16185 matches found
CVE-2026-34750 Payload has Insufficient Filename Validation in Client-Upload Signed-URL Endpoints
Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3, the client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize...
EUVD-2026-17983
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From versions 2.0.0-alpha to before 2.3.9 and 3.0.0-alpha to before 3.1.1, there is a conditional local privilege escalation vulnerability in an edge-case naming collision. Only authenticated himmelblau users whose...
CVE-2026-34397
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From versions 2.0.0-alpha to before 2.3.9 and 3.0.0-alpha to before 3.1.1, there is a conditional local privilege escalation vulnerability in an edge-case naming collision. Only authenticated himmelblau users whose...
CLEANSTART-2026-NN77774 Security fixes for CVE-2026-33186, ghsa-p77j-4mvh-x3m3 applied in versions: 2.4.0-r0
Multiple security vulnerabilities affect the crossplane-provider-azure package. These issues are resolved in later releases. See references for individual vulnerability details...
PT-2026-29598
Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.78.0 Description The client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize filenames. An attacker could craft filenames to escape the intended storage location. Recommendations...
CVE-2026-34750: Improper Limitation of a Pathname to a Restricted Directory
Payload is a free and open source headless content management system. Prior to version 3.78.0 in @payloadcms/storage-azure, @payloadcms/storage-gcs, @payloadcms/storage-r2, and @payloadcms/storage-s3, the client-upload signed-URL endpoints for S3, GCS, Azure, and R2 did not properly sanitize...
CVE-2026-34397: Improper Privilege Management
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From versions 2.0.0-alpha to before 2.3.9 and 3.0.0-alpha to before 3.1.1, there is a conditional local privilege escalation vulnerability in an edge-case naming collision. Only authenticated himmelblau users whose...
Himmelblau security vulnerability
Himmelblau is an open-source Azure Entra ID authentication module developed by Himmelblau. There is a security vulnerability in Himmelblau, which stems from conditional local privilege escalation due to name conflicts in edge scenarios. If the mapped CN or short name matches the name of a...
c7n-azure (0.7.8), erpbrasil-assinatura (1.0.2) +2 more potentially affected by CVE-2026-34073 via cryptography (3.3.0)
cryptography PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - c7n-azure 0.7.8 - erpbrasil-assinatura 1.0.2 - myjwt 1.2.0 - swimlane-platform 10.6.0 Source cves: CVE-2026-34073 Source advisory:...
Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2026-33343)
The version of CBL-Mariner Releases installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-33343 advisory. - etcd is a distributed key-value store for the data of a distributed system. Prior to versions...
Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2026-25645)
The version of CBL-Mariner Releases installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2026-25645 advisory. - Requests is a HTTP library. Prior to version 2.33.0, the requests.utils.extractzippedpaths...
GHSA-65XW-VW82-R86X vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-iam, grafana-alloy, crossplane-provider-aws-kinesis, crossplane-provider-family-aws, amazon-cloudwatch-agent, crossplane-provider-aws-elasticache, crossplane-provider-azure-authorization, crossplane-provider-aws-cloudfront,...
CVE-2026-32287 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-iam, grafana-alloy, crossplane-provider-aws-kinesis, crossplane-provider-family-aws, amazon-cloudwatch-agent, crossplane-provider-aws-elasticache, crossplane-provider-azure-authorization, crossplane-provider-aws-cloudfront,...
GHSA-65XW-VW82-R86X vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-cloudfront, crossplane-provider-aws-acm, crossplane-provider-aws-rolesanywhere-fips, grafana-alloy, crossplane-provider-aws-cloudformation, crossplane-provider-family-azure, crossplane-provider-aws-dynamodb-fips, crossplane-provider-aws-sns,...
CVE-2026-32287 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-cloudfront, crossplane-provider-aws-acm, crossplane-provider-aws-rolesanywhere-fips, grafana-alloy, crossplane-provider-aws-cloudformation, crossplane-provider-family-azure, crossplane-provider-aws-dynamodb-fips, crossplane-provider-aws-sns,...
Exploit for Exposure of Resource to Wrong Sphere in Linuxfoundation Containerd
ZipSlip Container Escape Vulnerability in containerd CVE...
Azure Linux 3.0 Security Update: CBL-Mariner Releases (CVE-2025-69720)
The version of CBL-Mariner Releases installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-69720 advisory. - The infocmp command-line tool in ncurses before 6.5-20251213 has a stack-based buffer overflow...
CVE-2026-33980
Azure Data Explorer MCP Server is a Model Context Protocol MCP server that enables AI assistants to execute KQL queries and explore Azure Data Explorer ADX/Kusto databases through standardized interfaces. Versions up to and including 0.1.1 contain KQL Kusto Query Language injection vulnerabilitie...