Azure Kubernetes Service Path Traversal

The vulnerability of the Container Application Deployment and Management service provided by Azure Kubernetes Service AKS is related to an incorrect path name limitation for the catalog. Exploiting this vulnerability could allow a attacker to execute arbitrary code...

CVE-2026-45642

Improper input validation in Microsoft Azure Attestation service and Device Health Attestation Service allows an authorized attacker to perform spoofing with a physical attack...

CVE-2026-47643

External control of file name or path in Azure Stack Edge allows an unauthorized attacker to execute code over a network...

CVE-2026-41098

Improper neutralization of input during web page generation 'cross-site scripting' in Azure Stack Edge allows an authorized attacker to perform spoofing over a network...

CVE-2026-32193

Improper limitation of a pathname to a restricted directory 'path traversal' in Microsoft Azure Kubernetes Service allows an authorized attacker to execute code locally...

org.jenkins-ci.main:jenkins-war (1.652), org.jenkins-ci.main:test (1.652) +1 more potentially affected by CVE-2026-53439 via org.jenkins-ci.main:jenkins-core (1.652)

org.jenkins-ci.main:jenkins-core MAVEN version 1.652 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-war 1.652 - org.jenkins-ci.main:test 1.652 -...

org.jenkins-ci.main:jenkins-war (1.645), org.jenkins-ci.main:test (1.645) +5 more potentially affected by CVE-2026-53436 via org.jenkins-ci.main:jenkins-core (1.645)

org.jenkins-ci.main:jenkins-core MAVEN version 1.645 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-war 1.645 - org.jenkins-ci.main:test 1.645 -...

org.jenkins-ci.main:jenkins-war (1.645), org.jenkins-ci.main:test (1.645) +5 more potentially affected by CVE-2026-53440 via org.jenkins-ci.main:jenkins-core (1.645)

org.jenkins-ci.main:jenkins-core MAVEN version 1.645 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-war 1.645 - org.jenkins-ci.main:test 1.645 -...

org.jenkins-ci.main:jenkins-war (1.653), org.jenkins-ci.main:test (1.653) +9 more potentially affected by CVE-2026-53442 via org.jenkins-ci.main:jenkins-core (1.653)

org.jenkins-ci.main:jenkins-core MAVEN version 1.653 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - org.jenkins-ci.main:jenkins-war 1.653 - org.jenkins-ci.main:test 1.653 -...

github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API

A flaw was found in Prometheus, an open-source monitoring system. The clientsecret field within the Azure Active Directory AD remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access t...

com.aerse:gcless (11.2), com.hazelcast:hazelcast-wm (>=3.4, <=3.8.3) +99 more potentially affected by CVE-2026-41706 via org.springframework.security:spring-security-web (3.2.1.release)

org.springframework.security:spring-security-web MAVEN version 3.2.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.security:spring-security-web and may be impacted: - com.aerse:gcless 11.2 - com.hazelcast:hazelcast-wm =3.4...

openSUSE 15: azure-cli / azure-cli-core / azure-cli-telemetry / python311-anyio / etc (SUSE-SU-SUSE-RU-2026:2237-2)

"The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-SUSE-RU-2026:2237-2 advisory. Changes in azure-cli-core: - Drop CVE-2025-24049 patch, fixed upstream - New upstream release - Version 2.82.0 - For detailed information...

EUVD-2026-35689

Improper input validation in Microsoft Azure Attestation service and Device Health Attestation Service allows an authorized attacker to perform spoofing with a physical attack...

EUVD-2026-35507

Improper neutralization of input during web page generation 'cross-site scripting' in Azure Stack Edge allows an authorized attacker to perform spoofing over a network...

EUVD-2026-35504

Improper limitation of a pathname to a restricted directory 'path traversal' in Microsoft Azure Kubernetes Service allows an authorized attacker to execute code locally...

Vulnerabilities in Microsoft Azure

Microsoft has addressed vulnerabilities in various Azure components. Malicious actors could exploit these vulnerabilities to impersonate other users, gain elevated privileges, execute arbitrary code, or potentially access sensitive data. The most severe vulnerability was found in HorizonDB and ha...

Reconstructing AI activity in investigations

AI systems are now part of everyday work. Investigators need a consistent way to reconstruct what happened within them. Security teams are already investigating activity involving Microsoft 365 Copilot and Azure AI services—from prompt injection attempts to unexpected data access. Those signals a...

Reconstructing AI activity in investigations

AI systems are now part of everyday work. Investigators need a consistent way to reconstruct what happened within them. Security teams are already investigating activity involving Microsoft 365 Copilot and Azure AI services—from prompt injection attempts to unexpected data access. Those signals a...

CVE-2026-47643

External control of file name or path in Azure Stack Edge allows an unauthorized attacker to execute code over a network...

CVE-2026-45642

Improper input validation in Microsoft Azure Attestation service and Device Health Attestation Service allows an authorized attacker to perform spoofing with a physical attack...