PT-2026-70387

Name of the Vulnerable Software and Affected Versions Microsoft Azure Kubernetes Service affected versions not specified Description Missing authentication for a critical function allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no...

Security Updates for Microsoft SharePoint Server 2016 (August 2026)

The Microsoft SharePoint Server 2016 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Improper authentication in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. CVE-2026-62827 -...

PT-2026-70598

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Server affected versions not specified Description An authentication bypass via capture-replay allows an authorized attacker to elevate privileges over a network. This issue involves improper authorization and external contr...

PT-2026-70293

Name of the Vulnerable Software and Affected Versions IntelR PROSet/Wireless WiFi Software affected versions not specified Description Improper authentication within Ring 0 the most privileged level of the CPU of the kernel may allow an information disclosure. A system software adversary with...

2026.3 IPU,  Intel® Trust Domain Extensions (Intel® TDX) module Advisory

Summary: Potential security vulnerabilities for some Intel® TDX modules may allow information disclosure, escalation of privilege, or denial of service. Intel is releasing firmware updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2026-20885 Description:...

Security Updates for Microsoft SharePoint Server 2019 (August 2026)

The Microsoft SharePoint Server 2019 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Improper authentication in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. CVE-2026-62827 -...

PT-2026-70536

Name of the Vulnerable Software and Affected Versions Microsoft Local Security Authority Server lsasrv affected versions not specified Description A heap-based buffer overflow occurs in the Microsoft Local Security Authority Server lsasrv, which is a process responsible for managing local securit...

PT-2026-70209

An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/auth service.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject...

CVE-2026-51584

An issue in usememos v0.27.1 allows a remote attacker to achieve account takeover via the ssoCredentials branch of the SignIn handler in server/router/api/v1/authservice.go, because SSO identity is matched only on an attacker-controllable identifier without binding to the IdP's stable subject cla...

PT-2026-70368

Name of the Vulnerable Software and Affected Versions Windows RPC API affected versions not specified Description Missing authentication for a critical function in the Windows RPC API allows an authorized attacker to elevate privileges locally. Remote Procedure Call RPC is a protocol that allows ...

PT-2026-70235

When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email verified" claim and do not actually verify the email. This allows a user to...

PT-2026-70162

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a prototype pollution vulnerability in the Edit Fields Set node. The node assigns output fields via a dot-notation path setter without restricting the field name, allowing an authenticated user to name a field after an inherited built-in method pat...

PT-2026-70529

Name of the Vulnerable Software and Affected Versions Windows License Manager affected versions not specified Description A missing authentication flaw in a critical function allows an authorized attacker to elevate privileges locally, potentially affecting the system. Recommendations At the...

PT-2026-70177

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier parameters channel, function, and trigger names into SQL statements without proper escaping. An authenticated user can inject arbitrary SQL...

PT-2026-70090

Name of the Vulnerable Software and Affected Versions Picketlink affected versions not specified Description A flaw exists in the Service Provider SP signature validation. An attacker can forge a SAML response containing zero assertion elements that match the signature check, enabling them to...

PT-2026-70838

An issue in MongoDB Server could allow a party with a valid client certificate and a corresponding user account to authenticate using a certificate-based authentication method, even when an administrator has configured the server to restrict authentication to other mechanisms. This could allow...

PT-2026-70071

Name of the Vulnerable Software and Affected Versions Device Configuration Framework affected versions not specified Description An authentication bypass flaw exists within the Device Configuration Framework. This issue can be exploited by an attacker who has already authenticated using a service...

PT-2026-70435

Name of the Vulnerable Software and Affected Versions Windows Remote Desktop Services affected versions not specified Description Missing authentication for a critical function allows an authorized attacker to elevate privileges locally, which can lead to full system compromise. Recommendations A...

PT-2026-70094

Name of the Vulnerable Software and Affected Versions EAP affected versions not specified Description A flaw exists in the IIOP Internet Inter-ORB Protocol of EAP. The listener's NameService accepts bind operations without requiring authentication. This allows an attacker to hijack JNDI Java Nami...

PT-2026-70219

Name of the Vulnerable Software and Affected Versions TypeBot versions prior to 3.17.0 Description TypeBot stores API tokens, which are bearer credentials used to authenticate against the builder API, as cleartext strings in the database. An attacker with read access to the database can extract...