PT-2026-68833

Name of the Vulnerable Software and Affected Versions Microsoft 365 Admin Center affected versions not specified Description Improper verification of cryptographic signatures in the Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network. Recommendations At...

KLA91190 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of...

CVE-2026-48085: Missing Authorization

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to /setup/create-admin-account and creates additional GLOBALADMIN accounts without...

CVE-2026-48081: Improper Neutralization of Input During Web Page Generation

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANTADMIN can store javascript: URLs in the tenant links configuration website, imprint, privacyStatement. These values are returned to the patient-facing landin...

CVE-2026-66662: Incorrect Privilege Assignment

Unauthenticated Privilege Escalation in Frontend Admin by DynamiApps = 3.29.10 versions...

CVE-2026-1728: Improper Privilege Management

Tokens issued to a low-privileged user are not sufficiently restricted, allowing them to be used to access product-level Admin REST APIs. Exploitation of this vulnerability allows a low-privileged user to invoke the Admin REST APIs of WSO2 products, potentially leading to full administrative...

CVE-2026-62873: Improper Verification of Cryptographic Signature

Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network...

PT-2026-68748

Name of the Vulnerable Software and Affected Versions OpenReception versions prior to 1.0.2 Description A privilege escalation exists where a user with TENANT ADMIN permissions can promote themselves or another collaborator to a platform-wide GLOBAL ADMIN via a single PUT request. The role-update...

PT-2026-68578

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.29.11 Description An issue allows unauthenticated users to perform privilege escalation within the software. Recommendations Update to a version newer than 3.29.10...

PT-2026-68762

Name of the Vulnerable Software and Affected Versions sysPass affected versions not specified Description The doBackupFiles function in FileBackupService.php constructs a tar shell command by concatenating the backup directory path this-path directly into the command line without using...

CVE-2026-63725: Improper Neutralization of Special Elements used in an OS Command

sysPass's FileBackupService::doBackupFiles in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this-path directly into the command line 'tar czf ' . $backupFileApp . ' ' . BASEPATH . ' --exclude "'...

CVE-2026-66470: Missing Authorization

Subscriber Broken Access Control in Frontend Admin by DynamiApps = 3.29.10 versions...

PT-2026-68577

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.29.11 Description Broken access control exists within the subscriber role, allowing unauthorized access or actions within the administrative interface. Recommendations Update to a version newer...

CVE-2026-70443

Jenkins Horreum Plugin 0.16.162.v33b4aab5f828 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure permission to have Jenkins send credentials they are not entitled to use to the administrator-configured Horreum URL...

CVE-2026-70430

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not restrict the types of objects that can be instantiated as part of the project naming strategy configuration, allowing attackers with Overall/Manage permission to instantiate arbitrary types related to configuration, including those...

Malicious code in @astralcore/sl-aura (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91ae2c72e5e03d23f3f5704859e8c92b9ce6c565c6d14d744d4382b980a0d233 This WhatsApp bot package ships several mechanisms that give the author persistent remote control of any installer's running instance and access to t...

MAL-2026-13355 Malicious code in @astralcore/sl-aura (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91ae2c72e5e03d23f3f5704859e8c92b9ce6c565c6d14d744d4382b980a0d233 This WhatsApp bot package ships several mechanisms that give the author persistent remote control of any installer's running instance and access to t...

EUVD-2026-53466

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with Admin privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root. This vulnerability is due to improper...

CVE-2026-20288 Cisco IMC Remote Code Execution Vulnerability Remote Code Execution Vulnerability

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with Admin privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root. This vulnerability is due to improper...

CVE-2026-20288 Cisco IMC Remote Code Execution Vulnerability Remote Code Execution Vulnerability

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with Admin privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root. This vulnerability is due to improper...