PT-2026-4959

Name of the Vulnerable Software and Affected Versions ixray-team ixray-1.6-stcop versions prior to 1.3 Description A flaw exists that can lead to the exposure of sensitive information to an unauthorized actor. Recommendations Update ixray-team ixray-1.6-stcop to version 1.3 or later...

CVE-2026-21520

Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector...

Azure Data Explorer Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Azure Data Explorer allows an unauthorized attacker to disclose information over a network...

PT-2026-4307

Name of the Vulnerable Software and Affected Versions Microsoft Copilot Studio versions prior to January 15, 2026 Description An issue in Microsoft Copilot Studio allows an unauthenticated remote attacker to view sensitive information via a network attack vector. The flaw is rooted in a lack of...

PT-2026-4309

Name of the Vulnerable Software and Affected Versions Azure Data Explorer affected versions not specified Description An issue exists in Azure Data Explorer that allows an unauthorized attacker to disclose sensitive information over a network. The issue involves the exposure of sensitive...

PT-2026-23549

Name of the Vulnerable Software and Affected Versions OpenClaw Nextcloud Talk plugin versions prior to 2026.2.6 Description The Nextcloud Talk plugin allows attackers to bypass direct message DM and room allowlists. The plugin incorrectly uses the mutable actor.name field for allowlist validation...

Security Bug in StealC Malware Panel Let Researchers Spy on Threat Actor Operations

Cybersecurity researchers have disclosed a cross-site scripting XSS vulnerability in the web-based control panel used by operators of the StealC information stealer, allowing them to gather crucial insights on one of the threat actors using the malware in their operations. "By exploiting it, we...

CVE-2026-20937

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally...

CVE-2026-20862

Exposure of sensitive information to an unauthorized actor in Windows Management Services allows an authorized attacker to disclose information locally...

CVE-2026-20847

Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to perform spoofing over a network...

CVE-2026-20821

Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows an unauthorized attacker to disclose information locally...

CVE-2026-20937

CVE-2026-20937 affects Windows File Explorer and is described as an information-disclosure vulnerability allowing a locally authorized attacker to disclose information. The provided documents confirm a Windows File Explorer exposure, with CVSS 3.1/5.5 (Local access, Low attack complexity, High co...

CVE-2026-20862

CVE-2026-20862 is a Windows Management Services information disclosure vulnerability. The description in the initial document states that it allows an authorized attacker to disclose sensitive information locally. The connected Nessus/NCSC/ENISA entries confirm this is a local-impact issue tied t...

CVE-2026-20932

CVE-2026-20932 is a Windows File Explorer information disclosure vulnerability with local access as the attack vector and a CVSS v3.1 base score of 5.5 (Medium). The connected advisories indicate the issue exists in Windows File Explorer and that Microsoft released January 2026 security updates; ...

CVE-2026-20823

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally...

PT-2026-2677

Name of the Vulnerable Software and Affected Versions Tablet Windows User Interface TWINUI Subsystem affected versions not specified Description The TWINUI Subsystem contains a flaw that could allow an attacker to disclose sensitive information locally. An authorized attacker can exploit this iss...

PT-2026-2741

CVE-2026-20939 Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. https://t.co/Y0ZO1sbgGl...

PT-2026-2694

Name of the Vulnerable Software and Affected Versions Windows Shell affected versions not specified Description A flaw exists in Windows Shell that could allow an attacker to perform spoofing over a network, potentially leading to unauthorized access to sensitive information. This issue enables a...

PT-2026-2671

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description A flaw exists in Windows Remote Procedure Call that could allow an unauthorized attacker to disclose information locally. This issue enables attackers to obtain sensitive information and...

golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS

A flaw in golang.org/x/crypto/ssh/agent causes the SSH agent client to panic when a peer responds with the generic SSHAGENTSUCCESS 0x06 message to requests expecting typed replies e.g., List, Sign. The unmarshal layer produces an unexpected message type, which the client code does not handle,...