CVE-2026-105941

The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire...

CVE-2026-105941

The Azure Key Vault KMS provider in Kroxylicious is vulnerable to a Server-Side Request Forgery (SSRF) due to a lack of format validation on the vaultName parameter received from wire-deserialized EDEK bytes. This flaw allows an attacker to exfiltrate the proxy's Azure bearer token to an attacker...

CVE-2026-105941 Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname

The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire...

CVE-2026-105941 Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname

The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire...

CVE-2026-105941 Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname

The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire...

EUVD-2026-104983

The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire...

CVE-2026-105941

The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire...

CVE-2026-88132

Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network...

CVE-2026-85925

Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network...

CVE-2026-85922

Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-85925

The Azure Key Vault component is affected by a vulnerability involving the improper restriction of communication channels to intended endpoints. This flaw allows an authorized attacker to achieve privilege escalation over a network. Microsoft has released updates to address this issue; users are ...

CVE-2026-85922

A weak authentication vulnerability in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network. This security control bypass has a CVSS v3.1 score of 7.4 and is categorized as HIGH severity. Microsoft has released updates to address this vulnerability; users ar...

CVE-2026-88132

An origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network. This vulnerability is classified as an Access to Sensitive Data issue with a CVSS v3.1 score of 5.9 (Medium) . Microsoft has released updates to address this vulnerability; users ...

EUVD-2026-99656

Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network...

vulnerabilities present in Microsoft Office

Microsoft has fixed xxx vulnerabilities in various Office products, such as Word, Excel, Access, Outlook, Visio, SharePoint, and PowerPoint, as well as subcomponents like Shell, Azure Key Vault, and Click-to-Run. A malicious actor could exploit these vulnerabilities to cause a denial-of, gain...

Azure Key Vault Security Feature Bypass Vulnerability

Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network...

Azure Key Vault Information Disclosure Vulnerability

Origin validation error in Azure Key Vault allows an unauthorized attacker to disclose information over a network...

CVE-2026-85925: Improper Restriction of Communication Channel to Intended Endpoints

Improper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a network...

CVE-2026-85922: Weak Authentication

Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network...

KLA91335 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, gain privileges, obtain sensitive information. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability i...