CVE-2026-8043

External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files and write arbitrary HTML files to a web directory, leading to information disclosure and possible client-side attacks...

KB5090354 - Description of the security update for SQL Server 2017 CU31: May 12, 2026

None None...

KB5090347 - Description of the security update for SQL Server 2017 GDR: May 12, 2026

None None...

KB5089899 - Description of the security update for SQL Server 2025 CU4: May 12, 2026

None None...

KB5090408 - Description of the security update for SQL Server 2019 GDR: May 12, 2026

None None...

KB5091158 - Description of the security update for SQL Server 2022 GDR: May 12, 2026

None None...

Microsoft Word Information Disclosure Vulnerability

Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized attacker to disclose information locally...

Microsoft Word Information Disclosure Vulnerability

Files or directories accessible to external parties in Microsoft Office Word allows an unauthorized attacker to disclose information locally...

Azure Monitor Agent Elevation of Privilege Vulnerability

External control of file name or path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally...

Microsoft Teams Spoofing Vulnerability

Files or directories accessible to external parties in Microsoft Teams allows an unauthorized attacker to perform spoofing locally...

SQL Server Remote Code Execution Vulnerability

External control of file name or path in SQL Server allows an authorized attacker to execute code over a network...

CVE-2026-45321

creationtimestamp| type| source ---|---|--- 2026-05-12 12:20:35+00:00| seen| https://bsky.app/profile/dameyiwu.bsky.social/post/3mlnrlvzty22x 2026-05-12 15:00:07+00:00| seen| Telegram/88YkBdmMMIAUjkN-cy3WAm2Yboedxaf0GfTYOA3KafU0qTc 2026-05-12 18:40:06+00:00| seen| https://t.me/truesecator/8195...

Hidden Public Link creation when sharing to a Team External Member

None...

CVE-2026-8162

creationtimestamp| type| source ---|---|--- 2026-05-12 09:10:50+00:00| seen| https://bsky.app/profile/ulisesgascon.com/post/3mlngymcjjk27 2026-05-12 10:38:58+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mlnlwa47v52l 2026-05-12 11:56:57+00:00| seen|...

MAL-2026-3689 Malicious code in dcchbot (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df79831d1b486c8ca704295b410cec7b66be85aa87c3244d97ff1e87f643183a The package performs multiple installer-hostile behaviors. 1 dcchbot/init.py auto-invokes run on import, which triggers interactive input prompts and...

Malicious code in dcchbot (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector df79831d1b486c8ca704295b410cec7b66be85aa87c3244d97ff1e87f643183a The package performs multiple installer-hostile behaviors. 1 dcchbot/init.py auto-invokes run on import, which triggers interactive input prompts and...

CVE-2026-45022 vulnerabilities

Vulnerabilities for packages: src-fingerprint, gitea, argo-workflows-fips, pulumi-kubernetes-operator, guac, cloudbeat-fips, grype, k9s-fips, gitlab-rails-ce-fips, chainloop-cli, flux-fips, wolfictl, kots, chainctl, nemo, cerbos-fips, argocd-image-updater-fips, kubescape, trivy-operator, snyk-cli...

Malicious code in @uipath/rpa-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 27baf6f8e722fd9803bff5f0d455ae5867fcf87135864df02a6f269cccf659fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-3521 Malicious code in @tolka/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 690527fdde65817c5fb47eeae87927130e678a6255b461b2ebfa6c0881be570f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @taskflow-corp/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e305906fa9a2ce7ccc0318baa5c5d7cd13bd021623fec9701e1841d92ab00e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...