CVE-2026-70352 Azure AI Language Elevation of Privilege Vulnerability

...

CVE-2026-70352

Azure AI Language is affected by a missing authentication vulnerability in a critical function, allowing an unauthorized attacker to elevate privileges over a network . The vulnerability is rated CVSS 10.0 (CRITICAL) with low complexity, no privileges required, no user interaction, and changed sc...

CVE-2026-70352 Azure AI Language Elevation of Privilege Vulnerability

...

pphack v0.1.5

pphack Advanced Client-Side Prototype Pollution Scanner Coded with 💙 by edoardottt Share on Twitter! Install • Get Started • Examples • Changelog • Contributing • License Install 📡 Using Go go install github.com/edoardottt/pphack/cmd/pphack@latest pphack relies on chromedp, so you need Chrome or...

wrongsecrets-binaries v0.3.0

wrongsecrets-binaries This is a supportive repository for OWASP WrongSecrets. Here we create our binaries which are included in the official project. Want to add a challenge related to secrets hiding in binary? Open a ticket at WrongSecrets issues. Want to fix something you found in one of the...

skillscript v0.40.1

Safe, reusable automation authored by agents. skillscript.ai • docs TL;DR — npm install -g skillscript-runtime && skillfile init && skillfile dashboard. See Quickstart. What is Skillscript? Skillscript came from asking: what would a Makefile look like if it built skills instead of binaries? The...

RLSA-2026:62577 Important: go-fdo-client security update

go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding. Security Fixes: crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to...

RHSA-2026:62631 Red Hat Security Advisory: golang-github-openprinting-ipp-usb security update

Bulletin has no description...

Analyzing a Go-Based IoT Self-Propagating DDoS Botnet

...

CVE-2026-70352: Missing Authentication for Critical Function

Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network...

PT-2026-85312

Name of the Vulnerable Software and Affected Versions Azure AI Language affected versions not specified Description Missing authentication for a critical function allows an unauthorized attacker to elevate privileges over a network without requiring any user interaction. Recommendations At the...

Repeat-After-Me: Black-Box Adaptive Visual Prompt Injection

Prompt injection is widely recognized as a major security threat to AI agents that interact with untrusted external data, such as websites, documents, and emails. Prior work has shown that, in the text domain, black-box prompt injection can achieve near-perfect attack success rates ASRs. In the...

Important: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fixes: encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive...

KLA91257 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to bypass security restrictions, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An information disclosure vulnerability i...

VCG — Updated!

==================================================================================== VCG VisualCodeGrepper Current version: 2.3.2 ==================================================================================== Contents: 1. Overview 2. Latest additions to VCG V2.3.2 3. Using VCG Input...

The vulnerability of the CSS components in Google Chrome and Microsoft Edge web browsers allows attackers to compromise data integrity.

The vulnerability of the CSS component in Google Chrome and Microsoft Edge relates to the improper presentation of critical information to the user interface. Exploiting this vulnerability can allow an attacker to compromise data integrity through a specially created HTML page...

The vulnerability of the NLTK library package for symbolic and statistical processing of natural language lies in its insecure initialization of resources, which allows attackers to bypass existing security mechanisms.

The vulnerability of the NLTK library package for symbolic and statistical processing of natural language is related to insecure initialization of resources. Exploiting this vulnerability could allow a malicious actor to bypass existing security measures remotely...

CAPTCHAs in the Agentic Era: Solvers That Learn from Every Encounter

Vision-language models VLMs can solve visual CAPTCHAs without task-specific training, but the agents built on them approach every challenge from scratch. For such an agent, the hundredth instance of a familiar puzzle costs as much time and compute as the first. Specialized detectors invert the...

The Implications of Linguistic Illegibility for LLM Security

LLMs are trained to generate natural language. However, various strands of evidence indicate that an LLM's externalized linguistic outputs and mechanistically-extracted linguistic features can be an unreliable lens for understanding internal model computation. We introduce the term "linguistic...

Joern 4.0.616

Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...