CVE-2020-37267

A flaw was found in Renovate. When used with Azure DevOps, the bot's authorization token may be exposed in server or pipeline logs. This occurs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. An attacker with access to these logs could obtain the bot's...

CVE-2020-37267

Renovate versions =19.180.0 and 23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed ...

EUVD-2020-31261

Renovate versions =19.180.0 and 23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed ...

CVE-2020-37267

Renovate versions >=19.180.0 and

CVE-2020-37267 Renovate 19.180.0 before 23.25.1 Token Leakage via Logs

Renovate versions =19.180.0 and 23.25.1, when used with Azure DevOps, may expose the bot's authorization token in server or pipeline logs because the git http.extraheader=AUTHORIZATION parameter is logged without redaction. Anyone with access to saved logs could obtain the bot credentials. Fixed ...

CVE-2026-66378

An authenticated user without repository read permission may access private NuGet metadata under specific conditions...

Malicious code in matlab-azure-devops-extension (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ecc42778bb54bfdea5784d5dcb68cf43c89def3dbaeddba1d1a6bd2850cb174b The package's preinstall script node index.js auto-executes on npm install and collects host identifiers os.hostname, os.userInfo.username, home...

Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents

A single invisible comment in an Azure DevOps pull request can turn a reviewer's own AI coding agent against them, driving it into projects the attacker has no rights to reach and quietly leaking what it finds. The flaw is in Microsoft's official Azure DevOps MCP server, and it works because one ...

vulnerabilities handled in Microsoft Developer Tools

Microsoft has addressed vulnerabilities in various Developer Tools. A malicious individual could exploit these vulnerabilities to carry out attacks that can cause the following types of damage: - Denial-of-Service DoS attacks - Bypass of security measures - Execution of arbitrary code user rights...

CVE-2026-42826

Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network...

EUVD-2026-28460

Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network...

The vulnerability of the Azure DevOps software development tool, related to information disclosure, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Azure DevOps software development tool is related to the exposure of information. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

CVE-2026-42826

Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network...

CVE-2026-42826 Azure DevOps Information Disclosure Vulnerability

...

CVE-2026-42826

Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network...

CVE-2026-42826

Technical details are not publicly available in the provided documents; no affected products/versions/vectors or remediation are specified here. Monitor for updates from official sources.

CVE-2026-42826 Azure DevOps Information Disclosure Vulnerability

...

Azure DevOps Information Disclosure Vulnerability

Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network...

PT-2026-38587

Name of the Vulnerable Software and Affected Versions Azure DevOps affected versions not specified Description Exposure of sensitive information in Azure DevOps allows an unauthorized actor to disclose information over a network. Recommendations At the moment, there is no information about a newe...

Microsoft Azure DevOps 信息泄露漏洞

Microsoft Azure DevOps is a team collaboration platform provided by the American company Microsoft. There is an information leakage vulnerability in Microsoft Azure DevOps. This vulnerability stems from the exposure of sensitive information to unauthorized participants, which may allow unauthoriz...