CVE-2026-59115

'.../...//' in Microsoft Entra Provisioning Service SyncFabric allows an authorized attacker to elevate privileges over a network...

CVE-2026-56162

Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-63508

Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-56162

Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-65667

Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-56161

Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network...

CVE-2026-49163

Improper limitation of a pathname to a restricted directory 'path traversal' in Application Insights Profiler allows an authorized attacker to elevate privileges over a network...

CVE-2026-50481

Modification of assumed-immutable data maid in Azure Active Directory allows an authorized attacker to elevate privileges over a network...

CVE-2026-62896

Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network...

CVE-2026-62857 Fedify: Server-Side Request Forgery in getNodeInfo() Allows Access to Internal Network Resources

Fedify is a TypeScript library for building federated server apps powered by ActivityPub. From version 1.2.0 through the affected 1.9, 1.10, 2.0, 2.1, 2.2, and 2.3 maintenance lines, getNodeInfo follows an attacker-controlled links.href value from /.well-known/nodeinfo without scheme, redirect, o...

Copilot Cowork Elevation of Privilege Vulnerability

Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network...

Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability

Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network...

Microsoft Teams Elevation of Privilege Vulnerability

Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network...

Azure Confidential Ledger Remote Code Execution Vulnerability

Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network...

Microsoft 365 Admin Center Elevation of Privilege Vulnerability

Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network...

Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability

'.../...//' in Microsoft Entra Provisioning Service SyncFabric allows an authorized attacker to elevate privileges over a network...

Azure SQL Managed Instance Elevation of Privilege Vulnerability

Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network...

MAL-2026-13424 Malicious code in tailwindcss-hide-scrollbar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac906893a6ea1562025bfa35bf4f1998cfd745619f21c4dc3880aa386dc3cfe1 dist/index.js exports a small tailwind scrollbar-hide plugin followed by a trailing evalatob'' that executes on every require/import of the package...

Malicious code in tailwindcss-hide-scrollbar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac906893a6ea1562025bfa35bf4f1998cfd745619f21c4dc3880aa386dc3cfe1 dist/index.js exports a small tailwind scrollbar-hide plugin followed by a trailing evalatob'' that executes on every require/import of the package...

CVE-2026-9196

IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation due to improper handling of LLM‑generated components. The application executes model‑generated Python code in the backend during validation prior to user...