146768 matches found
EUVD-2026-30562
Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but...
CVE-2026-44641
CVE-2026-44641 affects Microsoft APM. Before version 0.8.12, the plugin-loading flow copies components listed in plugin.json into the .apm/ directory and does not validate that manifest paths (agents, skills, commands, hooks) stay inside the plugin root. An attacker can supply absolute or ../ tra...
CVE-2026-44641 Microsoft APM: plugin.json component paths escape plugin root and copy arbitrary host files during install
Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but...
CVE-2026-44641
Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but...
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
...
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Improper input validation in Microsoft Edge Chromium-based allows an unauthorized attacker to bypass a security feature over a network...
Microsoft Edge (Chromium-based) Spoofing Vulnerability
...
CalPhishing Scam Uses EvilTokens Kit, Outlook Invites to Steal M365 Sessions
Hackers are exploiting Outlook calendar invites and device code phishing to steal M365 session tokens, bypass MFA and breach enterprise accounts...
CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1
...
CVE-2026-4890
...
CVE-2026-5172
...
CVE-2026-2291
...
CVE-2026-4893
...
CVE-2026-4891
...
Microsoft Edge 输入验证错误漏洞
Microsoft Edge is a web browser included with Windows 10 and later versions of the Microsoft operating system. There is a vulnerability in input validation of Microsoft Edge. Attackers can exploit this vulnerability to bypass certain features...
Security Updates for Microsoft .NET Framework (May 2026)
The Microsoft .NET Framework installation on the remote host is missing a security update. It is, therefore, affected by the following vulnerability: - Heap-based buffer overflow in .NET allows an unauthorized attacker to elevate privileges locally. CVE-2026-32177 Note that Nessus has not tested...
PT-2026-41711
Name of the Vulnerable Software and Affected Versions Microsoft Edge Chromium-based affected versions not specified Description A spoofing issue in Microsoft Edge Chromium-based allows attackers to affect the system. This includes a universal cross-site scripting XSS flaw—a type of vulnerability...
ROS-20260515-73-0038
A vulnerability in the MediaStream component of Google Chrome and Microsoft Edge browser is related to memory usage after it has been freed. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service using a specially crafted HTML page...
ROS-20260515-73-0019
A vulnerability in the ANGLE library of Google Chrome and Microsoft Edge browsers is related to integer overflow. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service using a specially crafted HTML page...
ROS-20260515-73-0033
A vulnerability in the Web Speech component of Google Chrome and Microsoft Edge browser is related to reading beyond buffer boundaries. Exploitation of the vulnerability could allow a remote attacker to affect the confidentiality, integrity and availability of protected information using a...