PT-2026-95182

Name of the Vulnerable Software and Affected Versions Azure Portal affected versions not specified Description Improper neutralization of input during web page generation leads to cross-site scripting XSS, a condition where malicious scripts are injected into trusted websites. This allows an...

PT-2026-95177

Name of the Vulnerable Software and Affected Versions Azure Cosmos DB affected versions not specified Description An issue involving improper neutralization of special elements in output used by a downstream component, known as injection, allows an authorized attacker to elevate privileges over a...

CVE-2026-87701: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Improper neutralization of special elements in output used by a downstream component 'injection' in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network...

PT-2026-95169

Name of the Vulnerable Software and Affected Versions Azure Arc affected versions not specified Description An issue exists where improper limitation of a pathname to a restricted directory, known as path traversal, allows an unauthorized attacker to elevate privileges over a network. Path...

PT-2026-95176

Name of the Vulnerable Software and Affected Versions Azure AI Foundry affected versions not specified Description Server-side request forgery SSRF allows an unauthorized attacker to elevate privileges over a network. SSRF is a flaw where an attacker can induce the server-side application to make...

CVE-2026-83944: Improper Access Control

Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network...

PT-2026-95183

Name of the Vulnerable Software and Affected Versions Azure Database for PostgreSQL affected versions not specified Description Improper authorization allows an authorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a newer version...

PT-2026-95175

Name of the Vulnerable Software and Affected Versions Azure AI Foundry affected versions not specified Description Azure AI Foundry contains a flaw in its core authentication module where a critical function lacks proper authentication. This allows an unauthenticated attacker to escalate privileg...

PT-2026-95173

Name of the Vulnerable Software and Affected Versions Azure Logic Apps affected versions not specified Description Improper access control allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a newer version that contai...

KLA91292 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to bypass security restrictions, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability i...

CVE-2026-85917: Server-Side Request Forgery (SSRF)

Server-side request forgery ssrf in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-70009: Improper Limitation of a Pathname to a Restricted Directory

Improper limitation of a pathname to a restricted directory 'path traversal' in Azure Arc allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-85889: Missing Authentication for Critical Function

Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network...

PT-2026-95180

Name of the Vulnerable Software and Affected Versions Azure Billing affected versions not specified Description Insufficient verification of data authenticity allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a newer...

PT-2026-95167

Name of the Vulnerable Software and Affected Versions Azure Arc affected versions not specified Description An elevation of privilege issue exists in Azure Arc, which could allow an attacker to gain higher permissions than intended. Recommendations At the moment, there is no information about a...

CVE-2026-63506: Authorization Bypass Through User-Controlled Key

Tina is a headless content management system. Prior to @tinacms/auth 1.1.4 and next-tinacms-azure 15.0.1, isAuthorized accepts a request-controlled clientID and asks isUserAuthorized to validate the bearer token against that selected TinaCloud app instead of the self-hosted site's configured app...

PT-2026-94025

Name of the Vulnerable Software and Affected Versions @tinacms/auth versions prior to 1.1.4 next-tinacms-azure versions prior to 15.0.1 Description Tina is a headless content management system. A cross-tenant authorization bypass exists because the isAuthorized function accepts a clientID directl...

Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (Azure) vulnerabilities (USN-8761-1)

"The remote Ubuntu 24.04 LTS / Pro Realtime 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8761-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. Thi...

BloodHound v9.7.1-rc1

BloodHound is a monolithic web application composed of an embedded React frontend with Sigma.js and a Go based REST API backend. It is deployed with a Postgresql application database and a Neo4j graph database, and is fed by the SharpHound and AzureHound data collectors. BloodHound leverages grap...

CVE-2026-58201

Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the management.azure.com base URL. A specially...