6", "Red Hat Enterprise Linux 7", "Red Hat Enterprise Linux 8", "Red Hat Enterprise Linux 9", "Red Hat OpenShift Container Platform 4" ], "cwes": [ "CWE-476" ], "description": "A flaw was found in sssd. A remote attacker can cause a denial of service (DoS) by submitting a certificate that lacks an expected Security Identifier (SID) extension. In deployments configured with SID-based certificate mapping rules, the service fails to verify the presence of the extension before processing it, causing the process to crash during authentication or lookup operations." }, { "id": "CVE-2026-104037", "url": "https://spydr.io/cve/CVE-2026-104037", "published": "2026-10-06T01:16:34.707Z", "modified": "2026-10-06T15:09:20.387Z", "score": 5.5, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "score_source": "redhat.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": "poc", "vendors": [ "Red Hat" ], "products": [ "Red Hat Enterprise Linux 10", "Red Hat Enterprise Linux 6", "Red Hat Enterprise Linux 7", "Red Hat Enterprise Linux 8", "Red Hat Enterprise Linux 9", "Red Hat OpenShift Container Platform 4" ], "cwes": [ "CWE-125" ], "description": "A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the responder process and result in a denial of service (DoS)." } ], "attribution": [ { "source": "NVD", "url": "https://nvd.nist.gov", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "source": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "notice": "Known exploited vulnerabilities from the CISA KEV catalog." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss", "notice": "Exploit prediction scores from FIRST EPSS." } ] }