760 matches found
EUVD-2026-82591
Improper neutralization of special elements in output used by a downstream component 'injection' in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network...
CVE-2026-87701
Improper neutralization of special elements in output used by a downstream component 'injection' in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network...
CVE-2026-87701
Azure Cosmos DB is affected by an injection vulnerability (improper neutralization of special elements in output used by a downstream component) that allows an authorized attacker to elevate privileges over a network . The CVSS 3.1 score is 9.6 (CRITICAL) , with a vector of AV:N/AC:L/PR:L/UI:N/S:...
Azure Cosmos DB Elevation of Privilege Vulnerability
Improper neutralization of special elements in output used by a downstream component 'injection' in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network...
CVE-2026-49446 Cosmos: Authentication bypass via forward-auth header smuggling on Constellation tunnel in Cosmos-Server
Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. Prior to 0.22.19, tokenMiddleware in src/proxy/routerGen.go can return through the Constellation tunnel bypass before removing x-cosmos-user, x-cosmos-role,...
Azure Cosmos DB Spoofing Vulnerability
Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network...
EUVD-2026-70796
Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network...
CVE-2026-69857
Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network...
CVE-2026-69857 Azure Cosmos DB Spoofing Vulnerability
...
CVE-2026-69857
Azure Cosmos DB is affected by an authorization bypass through user-controlled key , allowing an authorized attacker to perform spoofing over a network. The vulnerability is rated CVSS 3.1: 8.5 (HIGH) with a vector of CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating a changed scope and hi...
CVE-2026-69857 Azure Cosmos DB Spoofing Vulnerability
...
KLA91257 Multiple vulnerabilities in Microsoft Azure
Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to bypass security restrictions, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An information disclosure vulnerability i...
PT-2026-85310
🚨 HIGH: CVE-2026-69857 CVSS 8.5 - Authorization bypass in Azure Cosmos DB allows authenticated attackers to perform spoofing over network. Patch immediately. CVE Vulnerability PatchNow ThreatIntel DFIR https://t.co/jpe1VOsLLc...
GHSA-7G4W-CG88-2CQ2
creationtimestamp| type| source ---|---|--- 2026-08-28 20:59:24+00:00| seen| https://bsky.app/profile/newssecia.bsky.social/post/3mu6ax42wfx2g 2026-08-28 22:00:41+00:00| seen| https://thehackernews.com/2026/08/cosmos-evm-flaw-exploited-after-cosmos.html 2026-08-29 01:00:36+00:00| seen|...
MAL-2026-14305 Malicious code in mc-provider (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e494af2871662b1b342a26141de010623484dfef353b505805f4b41d85d775c1 Package metadata describes mc-provider as 'Theta chain registry ⚛️' and the README is a verbatim copy of the hyperweb-io/chain-registry README...
Malicious code in mc-provider (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e494af2871662b1b342a26141de010623484dfef353b505805f4b41d85d775c1 Package metadata describes mc-provider as 'Theta chain registry ⚛️' and the README is a verbatim copy of the hyperweb-io/chain-registry README...
GO-2026-6123 Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel in github.com/azukaar/cosmos-server
Cosmos-Server has an authentication bypass via forward-auth header smuggling on Constellation tunnel in github.com/azukaar/cosmos-server...
CVE-2026-66803
Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network...
