Microsoft November patches fix 1,090 flaws, one Outlook bug exploited
CVE-2026-124194 can leak an NTLMv2 hash if a user opens a crafted Outlook file; ZDI flags 30 wormable bugs.
Stories per day · 30 days
3 RSS
Relatedmicrosoft3outlook3patch-tuesday3exchange2gitlab2integer-overflow2ntlm2activemq1apache1authentication-gateway1authorization1authpoint1bypass1certificate-validation1credential-exposure1dn-injection1fortigate1fortios1
13 stories, newest first · one card per story
Stories tagged #ldap
Microsoft November patches fix 1,094 bugs, one exploited
CVE-2026-124194 can leak an Outlook user’s NTLMv2 hash; two zero-click remote code execution bugs also ship.
Microsoft November patches cover 1,260 flaws, one Outlook bug exploited
SANS says 68 issues are critical and CVE-2026-124194, an Outlook spoofing bug, is already exploited.
WatchGuard AuthPoint Gateway affected by four vulnerabilities
CVEs allow forged LDAP authentication, MITM attacks, unauthenticated DoS, and unauthorized admin actions prior to 7.6.0.
Apache ActiveMQ LDAPAuthorizationMap allows authorization bypass via DN injection (CVE-2026-108500)
Authenticated attackers can create destinations with crafted DN names containing special characters in versions before 6.3.3 and 5.19.12.
FortiBleed 2.0 finds 40,573 cleartext secrets in FortiGate configs
Hudson Rock parsed 1,703 FortiGate configuration reports and 1,689 host identifiers; 975 domain labels were absent from the earlier set.
GitLab patches unauthenticated code execution bug CVE-2026-110264
The integer overflow hits GitLab CE/EE back to 7.0; fixes include 19.5.1 and backports through 18.11.13.
GitLab patches unauthenticated regex RCE rated CVSS 10.0
CVE-2026-110264 reaches back to GitLab 7.0; self-managed admins must upgrade, and in-the-wild use is not confirmed.
2
CVE-2026-78243: Apache YuniKorn: LDAP Group provider panics on lowercase attribute name
Apache YuniKorn's LDAP group resolver can panic on a lowercase memberOf attribute before version 1.10.0.
CVE-2026-103877: Apache Directory LDAP API: Unsafe loading of Java code from LDAP schema elements
Apache Directory LDAP API before 2.1.9 can deserialize Java from a rogue LDAP schema, enabling potential remote code execution.
CVE-2026-91206: Apache Roller: Reflected XSS in the optional LDAP comment authenticator
Apache Roller 6.1.5 has a moderate reflected XSS in its optional LDAP comment authenticator.
USN-8820-1: curl vulnerabilities
Ubuntu patched curl flaws that may bypass LDAP peer checks or allow HTTP/2 crashes and code execution.
Jenkins Security Advisory 2026-09-02
Jenkins releases a security advisory affecting Jenkins Core, update-center2, and 17 plugins including GitLab, SAML, LDAP, Microsoft Entra ID, and Script Security.