15169 matches found
CVE-2026-47299
Improper neutralization of special elements used in a command 'command injection' in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network...
2026-08 Cumulative security Hotpatch for Azure Stack HCI, version 21H2 and Windows Server 2022 Datacenter: Azure Edition for x64-based Systems (KB5120229)
Install this update to resolve issues in Windows. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information...
Azure Storage Explorer Elevation of Privilege Vulnerability
Improper neutralization of input during web page generation 'cross-site scripting' in Azure Storage Explorer allows an unauthorized attacker to elevate privileges over a network...
Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability
Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Device Health Attestation DHA allows an unauthorized attacker to execute code over a network...
Azure CycleCloud Information Disclosure Vulnerability
Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network...
Azure CycleCloud Elevation of Privilege Vulnerability
Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network...
Azure Monitor Agent Elevation of Privilege Vulnerability
Improper neutralization of special elements used in a command 'command injection' in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network...
Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability
Integer overflow or wraparound in Windows Device Health Attestation DHA allows an unauthorized attacker to execute code over a network...
github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API
A flaw was found in Prometheus, an open-source monitoring system. The clientsecret field within the Azure Active Directory AD remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access t...
github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API
A flaw was found in Prometheus, an open-source monitoring system. The clientsecret field within the Azure Active Directory AD remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access t...
github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API
A flaw was found in Prometheus, an open-source monitoring system. The clientsecret field within the Azure Active Directory AD remote write OAuth configuration was incorrectly handled as a plain string instead of a secure Secret type. This misconfiguration allowed any user or process with access t...
PT-2026-70702
Name of the Vulnerable Software and Affected Versions Microsoft Azure Attestation service affected versions not specified Device Health Attestation Service affected versions not specified Description A race condition exists in the Microsoft Azure Attestation service and Device Health Attestation...
CVE-2026-50516: Missing Authentication for Critical Function
Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network...
PT-2026-70570
Name of the Vulnerable Software and Affected Versions Azure Entra ID affected versions not specified Description Insufficient verification of data authenticity allows an authorized attacker to perform spoofing over a network. Recommendations At the moment, there is no information about a newer...
CVE-2026-62869: Insufficient Verification of Data Authenticity
Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoofing over a network...
PT-2026-70387
Name of the Vulnerable Software and Affected Versions Microsoft Azure Kubernetes Service affected versions not specified Description Missing authentication for a critical function allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no...
KB5120242: Windows Server 2022 / Azure Stack HCI 22H2 Security Update (August 2026)
The remote Windows host is missing security update 5120242 or hotpatch 5120229. It is, therefore, affected by multiple vulnerabilities - Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network. CVE-2026-62815 - Stack-based buffer overflow in Windows DNS...
CVE-2026-47299: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command 'command injection' in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network...