Microsoft Azure AI Foundry M365 published agents: Access control error vulnerability

Microsoft Azure AI Foundry M365 Published Agents are a series of enterprise-level intelligent agents provided by the American company Microsoft. There is an access control vulnerability in Microsoft Azure AI Foundry M365 Published Agents. This vulnerability stems from improper access control, whi...

Microsoft Azure Cloud Shell command injection vulnerability

Microsoft Azure Cloud Shell is a browser-based cloud command-line environment developed by Microsoft Corporation. There is a command injection vulnerability in Microsoft Azure Cloud Shell, which stems from improper neutralization of special elements in commands. This vulnerability could allow...

Microsoft Azure Managed Instance for Apache Cassandra: Input validation error vulnerability

Microsoft Azure Managed Instance for Apache Cassandra is a service provided by Microsoft for Apache Cassandra on Azure. There is an input validation vulnerability in Microsoft Azure Managed Instance for Apache Cassandra; this vulnerability stems from improper input validation and could allow...

Microsoft Azure Machine Learning cross-site scripting vulnerability

Microsoft Azure Machine Learning is a machine learning service provided by Microsoft Corporation in the United States. Microsoft Azure Machine Learning has a cross-site scripting vulnerability, which stems from improper input during the web page generation process. This vulnerability could allow...

PT-2026-38587

Name of the Vulnerable Software and Affected Versions Azure DevOps affected versions not specified Description Exposure of sensitive information in Azure DevOps allows an unauthorized actor to disclose information over a network. Recommendations At the moment, there is no information about a newe...

PT-2026-38580

Name of the Vulnerable Software and Affected Versions Azure Managed Instance for Apache Cassandra affected versions not specified Description Improper input validation allows an authorized attacker to execute code over a network. Recommendations At the moment, there is no information about a newe...

CVE-2026-41105: Server-Side Request Forgery (SSRF)

Server-side request forgery ssrf in Azure Notification Service allows an authorized attacker to elevate privileges over a network...

KLA91030 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, bypass security restrictions, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Azur...

PT-2026-38584

Name of the Vulnerable Software and Affected Versions Azure Notification Service affected versions not specified Description Server-side request forgery SSRF, a flaw where an attacker can induce the server to make requests to an unintended location, in the Azure Notification Service allows an...

CVE-2026-33109: Improper Access Control

Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network...

CVE-2026-35435: Improper Access Control

Improper access control in Azure AI Foundry M365 published agents allows an unauthorized attacker to elevate privileges over a network...

PT-2026-40480

Уязвимость службы автоматизации развёртывания и масштабирования для управляемых решений Apache Cassandra Azure Managed Instance связана с ошибками разграничения доступа. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код...

PT-2026-38583

Name of the Vulnerable Software and Affected Versions Azure AI Foundry M365 published agents affected versions not specified Description Improper access control in Azure AI Foundry M365 published agents allows an unauthorized attacker to elevate privileges over a network. Recommendations At the...

CVE-2026-35428: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in Azure Cloud Shell allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-33844: Improper Input Validation

Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network...

CVE-2026-32207: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network...

KLA91028 OSI vulnerability in Microsoft Developer Tools

An information disclosure vulnerability was found in Microsoft Developer Tools. Malicious users can exploit this vulnerability to obtain sensitive information. Original advisories CVE-2026-42826 Exploitation Public exploits exist for this vulnerability. CVE list CVE-2026-42826 critical KB list...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the azureauthextension method. An attacker can gain unauthorized access to telemetry ingestion endpoints by replaying a valid Azure access token for any scope the configured identity c...

opentelemetry-collector-contrib's azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay

Summary A server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint for to authenticate to any OpenTelemetry receiver that uses auth: azureauth. The extension's Authenticate metho...

GHSA-PJV4-3C63-699F opentelemetry-collector-contrib's azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay

Summary A server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint for to authenticate to any OpenTelemetry receiver that uses auth: azureauth. The extension's Authenticate metho...