CVE-2026-32204 Azure Monitor Agent Elevation of Privilege Vulnerability

...

CVE-2026-32204

Azure Monitor Agent is affected by CVE-2026-32204. The vulnerability involves external control of a file name or path in the agent, enabling an authorized, local attacker to elevate privileges. The CVE has a high impact (C:H, I:H, A:H) with local attack vector and low attack complexity, requiring...

CVE-2026-32204 Azure Monitor Agent Elevation of Privilege Vulnerability

...

CVE-2026-43993

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the WAVS bridge's computeDataVerify called fetch on agent-supplied URLs without validating scheme, port, or resolved IP, resulting in an SSRF vulnerability. This vulnerability is fixed in 0.x.y-security-1...

CVE-2026-43990

JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, plugin-shell's runcommand wrapped every agent-supplied command in 'sh -c' / 'cmd /C' and passed the full argument string to the shell's parser, allowing shell metacharacters in agent-supplied arguments to be...

EUVD-2026-29492

LWP::UserAgent versions before 6.83 for Perl leak Authorization and Proxy-Authorization headers on cross-origin redirects. On a 3xx response, the redirect handler strips only Host and Cookie before issuing the follow-up request. Caller-supplied Authorization and Proxy-Authorization headers are se...

CVE-2026-43938

YetAnotherForum.NET YAF.NET is a C ASP.NET forum. Prior to 4.0.5 and 3.2.12, the application's database logger YAFNET.Core/Logger/DbLogger.cs captures the incoming request's User-Agent header into a JObject, serializes it with JsonConvert, and stores the result in the EventLog.Description column...

CVE-2026-8110

CVE-2026-8110 affects the Ivanti Endpoint Manager agent prior to 2024 SU6. The issue is an incorrect permissions assignment in the agent that allows a local authenticated attacker to escalate privileges (local, low complexity, no user interaction). The impact is elevated confidentiality, integrit...

CVE-2026-8368

CVE-2026-8368 affects the Perl module LWP::UserAgent before 6.83. The redirect handling on 3xx responses leaks caller credentials by sending Authorization and Proxy-Authorization headers unchanged, even across scheme/host/port changes, to the redirect target. This can disclose credentials to atta...

Azure Monitor Agent Elevation of Privilege Vulnerability

External control of file name or path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally...

Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability

Untrusted search path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally...

CVE-2026-43938

YetAnotherForum.NET YAF.NET is a C ASP.NET forum. Prior to 4.0.5 and 3.2.12, the application's database logger YAFNET.Core/Logger/DbLogger.cs captures the incoming request's User-Agent header into a JObject, serializes it with JsonConvert, and stores the result in the EventLog.Description column...

CVE-2026-43938 YAF.NET: Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header

YetAnotherForum.NET YAF.NET is a C ASP.NET forum. Prior to 4.0.5 and 3.2.12, the application's database logger YAFNET.Core/Logger/DbLogger.cs captures the incoming request's User-Agent header into a JObject, serializes it with JsonConvert, and stores the result in the EventLog.Description column...

CVE-2026-43938

Summary (supported): CVE-2026-43938 affects YetAnotherForum.NET (YAF.NET) prior to 4.0.5 and 3.2.12. The database logger captures the request’s User-Agent into a JSON object and stores it in EventLog.Description. When an admin views the EventLog, the code deserializes that JSON and interpolates t...

CVE-2026-43938 YAF.NET: Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header

YetAnotherForum.NET YAF.NET is a C ASP.NET forum. Prior to 4.0.5 and 3.2.12, the application's database logger YAFNET.Core/Logger/DbLogger.cs captures the incoming request's User-Agent header into a JObject, serializes it with JsonConvert, and stores the result in the EventLog.Description column...

CVE-2026-43938 YAF.NET: Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header

YetAnotherForum.NET YAF.NET is a C ASP.NET forum. Prior to 4.0.5 and 3.2.12, the application's database logger YAFNET.Core/Logger/DbLogger.cs captures the incoming request's User-Agent header into a JObject, serializes it with JsonConvert, and stores the result in the EventLog.Description column...

GHSA-MF9V-MFXR-J63J vulnerabilities

Vulnerabilities for packages: ansible-operator, openstack-kolla-toolbox-2026.1-fips, confluent-docker-utils, datadog-agent, barman, pgadmin4-fips, pypy-3.11, httpie, pypy-3.10, opal, ggshield, py3-cassandra-medusa, spamcheck, aws-cli, ansible-operator-fips, keep-fips, azure-functions-host,...

GHSA-QCCP-GFCP-XXVC vulnerabilities

Vulnerabilities for packages: ansible-operator, openstack-kolla-toolbox-2026.1-fips, confluent-docker-utils, datadog-agent, barman, pgadmin4-fips, pypy-3.11, httpie, pypy-3.10, opal, ggshield, py3-cassandra-medusa, spamcheck, aws-cli, ansible-operator-fips, keep-fips, azure-functions-host,...

CVE-2026-44431 vulnerabilities

Vulnerabilities for packages: ansible-operator, openstack-kolla-toolbox-2026.1-fips, confluent-docker-utils, datadog-agent, barman, pgadmin4-fips, pypy-3.11, httpie, pypy-3.10, opal, ggshield, py3-cassandra-medusa, spamcheck, aws-cli, ansible-operator-fips, keep-fips, azure-functions-host,...

CVE-2026-44432 vulnerabilities

Vulnerabilities for packages: ansible-operator, openstack-kolla-toolbox-2026.1-fips, confluent-docker-utils, datadog-agent, barman, pgadmin4-fips, pypy-3.11, httpie, pypy-3.10, opal, ggshield, py3-cassandra-medusa, spamcheck, aws-cli, ansible-operator-fips, keep-fips, azure-functions-host,...