Known Vulnerabilities for products from Fedoraproject
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Fedoraproject".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-104048 json | A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) ... | Not Provided | 2026-10-06 | 2026-10-09 |
| CVE-2026-104047 json | A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being in... | Not Provided | 2026-10-06 | 2026-10-09 |
| CVE-2026-104046 json | A flaw was found in SSSD (System Security Services Daemon). When Identity Provider (IdP) authentication is enabled, pre-authe... | Not Provided | 2026-10-06 | 2026-10-13 |
| CVE-2026-104045 json | A flaw was found in SSSD. A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs res... | Not Provided | 2026-10-06 | 2026-10-13 |
| CVE-2026-104040 json | A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes ar... | Not Provided | 2026-10-06 | 2026-10-16 |
| CVE-2026-90996 json | A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Net... | Not Provided | 2026-09-14 | 2026-10-07 |
| CVE-2026-90995 json | A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable... | Not Provided | 2026-09-14 | 2026-10-14 |
| CVE-2026-90462 json | A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `locko... | Not Provided | 2026-09-22 | 2026-10-07 |
| CVE-2026-88252 json | A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available fi... | Not Provided | 2026-10-06 | 2026-10-20 |
| CVE-2026-68744 json | A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all ... | Not Provided | 2026-08-04 | 2026-08-31 |
| CVE-2026-68743 json | A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length fiel... | Not Provided | 2026-08-04 | 2026-08-31 |
| CVE-2026-68742 json | A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field... | Not Provided | 2026-08-03 | 2026-08-31 |
| CVE-2026-54231 json | A content injection vulnerability was found in the ABRT post-create event handler scripts in libreport. The event script quer... | Not Provided | 2026-06-13 | 2026-09-21 |
| CVE-2026-54230 json | A symlink following vulnerability was found in the ABRT post-create event handler scripts in libreport. Event scripts write o... | Not Provided | 2026-06-13 | 2026-09-21 |
| CVE-2026-35094 json | A flaw was found in libinput. An attacker capable of deploying a Lua plugin file in specific system directories can exploit a... | Not Provided | 2026-04-01 | 2026-04-07 |
| CVE-2026-12610 json | A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulner... | Not Provided | 2026-06-30 | 2026-08-31 |
| CVE-2026-6245 json | A flaw was found in the System Security Services Daemon (SSSD). The pam_passkey_child_read_data() function within the PAM pas... | Not Provided | 2026-04-15 | 2026-09-01 |
| CVE-2024-47692 json | Not Provided | 2024-10-21 | 2026-10-15 | |
| CVE-2024-28960 json | An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0, and Mbed Crypto. The PSA Crypto... | Not Provided | 2024-03-29 | 2026-06-05 |
| CVE-2024-28757 json | libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML_... | Not Provided | 2024-03-10 | 2026-10-15 |
Known software with vulnerabilities from Fedoraproject
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Fedoraproject | 389 Administration Server | 1.1.37 |
| Application | Fedoraproject | 389 Directory Server | - |
| Application | Fedoraproject | Anaconda | - |
| Operating System | Fedoraproject | Fedora | - |
| Operating System | Fedoraproject | Fedora Core | - |
| Application | Fedoraproject | Mirrormanager | 0.0.1 |
| Application | Fedoraproject | Python-fedora | 0.8.0 |
| Application | Fedoraproject | Sectool | - |
| Application | Fedoraproject | Selinux-policy | 2020-08-24 |
| Application | Fedoraproject | Sssd | - |