15166 matches found
CVE-2026-93853: Unverified Ownership
Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots. When a snapshot backup is deleted, either explicitly or by retention policy enforcement, Barman reads the snapshot identifiers from the...
PT-2026-102928
Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots. When a snapshot backup is deleted, either explicitly or by retention policy enforcement, Barman reads the snapshot identifiers from the...
PT-2026-102758
Name of the Vulnerable Software and Affected Versions Azure RTOS affected versions not specified Description In builds with TX ENABLE EVENT TRACE enabled, a user-mode, memory-protected module using TXM MODULE USER MODE | TXM MODULE MEMORY PROTECTION can register an arbitrary function pointer as t...
The vulnerability of the integrated connection platform for cloud services in Spring Cloud Azure, related to deficiencies in authentication procedures, allows attackers to escalate their privileges.
The vulnerability of the integrated connection platform for cloud services in Spring Cloud Azure is related to deficiencies in the authentication process. Exploiting this vulnerability could allow attackers to enhance their privileges remotely...
Azure File Sync Agent v23.1 Release – August 2026 (KB5072939)
Update Rollup for Azure File Sync agent version 23.1.0.0. For more details, see the associated Microsoft Knowledge Base article...
Azure File Sync Agent v23.1 Release – August 2026 (KB5072939)
Update Rollup for Azure File Sync agent version 23.1.0.0. For more details, see the associated Microsoft Knowledge Base article...
Azure File Sync Agent v23.1 Release – August 2026 (KB5072939)
Update Rollup for Azure File Sync agent version 23.1.0.0. For more details, see the associated Microsoft Knowledge Base article...
Azure File Sync Agent v23.1 Release – August 2026 (KB5072939)
Update Rollup for Azure File Sync agent version 23.1.0.0. For more details, see the associated Microsoft Knowledge Base article...
Malicious Package
Overview azure-langchain-example is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...
JADEPUFFER-Linked Attackers Used Compromised Service Principals to Delete Azure Resources
The threat actor known as JADEPUFFER has been observed orchestrating destructive actions within a Microsoft Azure environment using compromised service principals. Microsoft, which is tracking the activity under the name Storm-3168 , has called it an evolution of the threat actor's tradecraft. Th...
Malicious code in azure-langchain-example (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cffc3a51858b1b7a17ff0edfd2eeae6383e83b4eff5bc078f7b1d4f5ba36ad2 On import azurelangchainexample, the package's init.py starts a background daemon thread that issues a GET request to...
MAL-2026-17213 Malicious code in azure-langchain-example (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cffc3a51858b1b7a17ff0edfd2eeae6383e83b4eff5bc078f7b1d4f5ba36ad2 On import azurelangchainexample, the package's init.py starts a background daemon thread that issues a GET request to...
The vulnerability of the Command Line Interface (CLI) of the Microsoft Azure platform, which allows a hacker to execute arbitrary code.
The vulnerability of the Command Line Interface CLI of the Microsoft Azure platform is related to the lack of measures taken for data cleaning at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2026-100569
OpenClaw is an npm-distributed application. In versions = 2026.4.25 and 2026.8.1, the workspace environment-variable filter did not block variables ending in ENDPOINT, so an untrusted workspace .env file could set AZURESPEECHENDPOINT. Azure Speech preferred that value over the configured region, ...
CVE-2026-100569
The OpenClaw npm-distributed application, versions >= 2026.4.25 and
EUVD-2026-87482
OpenClaw is an npm-distributed application. In versions = 2026.4.25 and 2026.8.1, the workspace environment-variable filter did not block variables ending in ENDPOINT, so an untrusted workspace .env file could set AZURESPEECHENDPOINT. Azure Speech preferred that value over the configured region, ...
CVE-2026-100569
OpenClaw is an npm-distributed application. In versions = 2026.4.25 and 2026.8.1, the workspace environment-variable filter did not block variables ending in "ENDPOINT", so an untrusted workspace ".env" file could set AZURESPEECHENDPOINT. Azure Speech preferred that value over the configured...
CVE-2026-100569 OpenClaw before 2026.8.1 Credential Exposure via Endpoint Override
OpenClaw is an npm-distributed application. In versions = 2026.4.25 and 2026.8.1, the workspace environment-variable filter did not block variables ending in ENDPOINT, so an untrusted workspace .env file could set AZURESPEECHENDPOINT. Azure Speech preferred that value over the configured region, ...
PT-2026-99205
Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.4.25 through 2026.8.0 Description The workspace environment-variable filter fails to block variables ending in ENDPOINT. This allows an untrusted workspace .env file to set the AZURE SPEECH ENDPOINT variable. Because Azu...
CVE-2026-100569: Insufficiently Protected Credentials
OpenClaw is an npm-distributed application. In versions = 2026.4.25 and 2026.8.1, the workspace environment-variable filter did not block variables ending in ENDPOINT, so an untrusted workspace .env file could set AZURESPEECHENDPOINT. Azure Speech preferred that value over the configured region, ...