CVE-2026-83991

CVE-2026-83991 affects the Windows Cloud Files Mini Filter Driver , where a missing authentication check on a critical function allows a locally authenticated attacker to perform tampering . The vulnerability is rated CVSS 5.5 (MEDIUM) with a local attack vector, low complexity, low privileges re...

EUVD-2026-73359

Missing authentication for critical function in Windows Cloud Files Mini Filter Driver allows an authorized attacker to perform tampering locally...

EUVD-2026-73326

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-80093

A use-after-free flaw in the Windows Cloud Files Mini Filter Driver allows an authorized local attacker to achieve privilege escalation . The vulnerability is rated CVSS 7.0 (HIGH) with a local attack vector, high complexity, and low privileges required, impacting confidentiality, integrity, and ...

EUVD-2026-73216

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-69279

CVE-2026-69279 is a use after free vulnerability in the Windows Cloud Files Mini Filter Driver that allows an authorized local attacker to elevate privileges . The CVSS 3.1 score is 7.0 (HIGH) with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, indicating a local attack with high complexity but...

Security Bulletin: Due to use of IBM WebSphere Application Server and IBM WebSphere Liberty, IBM Cloud Pak System is affected by multiple vulnerabilities

Summary Multiple vulnerabilities have been identified in IBM WebSphere Application Server and IBM WebSphere Liberty, supporting product which is shipped as pattern type with IBM Cloud Pak System. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affecte...

Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution

A previously undocumented financially motivated threat actor has been linked to attacks targeting Brazilian financial institutions since at least March 2026. Cybersecurity company CrowdStrike is tracking the Brazil-based activity cluster under the name Slim Spider. "The adversary demonstrates dee...

CVE-2026-86735

snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule that fails to detect IPv6 transition addresses encoding private IPv4 targets. Attackers with super-admin privileges can configure webhook URLs using NAT64, 6to4, or Teredo...

Directory Traversal

Spring Cloud Config is vulnerable to Directory Traversal. The vulnerability is due to improper restriction of configuration file access in the native environment repository, which allows an attacker to access configuration files outside the configured repository path...

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally...

Spring Cloud Azure Elevation of Privilege Vulnerability

Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network...

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally...

Autonomous AI Agents Compromise Thousands of Credentials in Under Six Hours

Threat actors are continuing to leverage artificial intelligence AI to streamline their operations, with one financially motivated hacking group employing an autonomous, multi-agent attack framework to carry out a large-scale credential harvesting campaign within six hours. Google Threat...

CVE-2026-73315 XenForo < 2.3.13 SSRF via PayPal REST Webhook Handler

XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme...

CVE-2026-73315

XenForo before 2.3.13 contains a Server-Side Request Forgery (SSRF) vulnerability in the PayPal REST webhook handler . Unauthenticated attackers can submit a crafted POST to the PayPal webhook callback endpoint with a certificate URL lacking scheme, hostname, or allowlist validation, causing the ...

EUVD-2026-72786

XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated attackers to cause the server to make outbound HTTP requests to arbitrary destinations by supplying a crafted certificate URL in webhook headers without scheme...

Server-Side Request Forgery (SSRF)

Spring Cloud Gateway is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to JsonToGrpcGatewayFilterFactory allowing arbitrary Spring Resource locations for the proto descriptor, which allows an attacker to access or load unintended resources from the server...

Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to a vulnerability in brace-expansion

Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to a vulnerability in brace-expansion. CVE-2026-14257 The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2026-14257 DESCRIPTION: brace-expansion through 5.0.7 is vulnerable to...

Sensitive Data Exposure

org.springframework.cloud, spring-cloud-function-adapter-aws is vulnerable to sensitive data exposure. The vulnerability is due to sensitive information being included in application logs, which allows an attacker with access to the logs to obtain potentially confidential data...