CVE-2026-56161

Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network...

CVE-2026-59118 Copilot Cowork Elevation of Privilege Vulnerability

...

CVE-2026-59118 Copilot Cowork Elevation of Privilege Vulnerability

...

CVE-2026-59118

Improper authorization in Microsoft Power Apps allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-59118

Technical details such as affected components, root cause, and patch information are not publicly provided in the supplied documents. Monitor for updates from Microsoft and other sources.

Copilot Cowork Elevation of Privilege Vulnerability

Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network...

Azure Logic Apps Information Disclosure Vulnerability

Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network...

CVE-2026-70556

Hubzilla versions prior to 11.4 contains a cross-site request forgery vulnerability in the OAuth2 /authorize endpoint handled by Zotlabs\Module\Authorize::post that allows unauthenticated attackers to register arbitrary OAuth2 applications under an authenticated user's account by submitting a...

EUVD-2026-53869

Hubzilla 11.2.1 contains a cross-site request forgery vulnerability in the OAuth2 /authorize endpoint handled by Zotlabs\Module\Authorize::post that allows unauthenticated attackers to register arbitrary OAuth2 applications under an authenticated user's account by submitting a cross-origin POST...

CVE-2026-56161: Improper Access Control

Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network...

KLA91192 PE vulnerability in Microsoft Dynamics

Privilege escalation vulnerability was found in Microsoft Dynamics. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2026-59118 Exploitation Related products .NET Microsoft-Power-Apps-Desktop-Client CVE list CVE-2026-59118 unknown KB list Solution Install...

PT-2026-68830

Name of the Vulnerable Software and Affected Versions Microsoft Power Apps affected versions not specified Description Improper authorization in Microsoft Power Apps allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about ...

KLA91190 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of...

CVE-2026-70612

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, requests to open external protocol URLs from web content did not take iframe sandbox restrictions into account, so a sandboxed iframe could...

CVE-2026-70607

CVE-2026-70607 affects Electron: prior to 39.8.8, 40.9.0, 41.2.1, and 42.0.0-beta.3, window.open() features strings could apply untrusted window options to a new BrowserWindow if the app does not override child window options via setWindowOpenHandler or overrideBrowserWindowOptions. This could le...

GHSA-M55F-7GQJ-FR98 Electron: Extension tab APIs operate across session boundaries

Impact Extension tab and scripting APIs were not scoped to the extension's own session. A malicious or compromised extension loaded into one session could navigate, script, and read from windows belonging to a different session. Apps are only affected if they load Chrome extensions via...

@finsemble/finsemble-core (>=9.10.13-beta.1, <=9.10.28), @finsemble/finsemble-electron-adapter (>=9.10.13-beta.1, <=10.3.2-beta.1) +8 more potentially affected by CVE-2026-70601 via electron (>=41.0.3, <=41.2.0)

electron NPM version =41.0.3, =9.10.13-beta.1, =9.10.13-beta.1, =5.0.0, =1.3.0, =2.1.30, =0.1.0, =0.3.73, =1.0.5, =1.3.0 Source cves: CVE-2026-70601 Source advisory: SNYK:JS-ELECTRON-18563206...

CVE-2026-5108 Super Progressive Web Apps <= 2.2.43 - Authenticated (Administrator+) Stored Cross-Site Scripting via Offline Message Setting

The Super Progressive Web Apps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the superpwasettingsofflinemessagetxt setting in all versions up to, and including, 2.2.43. This is due to insufficient input sanitization and output escaping. The offline message value is stored...

CVE-2026-5108

The CVE concerns the WordPress plugin Super Progressive Web Apps (versions

CVE-2026-5108: Improper Neutralization of Input During Web Page Generation

The Super Progressive Web Apps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the superpwasettingsofflinemessagetxt setting in all versions up to, and including, 2.2.43. This is due to insufficient input sanitization and output escaping. The offline message value is stored...