EUVD-2026-38090

Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network...

CVE-2026-48582 Microsoft Exchange Online Elevation of Privilege Vulnerability

...

CVE-2026-48582

This CVE affects Microsoft Exchange Online. Missing authorization could allow an attacker with low privileges and network access (no user interaction) to elevate privileges (impact: high confidentiality and integrity, no availability impact) per CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N, base...

CVE-2026-46461

creationtimestamp| type| source ---|---|--- 2026-06-19 09:21:15+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116776034117890499 2026-06-19 12:09:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3moncobmhm42g 2026-06-20 09:12:55+00:00| seen|...

CVE-2026-32208

creationtimestamp| type| source ---|---|--- 2026-06-19 06:12:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116775290939154479 2026-06-19 22:22:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mooex7rpsr2e 2026-06-20 12:11:59+00:00| seen|...

CVE-2026-49252

creationtimestamp| type| source ---|---|--- 2026-06-19 03:00:31+00:00| seen| https://infosec.exchange/users/offseq/statuses/116774537156468830 2026-06-19 03:00:33+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3momdzivs6c26 2026-06-19 09:01:31+00:00| seen|...

SUSE CVE-2026-55199

libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSHMSGEXTINFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can s...

PT-2026-51033

Name of the Vulnerable Software and Affected Versions Microsoft Exchange Online affected versions not specified Description Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network. There have been reports of elevated activities targeti...

CVE-2026-47647

creationtimestamp| type| source ---|---|--- 2026-06-18 23:00:25+00:00| seen| https://infosec.exchange/users/offseq/statuses/116773592895899835 2026-06-18 23:00:25+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3molwm435hu2l 2026-06-19 01:30:08+00:00| seen|...

CVE-2026-49257

creationtimestamp| type| source ---|---|--- 2026-06-18 21:30:16+00:00| seen| https://infosec.exchange/users/offseq/statuses/116773238347097877 2026-06-18 21:30:40+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3molrkuu26z27 2026-06-18 22:03:44+00:00| seen|...

CVE-2026-54103

creationtimestamp| type| source ---|---|--- 2026-06-18 17:00:14+00:00| seen| https://infosec.exchange/users/offseq/statuses/116772176604613913 2026-06-18 17:00:14+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3molci2fbib2u 2026-06-18 17:52:23+00:00| seen|...

Microsoft Exchange Online Elevation of Privilege Vulnerability

Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network...

Incorrect Authorization

Overview github.com/zitadel/zitadel/internal/api/oidc is a package for identity infrastructure Affected versions of this package are vulnerable to Incorrect Authorization in the CodeExchange and RefreshToken processes. An attacker can gain unauthorized access to user accounts or maintain persiste...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the CodeExchange and RefreshToken processes. An attacker can gain unauthorized access to user accounts or maintain persistent access from an unauthorized client by presenting intercepted authorization codes or...

ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)

Summary Zitadel's OAuth2 / OIDC CodeExchange and RefreshToken implementations omit a critical validation step to ensure that the requesting client matches the client that originally initiated the authorization flow. This violates RFC 6749 Section 4.1.3, which mandates that the authorization serve...

GHSA-XQXV-4JC2-X56X ZITADEL: Missing client_id binding in OIDC authorization code exchange and refresh token flows (RFC 6749 Section 4.1.3 violation)

Summary Zitadel's OAuth2 / OIDC CodeExchange and RefreshToken implementations omit a critical validation step to ensure that the requesting client matches the client that originally initiated the authorization flow. This violates RFC 6749 Section 4.1.3, which mandates that the authorization serve...

CVE-2026-22283

creationtimestamp| type| source ---|---|--- 2026-06-18 09:03:07+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116770300607907622...

ALPINE-CVE-2026-55199

libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSHMSGEXTINFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can s...

EUVD-2026-37782

libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSHMSGEXTINFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can s...

CVE-2026-55199 libssh2 - Pre-Authentication DoS via SSH_MSG_EXT_INFO Handler

libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-authentication denial of service vulnerability in the SSHMSGEXTINFO handler in src/packet.c that allows a malicious SSH server to cause a client CPU exhaustion loop by sending a crafted extension count value. A malicious server can s...