Azure Logic Apps Elevation of Privilege Vulnerability

Improper limitation of a pathname to a restricted directory 'path traversal' in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network...

Don’t Just Replace Kenna- Evolve to Vulnerability Exposure Management

Cisco has announced the end-of-sale for Cisco Vulnerability Management formerly Kenna Security, leaving security teams with a critical decision: remain on a legacy path or transform. Yes, it is true that the Kenna Security platform will be supported until June 30th, 2028 but the platform won’t be...

CVE-2026-24042 Appsmith public apps can execute unpublished actions (viewMode confusion)

Appsmith is a platform to build admin panels, internal tools, and dashboards. In versions 1.94 and below, publicly accessible apps allow unauthenticated users to execute unpublished edit-mode actions by sending viewMode=false or omitting it to POST /api/v1/actions/execute. This bypasses the...

CVE-2026-24042

Appsmith (versions 1.94 and below) exposes an unauthenticated risk where public apps can execute unpublished (edit-mode) actions by sending viewMode=false or omitting it to POST /api/v1/actions/execute. The underlying cause is viewMode handling that bypasses the publish boundary, allowing executi...

CVE-2026-24042 Appsmith public apps can execute unpublished actions (viewMode confusion)

Appsmith is a platform to build admin panels, internal tools, and dashboards. In versions 1.94 and below, publicly accessible apps allow unauthenticated users to execute unpublished edit-mode actions by sending viewMode=false or omitting it to POST /api/v1/actions/execute. This bypasses the...

CVE-2026-24042 Appsmith public apps can execute unpublished actions (viewMode confusion)

Appsmith is a platform to build admin panels, internal tools, and dashboards. In versions 1.94 and below, publicly accessible apps allow unauthenticated users to execute unpublished edit-mode actions by sending viewMode=false or omitting it to POST /api/v1/actions/execute. This bypasses the...

PT-2026-4305

Name of the Vulnerable Software and Affected Versions Azure Logic Apps affected versions not specified Description An improper limitation of a pathname to a restricted directory 'path traversal' exists in Azure Logic Apps. This allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-21227: Improper Limitation of a Pathname to a Restricted Directory

Improper limitation of a pathname to a restricted directory 'path traversal' in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network...

KLA90855 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to perform cross-site scripting attack, spoof user interface, obtain sensitive information, gain privileges. Below is a complete list of vulnerabilities: 1. A spoofing vulnerability in...

KLA90856 Multiple vulnerabilities in Microsoft Apps

Multiple vulnerabilities were found in Microsoft Apps. Malicious users can exploit these vulnerabilities to obtain sensitive information, bypass security restrictions, gain privileges. Below is a complete list of vulnerabilities: 1. An information disclosure vulnerability in Word Copilot can be...

Microsoft Azure Logic Apps path traversal vulnerability

Microsoft Azure Logic Apps is a low-code automation platform developed by the American company Microsoft. There is a path traversal vulnerability in Microsoft Azure Logic Apps, which stems from improper restrictions on path names for restricted directories. Attackers can exploit this vulnerabilit...

CVE-2026-23499: Improper Neutralization of Input During Web Page Generation

Saleor is an e-commerce platform. Starting in version 3.0.0 and prior to versions 3.20.108, 3.21.43, and 3.22.27, Saleor allowed authenticated staff users or Apps to upload arbitrary files, including malicious HTML and SVG files containing Javascript. Depending on the deployment strategy, these...

The vulnerability of Microsoft Office package applications and Microsoft 365 Apps for Enterprise, related to deficiencies in access control, allows attackers to bypass security restrictions.

The vulnerability of Microsoft Office package applications and Microsoft 365 Apps for Enterprise is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to bypass security restrictions...

The vulnerability of Microsoft Office package applications and Microsoft 365 Apps for Enterprise, related to unreliable pointer aliasing, allows attackers to execute arbitrary code.

The vulnerability of Microsoft Office package applications and Microsoft 365 Apps for Enterprise is related to an unreliable pointer assignment mechanism. Exploiting this vulnerability can allow attackers to execute arbitrary code...

The vulnerability of Microsoft Office package applications and Microsoft 365 Apps for Enterprise, related to memory usage after it is released, allows attackers to execute arbitrary code.

The vulnerability of Microsoft Office package applications and Microsoft 365 Apps for Enterprise lies in the use of memory after it is released. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

Why Secrets in JavaScript Bundles are Still Being Missed

Leaked API keys are no longer unusual, nor are the breaches that follow. So why are sensitive tokens still being so easily exposed? To find out, Intruder's research team looked at what traditional vulnerability scanners actually cover and built a new secrets detection method to address gaps in...

IBM Concert 安全漏洞

IBM Concert is a new tool from International Business Machines IBM Inc. that uses generative AI to help manage complex cloud-native applications. IBM Concert suffers from an information disclosure vulnerability that can be exploited by attackers to obtain sensitive information...

MiracleLinux 8 : dotnet5.0-5.0.203-1.el8.ML.1 (AXSA:2021-2298:06)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-2298:06 advisory. dotnet: .NET Core single-file application privilege escalation CVE-2021-31204 In order for the update to be complete, self-contained applications deployed...

MiracleLinux 8 : dotnet3.1-3.1.115-1.el8.ML.1 (AXSA:2021-2226:06)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-2226:06 advisory. dotnet: .NET Core single-file application privilege escalation CVE-2021-31204 In order for the update to be complete, self-contained applications deployed...

Malicious code in @cda-apps/source (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b5806c1f8be7708beab46a8c3d8c222da577363ce72533ed3fb40aadd28a7c2 The package @cda-apps/source was found to contain malicious code. Source: ghsa-malware 356aaa5e677bd040b40c0cec9325f05ae0c9e0e05c364bc0db6ba9837d4607...