@diligencefabric/client-sdk (>=0.0.1, <=0.0.2), @jtl-software/cloud-apps-rest-sdk (0.0.1) potentially affected by CVE-2026-49336 via @microsoft/kiota-http-fetchlibrary (1.0.0-preview.100)

@microsoft/kiota-http-fetchlibrary NPM version 1.0.0-preview.100 is affected by a known vulnerability. The following packages have a transitive dependency on @microsoft/kiota-http-fetchlibrary and may be impacted: - @diligencefabric/client-sdk =0.0.1, =0.0.2 - @jtl-software/cloud-apps-rest-sdk...

@diligencefabric/client-sdk (>=0.0.1, <=0.0.2), @jtl-software/cloud-apps-rest-sdk (0.0.1) potentially affected by CVE-2026-49336 via @microsoft/kiota-http-fetchlibrary (1.0.0-preview.100)

@microsoft/kiota-http-fetchlibrary NPM version 1.0.0-preview.100 is affected by a known vulnerability. The following packages have a transitive dependency on @microsoft/kiota-http-fetchlibrary and may be impacted: - @diligencefabric/client-sdk =0.0.1, =0.0.2 - @jtl-software/cloud-apps-rest-sdk...

@diligencefabric/client-sdk (>=0.0.1, <=0.0.2), @jtl-software/cloud-apps-rest-sdk (0.0.1) potentially affected by CVE-2026-49336 via @microsoft/kiota-http-fetchlibrary (1.0.0-preview.100)

@microsoft/kiota-http-fetchlibrary NPM version 1.0.0-preview.100 is affected by a known vulnerability. The following packages have a transitive dependency on @microsoft/kiota-http-fetchlibrary and may be impacted: - @diligencefabric/client-sdk =0.0.1, =0.0.2 - @jtl-software/cloud-apps-rest-sdk...

@diligencefabric/client-sdk (>=0.0.1, <=0.0.2), @jtl-software/cloud-apps-rest-sdk (0.0.1) potentially affected by CVE-2026-49336 via @microsoft/kiota-http-fetchlibrary (1.0.0-preview.100)

@microsoft/kiota-http-fetchlibrary NPM version 1.0.0-preview.100 is affected by a known vulnerability. The following packages have a transitive dependency on @microsoft/kiota-http-fetchlibrary and may be impacted: - @diligencefabric/client-sdk =0.0.1, =0.0.2 - @jtl-software/cloud-apps-rest-sdk...

Where Multi-Factor Authentication Stops and Credential Abuse Starts

Organizations typically roll out multi-factor authentication MFA and assume stolen passwords are no longer enough to access systems. In Windows environments, that assumption is often wrong. Attackers still compromise networks every day using valid credentials. The issue is not MFA itself, but...

EUVD-2025-1774

Malicious code in bioql PyPI...

Securing Data in the AI Era

The 2025 Data Risk Report: Enterprises face potentially serious data loss risks from AI-fueled tools. Adopting a unified, AI-driven approach to data security can help. As businesses increasingly rely on cloud-driven platforms and AI-powered tools to accelerate digital transformation, the stakes f...

CVE-2025-0578

A vulnerability was found in Facile Sistemas Cloud Apps up to 20250107. It has been classified as problematic. Affected is an unknown function of the file /account/forgotpassword of the component Password Reset Handler. The manipulation of the argument reterros leads to cross site scripting. It i...

CVE-2025-0578

A vulnerability was found in Facile Sistemas Cloud Apps up to 20250107. It has been classified as problematic. Affected is an unknown function of the file /account/forgotpassword of the component Password Reset Handler. The manipulation of the argument reterros leads to cross site scripting. It i...

CVE-2025-0578 Facile Sistemas Cloud Apps Password Reset forgotpassword cross site scripting

A vulnerability was found in Facile Sistemas Cloud Apps up to 20250107. It has been classified as problematic. Affected is an unknown function of the file /account/forgotpassword of the component Password Reset Handler. The manipulation of the argument reterros leads to cross site scripting. It i...

CVE-2025-0578 Facile Sistemas Cloud Apps Password Reset forgotpassword cross site scripting

A vulnerability was found in Facile Sistemas Cloud Apps up to 20250107. It has been classified as problematic. Affected is an unknown function of the file /account/forgotpassword of the component Password Reset Handler. The manipulation of the argument reterros leads to cross site scripting. It i...

CVE-2025-0578

CVE-2025-0578 affects Facile Sistemas Cloud Apps (up to 20250107), specifically the Password Reset Handler’s /account/forgotpassword function. The issue is a cross-site scripting vulnerability caused by manipulating the reterros parameter, allowing remote exploitation. Public exploits have been d...

Easy Cloud App Systems: Code Injection Vulnerabilities

Facile Sistemas Cloud Apps is an application from Facile Sistemas. A code injection vulnerability exists in Facile Sistemas Cloud Apps 20250107 and earlier versions, which stems from the parameter retros in the file /account/forgotpassword can lead to cross-site scripting...

CVE-2025-0578: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in Facile Sistemas Cloud Apps up to 20250107. It has been classified as problematic. Affected is an unknown function of the file /account/forgotpassword of the component Password Reset Handler. The manipulation of the argument reterros leads to cross site scripting. It i...

Karmada security vulnerabilities

Karmada is a Kubernete management system open-sourced by Karmada. A security vulnerability exists in Karmada versions prior to 1.12.0 that stems from allowing users to run cloud-native applications across multiple Kubernetes clusters and clouds...

How Attackers Can Own a Business Without Touching the Endpoint

Attackers are increasingly making use of "networkless" attack techniques targeting cloud apps and identities. Here's how attackers can and are compromising organizations – without ever needing to touch the endpoint or conventional networked systems and services. Before getting into the details of...

Threat actors misuse OAuth applications to automate financially driven attacks

Threat actors are misusing OAuth applications as an automation tool in financially motivated attacks. OAuth is an open standard for token-based authentication and authorization that enables applications to get access to data and resources based on permissions set by a user. Threat actors compromi...

How to leverage generative AI in cloud apps without putting user data at risk

Learn security best practices to deploy generative AI models as part of your multi-tenant cloud applications and avoid putting your customers’ data at risk...

Argo CD Security Bug Opens Kubernetes Cloud Apps to Attackers

A high-severity security vulnerability in Argo CD can enable attackers to access targets’ application-development environments, paving the way for stealing passwords, API keys, tokens and other sensitive information. Argo CD is a continuous-delivery platform deployed as a Kubernetes controller in...

Protect your business with Microsoft Security’s comprehensive protection

Securing an organization has never been simple. But over the past year, we’ve seen significant changes in the threat landscape that are having a major impact on organizations of every size in every sector. The frequency and sophistication of cyber events have increased significantly. We see...