{"items":[{"id":"CVE-2026-107778","published":"2026-10-08T20:15:54.159Z","updated":"2026-10-09T11:50:03.488Z","title":"MIT krb5 through 1.22.2 NULL Pointer Dereference via krb5_rd_cred()","severity":"HIGH","score":7.1,"vendor":"MIT","product":"krb5","kev":false,"epss":0.00424,"kevAdded":null,"exploit":false},{"id":"CVE-2026-107708","published":"2026-10-08T20:15:53.534Z","updated":"2026-10-14T01:18:51.696Z","title":"MIT krb5 through 1.22.2 KDC NULL Pointer Dereference via S4U2Proxy PAC","severity":"MEDIUM","score":6.9,"vendor":"MIT","product":"krb5","kev":false,"epss":0.00521,"kevAdded":null,"exploit":false},{"id":"CVE-2026-40356","published":"2026-04-28T00:00:00.000Z","updated":"2026-04-28T13:10:24.842Z","title":"In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on…","severity":"MEDIUM","score":5.9,"vendor":"MIT","product":"Kerberos 5","kev":false,"epss":0.00604,"kevAdded":null,"exploit":false},{"id":"CVE-2026-40355","published":"2026-04-28T00:00:00.000Z","updated":"2026-11-10T12:45:52.453Z","title":"In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx…","severity":"MEDIUM","score":5.9,"vendor":"MIT","product":"Kerberos 5","kev":false,"epss":0.00645,"kevAdded":null,"exploit":true},{"id":"CVE-2025-24528","published":"2026-01-16T00:00:00.000Z","updated":"2026-01-16T18:06:59.339Z","title":"In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update size to resize() in kdb_log.c. An…","severity":"HIGH","score":7.1,"vendor":"MIT","product":"Kerberos 5","kev":false,"epss":0.00507,"kevAdded":null,"exploit":false},{"id":"CVE-2019-14844","published":"2019-09-26T11:50:05.000Z","updated":"2024-08-05T00:26:39.128Z","title":"A flaw was found in, Fedora versions of krb5 from 1.16.1 to, including 1.17.x, in the way a Kerberos client could crash the KDC by sending one of the RFC 4556…","severity":"HIGH","score":7.5,"vendor":"MIT","product":"krb5","kev":false,"epss":0.04436,"kevAdded":null,"exploit":false},{"id":"CVE-2017-7562","published":"2018-07-26T15:00:00.000Z","updated":"2024-08-05T16:04:12.058Z","title":"An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates. A remote attacker…","severity":"MEDIUM","score":6.5,"vendor":"MIT","product":"krb5","kev":false,"epss":0.03178,"kevAdded":null,"exploit":false}]}