CVE-2026-35425 Azure API Management (APIM) Remote Code Execution Vulnerability

...

PT-2026-64444

Summary The GHSA-6c99-87fr-6q7r fix wrapped WebAuthn authenticator deserialization in an ObjectInputFilter meant to allow only AuthenticatorImpl, but it short-circuits to ALLOWED for any object at stream depth 1. Because the Java serialization filter is consulted for every class in the graph and...

Apache Syncope permissions and access control vulnerabilities (CNVD-2026-30665)

Apache Syncope is an open-source digital identity management system, primarily used for authentication, authorization, and account management. There are security vulnerabilities in Apache Syncope. These vulnerabilities stem from insufficient protection of the Groovy security sandbox, which leads ...

KLA91173 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to bypass security restrictions, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. A spoofing vulnerability in Microsoft Edge Chromium-base...

ROS-20260724-73-0025

The vulnerability in dotnet10.0 is related to type mixing errors. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20260724-73-0046

The vulnerability in ImageMagick 7 is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20260724-73-0027

The vulnerability in dotnet10.0 is related to insufficient verification of data authenticity. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20260724-73-0044

The vulnerability in ImageMagick7 is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the console-based graphic editor ImageMagick lies in the overflow of buffers in dynamic memory, allowing an attacker to execute arbitrary code.

The vulnerability of the console-based graphic editor ImageMagick is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-64451

Name of the Vulnerable Software and Affected Versions Redis versions prior to 8.8.0 Description A double free error occurs when an authenticated attacker executes the RESTORE command. This happens when a RESTORE payload references the same NACK pending entry across multiple consumers, and both...

Apache Syncope permissions and access control vulnerabilities (CNVD-2026-30660)

Apache Syncope is an open-source identity management platform, primarily used for user authentication, authorization, and account management in enterprise environments. There are security vulnerabilities in Apache Syncope. These vulnerabilities stem from a bypass of the Groovy security sandbox...

PT-2026-64267

A critical architectural breakdown targeting enterprise secret storage engines has been disclosed over the last 24 hours. A severe Zero-Day flaw dubbed "VaultSmuggle" tracked as CVE-2026-93401, CVSS 9.8 has been publicly revealed, heavily impacting HashiCorp Vault and OpenBao core clusters. When...

ROS-20260724-73-0028

The vulnerability in dotnet10.0 is related to buffer overflow in the stack. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20260724-73-0045

The vulnerability in ImageMagick is related to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-64203

Name of the Vulnerable Software and Affected Versions Microsoft M365 Copilot affected versions not specified Description Deserialization of untrusted data allows an authorized attacker to execute code over a network. Deserialization is the process of converting a data stream back into an object,...

CVE-2026-54120 Microsoft Surface Remote Code Execution Vulnerability

...

CVE-2026-56165

CVE-2026-56165: Heap-based buffer overflow in Microsoft Account enables remote code execution over a network. Affected: Microsoft Account service. Root cause: heap-based overflow (details not provided). Impact: high (confidentiality, integrity, availability). CVSS v3.1 base score 9.8 (CRITICAL); ...

CVE-2026-54120 Microsoft Surface Remote Code Execution Vulnerability

...

CVE-2026-56165

Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network...

CVE-2026-54120

Technical details for CVE-2026-54120 are not publicly available in the provided documents. The materials only reiterate the description of improper input validation in Microsoft Surface. Monitor for updates from vendors for affected products and patches.