CVE-2026-50401: Out-of-bounds Read

Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally...

CVE-2026-9292: Improper Neutralization of Input During Web Page Generation

A Stored Cross-Site Scripting security issue exists within FactoryTalk® DataMosaix™ Private Cloud. The vulnerability stems from improper neutralization of user-supplied input within the Workflows configuration. An authenticated attacker with high privileges can inject malicious scripts that are...

Adobe Creative Cloud < 6.10.0.252.3 Multiple Privilege escalation (APSB26-77)

The version of Adobe Creative Cloud installed on the remote Windows host is prior to 6.10.0.252.3. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-77 advisory. - Creative Cloud Desktop is affected by a Time-of-check Time-of-use TOCTOU Race Condition vulnerabilit...

CVE-2026-58613: Use After Free

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally...

CVE-2026-44761: Use of Default Credentials

SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token...

PT-2026-58084

A Stored Cross-Site Scripting security issue exists within FactoryTalk® DataMosaix™ Private Cloud. The vulnerability stems from improper neutralization of user-supplied input within the Workflows configuration. An authenticated attacker with high privileges can inject malicious scripts that are...

PT-2026-58649

Name of the Vulnerable Software and Affected Versions Windows Cloud Files Mini Filter Driver affected versions not specified Description A use-after-free condition in the Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. Use-after-free is a memory...

PT-2026-58356

Name of the Vulnerable Software and Affected Versions Windows Cloud Files Mini Filter Driver affected versions not specified Description A use-after-free condition exists in the Windows Cloud Files Mini Filter Driver. This issue allows an authorized attacker to elevate privileges on the system...

PT-2026-58380

Name of the Vulnerable Software and Affected Versions Windows Cloud Files Mini Filter Driver affected versions not specified Description An out-of-bounds read in the Windows Cloud Files Mini Filter Driver allows an authorized attacker to disclose information locally. An out-of-bounds read occurs...

PT-2026-58781

Name of the Vulnerable Software and Affected Versions Creative Cloud Desktop affected versions not specified Description An Uncontrolled Search Path Element issue exists in the AdobeUpdateService. This flaw could allow an attacker to achieve local privilege escalation and execute arbitrary code...

PT-2026-58967

Summary Anyquery's server mode does not restrict outbound HTTP requests initiated by its built-in SQLite virtual table modules e.g., json reader, log reader. Unauthenticated attackers connecting to the MySQL-compatible server port can create virtual tables pointing to internal network endpoints o...

On the Security Implications of PQC in TLS: Handshake Exhaustion and IDS Degradation

Post-Quantum Cryptography PQC is increasingly being integrated into TLS 1.3 to enhance resilience against quantum-enabled attacks. However, the additional computational and communication overhead introduced by PQC primitives during the handshake phase may also amplify the impact of TLS handshake...

PT-2026-58108

Name of the Vulnerable Software and Affected Versions Nexus Repository 3 affected versions not specified Description Nexus Repository 3 fails to apply Server-Side Request Forgery SSRF protections to HTTP redirect targets returned by proxy repository upstream servers. SSRF is a flaw that allows an...

PT-2026-58790

Name of the Vulnerable Software and Affected Versions Creative Cloud Desktop affected versions not specified Description A Time-of-check Time-of-use TOCTOU Race Condition exists, which is a software bug where a program checks the state of a resource and then acts on that resource, but the state...

PT-2026-60062

Name of the Vulnerable Software and Affected Versions OpenCost affected versions not specified Description OpenCost contains an unauthenticated file write issue in the POST /serviceKey endpoint. The AddServiceKey function in pkg/costmodel/router.go accepts user-supplied data via the key parameter...

CVE-2026-48344: Time-of-check Time-of-use (TOCTOU) Race Condition

Creative Cloud Desktop is affected by a Time-of-check Time-of-use TOCTOU Race Condition vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user...

CVE-2026-58536: Use After Free

Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally...

APSB26-77 : Security update available for Adobe Creative Cloud Desktop Application

Adobe has released an update for the Creative Cloud Desktop for Windows. This update includes a fix for critical vulnerabilities that could lead to arbitrary code execution in the context of the current user. Adobe is not aware of any exploits in the wild for any of the issues addressed in these...

Defending SaaS-based applications against ShinyHunters OAuth abuse

In this article 1. Attack chain overview 2. Improving visibility into Salesforce OAuth abuse 3. Mitigation and protection guidance 4. Learn more In a series of campaigns observed between mid-2025 and mid-2026, Microsoft identified threat actor activity with overlapping tradecraft commonly...

CVE-2026-62242 Spring Boot Admin Server < 4.1.2 SSRF via Unauthenticated Instance Registration

Spring Boot Admin Server before 4.1.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to register instances with attacker-controlled healthUrl and managementUrl parameters without validation against private IP ranges or metadata endpoints. Attackers can...