7515 matches found
EUVD-2026-54675
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.0, the iOS Companion app treats tag links NFC or QR delivered through an OS-level routing mechanism such as iOS universal links as if they were physically scanned, without validating the...
CVE-2026-66061
CVE-2026-66061 affects the Home Assistant project via its iOS Companion app. The root cause is that, prior to version 2026.5.0, tag links (NFC or QR) delivered through OS-level routing (e.g., iOS universal links) could be treated as if physically scanned without validating the calling app or prom...
EUVD-2026-54654
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.3, the Companion app treats tag links NFC or QR delivered through an OS-level routing mechanism as if they were physically scanned, without validating the calling app or prompting the user...
CVE-2026-66060 Home Assistant: Unconfirmed NFC/QR tag scans allow silent automation execution by untrusted callers
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.3, the Companion app treats tag links NFC or QR delivered through an OS-level routing mechanism as if they were physically scanned, without validating the calling app or prompting the user...
CVE-2026-66060
Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.3, the Companion app treats tag links NFC or QR delivered through an OS-level routing mechanism as if they were physically scanned, without validating the calling app or prompting the user...
EUVD-2026-54570
In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exported with no permission guard. A co-installed application can launch it with attacker-controlled Intent extras, including a full-screen lock-screen message, an arbitrary on-call page ID,...
CVE-2026-47361
In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no permission guard and accepts a SEND intent with a caller-supplied conversationid. When the activity closes and no in-process session matches that ID, it unconditionally cancels notification ...
EUVD-2026-54314
Improper authorization in Microsoft Power Apps allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-54320
Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network...
CVE-2026-59118
Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-56161
Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network...
CVE-2026-56161 Azure Logic Apps Information Disclosure Vulnerability
...
CVE-2026-56161 Azure Logic Apps Information Disclosure Vulnerability
...
CVE-2026-56161
Azure Logic Apps is identified in CVE-2026-56161 as having improper access control that allows an authorized attacker to disclose information over a network. The CVSS 3.1 base score is 9.6 (CRITICAL) with NETWORK attack vector, LOW attack complexity, LOW privileges required, and no user interacti...
CVE-2026-56161
Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network...
CVE-2026-59118 Copilot Cowork Elevation of Privilege Vulnerability
...
CVE-2026-59118
Improper authorization in Microsoft Power Apps allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-59118
Technical details such as affected components, root cause, and patch information are not publicly provided in the supplied documents. Monitor for updates from Microsoft and other sources.
