CVE-2026-69543

Server-side request forgery ssrf in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network...

CVE-2026-69555

Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-69558

Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network...

CVE-2026-69851

Server-side request forgery ssrf in Azure Active Directory allows an authorized attacker to elevate privileges over a network...

CVE-2026-68782

Improper neutralization of special elements used in an sql command 'sql injection' in Azure SQL Database allows an authorized attacker to elevate privileges over a network...

CVE-2026-68789

Improper neutralization of special elements used in an sql command 'sql injection' in Azure SQL Database allows an authorized attacker to elevate privileges over a network...

CVE-2026-66309

Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network...

CVE-2026-65816

Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-69555

Azure Arc is affected by an incorrect authorization flaw that allows an unauthenticated, remote attacker to elevate privileges over the network. The vulnerability is rated CVSS 3.1: 10.0 (CRITICAL) with a vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, indicating high confidentiality and integrity...

CVE-2026-68782

An SQL injection flaw in Azure SQL Database allows an authenticated, low-privilege network attacker to elevate privileges, with CVSS 9.9 (Critical) reflecting full confidentiality, integrity, and availability impact. Microsoft's update guide is the primary remediation reference; no patch version ...

CVE-2026-66309

CVE-2026-66309 is a Critical (CVSS 9.1) elevation-of-privilege flaw in Azure SQL Database; an authenticated, high-privilege attacker can escalate privileges over the network, affecting confidentiality, integrity, and availability. No affected versions, root cause, or patch details are provided in...

CVE-2026-63509

A critical (CVSS 9.9) relative path traversal vulnerability in Microsoft Fabric allows an authenticated, low-privileged attacker over the network to elevate privileges, impacting confidentiality, integrity, and availability. No affected versions, exploit details, or patch information are provided...

CVE-2026-70105

CVE-2026-70105 is an information disclosure vulnerability in Microsoft Office Word caused by improper input validation, allowing an unauthorized attacker to disclose sensitive information over a network. Microsoft rates it 6.5 (MEDIUM) with user interaction required; NVD rates it 7.5 (HIGH) with ...

CVE-2026-69519

Azure Stack HCI has an observable response discrepancy vulnerability allowing an unauthenticated remote attacker to disclose sensitive information over the network. CVSS 3.1 scores it HIGH (8.6) with network attack vector and no privileges required. No patch version or exploitation details are pr...

EUVD-2026-63655

A single crafted SSH message gives an unauthenticated network attacker an out-of-bounds stack write of attacker-controlled length and content against any application built on swift-nio-ssh. This vulnerability is addressed in swift-nio-ssh version 0.14.1...

CVE-2026-64783

A flaw was found in WebKitGTK. Processing malicious web content can cause a use-after-free issue due to improper memory management and result in an unexpected process crash. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packag...

CVE-2026-73253

Mongoose is an embedded web server and network library. Prior to version 7.22, an on-path network attacker with a wildcard certificate for a parent domain can impersonate deeper subdomains to a client using the built-in TLS stack. The mgtlsverifycertsan and mgtlsverifycertcn functions in...

CVE-2026-55642 dbx: Unauthenticated arbitrary SQL execution in dbx-web (authentication fails open when no password is configured)

dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web authmiddleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when passwordhash is None. A fresh deployment reaches that state when DBXPASSWORD is unset and no stored password exists...

CVE-2026-55642

In dbx-web before 0.5.51, auth_middleware in crates/dbx-web/src/auth.rs bypasses authentication when password_hash is None, which occurs on fresh deployments with DBX_PASSWORD unset. The service binds to 0.0.0.0:4224 by default, allowing unauthenticated attackers to call /api/connection/connect a...

EUVD-2026-63429

Sony XAV-9500ES AVRCPBrResponseParser Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. An attacker must first obtain the ability to pair a malicious...