CVE-2026-65812

Microsoft Teams for Android is affected by an information disclosure vulnerability caused by the insertion of sensitive information into sent data, allowing an authorized attacker to disclose information over a network. The CVSS 3.1 score is 6.8 (Medium) , with a network attack vector, low comple...

CVE-2026-69904

A server-side request forgery (SSRF) vulnerability in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. The flaw requires user interaction and low privileges (CVSS 3.1: 3.5 – LOW ). CISA's SSVC assessment indicates no known exploitation , the vulner...

CVE-2026-69297

CVE-2026-69297 affects Windows DHCP Server , where passwords are stored in a recoverable format, allowing an authorized attacker (with low privileges) to disclose information over a network. The CVSS v3.1 score is 6.5 (MEDIUM) with high confidentiality impact and no integrity or availability impa...

CVE-2026-70019

CVE-2026-70019 is an information disclosure vulnerability in Windows Compressed Folder caused by a hard link mechanism that allows an unauthorized attacker to disclose information over a network. The vulnerability requires user interaction and no prior privileges (CVSS 3.1: 6.5 MEDIUM , C:H). CIS...

CVE-2026-77909

CVE-2026-77909 affects Azure CycleCloud , where insufficiently protected credentials allow an authorized attacker to disclose information over a network . The vulnerability is rated CVSS 3.1 7.7 (HIGH) with a scope change and high confidentiality impact (vector: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:...

EUVD-2026-73090

Exposure of sensitive system information to an unauthorized control sphere in Windows Services for NFS ONCRPC XDR Driver allows an unauthorized attacker to disclose information over a network...

CVE-2026-71330

CVE-2026-71330 is an information disclosure vulnerability in Windows Services for NFS ONCRPC XDR Driver . An unauthorized network-based attacker with no privileges can expose sensitive system information over the network, resulting in a High confidentiality impact (CVSS 3.1: 7.5 ). CISA's SSVC as...

EUVD-2026-73045

Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information over a network...

Microsoft Office SharePoint Information Disclosure Vulnerability

Improper neutralization of special elements used in an sql command 'sql injection' in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

Microsoft Office PowerPoint Information Disclosure Vulnerability

Access of resource using incompatible type 'type confusion' in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network...

CVE-2026-23744

CVE-2026-23744 CVE-2026-23744 RCE Mientras analizaba esta vulnerabilidad, descubrí que MCPJam Inspector exponía el endpoint /api/mcp/connect a la red vinculándose a 0.0.0.0. Este endpoint acepta un objeto JSON que contiene serverConfig, incluidos los campos command y args. La aplicación tenía la...

EUVD-2026-72561

knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password required on fresh installations. Attackers can access the unauthenticated /api/tunnel/start endpoint to provision a public tunnel and republish the API at a publicl...

Linux Distros Unpatched Vulnerability : CVE-2026-78123

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS7 parsing in the openssl plugin. CVE-2026-78123 Note that Nessus relies on the presence...

CVE-2026-86121

Cua computer-server versions before 0.3.42 skip authentication when the CONTAINERNAME environment variable is unset and bind to all interfaces by default, allowing unauthenticated attackers to execute arbitrary commands. Attackers can reach TCP port 8000 to run shell commands via the runcommand...

UBUNTU-CVE-2026-75538

An attacker that connects to an open Erlang TCP port that uses the ine...

CVE-2026-82456 argocd-mcp 0.8.0 Authentication Bypass via Unauthenticated HTTP

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCDAPITOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications,...

PT-2026-83435

Name of the Vulnerable Software and Affected Versions argocd-mcp version 0.8.0 Description The software binds its HTTP transport to every network interface 0.0.0.0 and accepts MCP sessions without requiring caller credentials when the ARGOCD API TOKEN variable is configured. This allows a...

EUVD-2026-66846

Spring Security's embedded UnboundID LDAP server UnboundIdContainer unconditionally registers an administrative credential and binds its listener to all available network interfaces. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18...

PT-2026-82413

Name of the Vulnerable Software and Affected Versions Spring Security version 7.1.0 Spring Security versions 7.0.0 through 7.0.6 Spring Security versions 6.5.0 through 6.5.11 Spring Security versions 6.4.0 through 6.4.18 Spring Security versions 5.8.0 through 5.8.27 Spring Security versions 5.7.0...

Binding to an Unrestricted IP Address

Overview Affected versions of this package are vulnerable to Binding to an Unrestricted IP Address through the ForwardPorts path in pkg/cmd/codespace/ports.go. An attacker can reach a forwarded Codespaces service from other hosts on the victim’s network by having the user run gh codespace ports...