CVE-2026-42316

kafka-sink-azure-kusto Kafka Connect plugin is the official Microsoft sink for Azure Data Explorer Kusto. Prior to 5.2.3, kafka-sink-azure-kusto did not sanitize user-controlled values inside the kusto.tables.topics.mapping configuration. The db, table, mapping, and format fields of each mapping...

CVE-2026-41574

Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.49.1, Nhost automatically links an incoming OAuth identity to an existing Nhost account when the email addresses match. This is only safe when the email has been verified by the OAuth provider. Nhost's controller trusts...

CVE-2026-42602

azureauthextension is the Azure Authenticator Extension. From 0.124.0 to 0.150.0, a server-side authentication bypass in azureauthextension allows any party who holds a single valid Azure access token for any scope the collector's configured identity can mint for to authenticate to any...

PCPJack Hijacks 230 AWS, Google Cloud, and Azure Servers for Covert SMTP Relay Network

The threat actor known as PCPJack has hijacked cloud servers associated with Amazon Web Services AWS, Google Cloud, and Microsoft Azure to create a covert SMTP email relay network. "Compromised business servers across the U.S., Europe, and Asia were quietly converted into SMTP proxies, verified f...

EUVD-2026-34333

Authentication bypass by spoofing in Azure HorizonDB allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-48567

Authentication bypass by spoofing in Azure HorizonDB allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-48567 Azure HorizonDB Elevation of Privilege Vulnerability

...

CVE-2026-48567 Azure HorizonDB Elevation of Privilege Vulnerability

...

CVE-2026-48567

Authentication bypass by spoofing in Azure HorizonDB allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-48567

CVE-2026-48567 : Azure HorizonDB suffers an authentication bypass by spoofing, enabling a network-based attacker with no privileges and no user interaction to achieve privilege escalation. CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H with a base score of 10.0 (CRITICAL). Explo...

PT-2026-46405

Name of the Vulnerable Software and Affected Versions Azure HorizonDB affected versions not specified Description An authentication bypass via spoofing allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a newer versio...

Microsoft Azure Horizondb 授权问题漏洞

Microsoft Azure HorizonDB is a cloud-native PostgreSQL database service provided by Microsoft Corporation. There is a security vulnerability in Microsoft Azure HorizonDB, which stems from bypassing authentication through deception. This could allow unauthorized attackers to escalate their...

The vulnerability of the cloud-based platform for managing and protecting Microsoft Entra ID (formerly Azure Active Directory) relates to deficiencies in the data source verification mechanism, allowing attackers to escalate their privileges.

The vulnerability of the cloud-based platform for managing and protecting Microsoft Entra ID formerly Azure Active Directory is related to deficiencies in the data source verification mechanism. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...

The vulnerability of the Azure Resource Manager service and the software platform of Microsoft Azure allows attackers to escalate their privileges.

The vulnerability of the Azure Resource Manager service, a software platform of Microsoft Azure, relates to the bypassing of authentication using an alternative name. Exploiting this vulnerability can allow a malicious actor to gain increased privileges...

The vulnerability of the Azure Orbital Spatio deployment and management service, a software platform of Microsoft Azure, allows a attacker to execute arbitrary code.

The vulnerability of the Azure Orbital Spatio deployment and management service of the Microsoft Azure software platform is related to the unlimited loading of dangerous files. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

The vulnerability of the compatibility package for Microsoft Azure Entra ID lies in the insecure management of privileges, allowing a perpetrator to escalate their privileges.

The vulnerability of the compatibility package for Microsoft Azure Entra ID is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...

The vulnerability in the access and identity management service of the Microsoft Azure Active Directory B2C package allows a perpetrator to escalate their privileges.

The vulnerability of the Microsoft Azure Active Directory B2C access and identity management service relates to bypassing the authentication process by using an alternative path or channel. Exploiting this vulnerability can allow a malicious actor to gain elevated privileges...

The vulnerability of Azure cloud services for managing geospatial data by Microsoft Planetary Computer Pro, related to deserialization mechanism flaws, allows attackers to disclose protected information.

The vulnerability of Azure cloud services for managing geospatial data with the Microsoft Planetary Computer Pro is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow a malicious actor to disclose protected information...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...