CosmosEscape: Taking Over Every Database in Azure Cosmos DB

A critical vulnerability chain in Azure Cosmos DB enabled full read and write access to every Cosmos DB database...

CLEANSTART-2026-PY48684 Security fixes in az 2.83.0-r0

Package az version 2.83.0-r0 fixes 1 vulnerabilities: CVE-2026-4539...

CLEANSTART-2026-RW79431 Security fixes in velero-plugin-for-microsoft-azure-fips 1.14.0-r1

Package velero-plugin-for-microsoft-azure-fips version 1.14.0-r1 fixes 9 vulnerabilities: CVE-2026-27143, CVE-2026-32281, CVE-2026-32280, CVE-2026-32283, CVE-2026-27140...

CLEANSTART-2026-BF59911 Security fixes in az 2.83.0-r2

Package az version 2.83.0-r2 fixes 4 vulnerabilities: CVE-2026-48524, CVE-2026-48522, CVE-2026-48525, CVE-2026-48526...

CLEANSTART-2026-RZ36238 Security fixes in azure-functions-node 4.1052.200-r0

Package azure-functions-node version 4.1052.200-r0 fixes 22 vulnerabilities: CVE-2026-41907, CVE-2026-48068, CVE-2026-48069, CVE-2024-37168, CVE-2024-4068...

CLEANSTART-2026-OA40644 Security fixes in az 2.83.0-r1

Package az version 2.83.0-r1 fixes 4 vulnerabilities: CVE-2026-44432, CVE-2026-44431, CVE-2026-39892, CVE-2026-45409...

CLEANSTART-2026-OI46313 Security fixes in az 2.83.0-r3

Package az version 2.83.0-r3 fixes 1 vulnerabilities: ghsa-537c-gmf6-5ccf...

CLEANSTART-2026-JW02028 Security fixes in az 2.84.0-r2

Package az version 2.84.0-r2 fixes 4 vulnerabilities: CVE-2026-44432, CVE-2026-44431, CVE-2026-39892, CVE-2026-45409...

CLEANSTART-2026-RE00985 Security fixes in velero-plugin-for-microsoft-azure-fips 1.14.0-r2

Package velero-plugin-for-microsoft-azure-fips version 1.14.0-r2 fixes 11 vulnerabilities: CVE-2026-39820, CVE-2026-42499, CVE-2026-39836, CVE-2026-33814, CVE-2026-33811...

The vulnerability of the AI.Plugin.Azure software for vulnerability and error detection tools like PT Application Inspector arises from the lack of measures taken to neutralize special elements. This allows attackers to execute arbitrary commands.

The vulnerability of the AI.Plugin.Azure software patch, which is used for identifying vulnerabilities and errors in PT Application Inspector, stems from the lack of measures taken to neutralize its special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

CVE-2026-66803: Improper Access Control

Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network...

PT-2026-66599

Name of the Vulnerable Software and Affected Versions Azure Cosmos DB affected versions not specified Description Improper access control allows an unauthorized attacker to execute code over a network. Recommendations At the moment, there is no information about a newer version that contains a fi...

KLA91184 ACE vulnerability in Microsoft Azure

A remote code execution vulnerability was found in Microsoft Azure. Malicious users can exploit this vulnerability to execute arbitrary code, bypass security restrictions. Original advisories CVE-2026-66803 Exploitation CVE list CVE-2026-66803 critical Solution Install necessary updates from the ...

BloodHound v9.5.1

BloodHound is a monolithic web application composed of an embedded React frontend with Sigma.js and a Go based REST API backend. It is deployed with a Postgresql application database and a Neo4j graph database, and is fed by the SharpHound and AzureHound data collectors. BloodHound leverages grap...

Improper Verification of Cryptographic Signature

Overview apache-airflow-providers-fab is a Provider package apache-airflow-providers-fab for Apache Airflow Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the verifysignature parameter in the Azure AD OAuth login defaulting to False,...

CVE-2026-59243

The FAB auth manager's Azure AD OAuth login defaulted verifysignature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...

CVE-2026-59243 Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)

The FAB auth manager's Azure AD OAuth login defaulted verifysignature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...

CVE-2026-59243 Apache Airflow FAB provider: FAB auth manager: JWT signature verification disabled by default for Azure AD OAuth (`verify_signature` defaults to `False`)

The FAB auth manager's Azure AD OAuth login defaulted verifysignature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...

CVE-2026-59243

The apache-airflow-providers-fab component in Apache Airflow is vulnerable to an authentication bypass due to the FAB auth manager's Azure AD OAuth login defaulting verify_signature=False when decoding ID tokens. An attacker can present a forged or unsigned (alg:none) ID token to the OAuth callba...

CVE-2026-59243

The FAB auth manager's Azure AD OAuth login defaulted verifysignature=False when decoding the ID token, so an attacker able to present a forged or unsigned alg:none ID token to the OAuth callback could bypass authentication and log in as an arbitrary user, including one holding the Admin role...