CVE-2026-26117 Arc Enabled Servers - Azure Connected Machine Agent Elevation of Privilege Vulnerability

...

CVE-2026-26117

Authentication bypass using an alternate path or channel in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally...

CVE-2025-13901

CWE-404 Improper Resource Shutdown or Release vulnerability exists that could cause partial Denial of Service on Machine Expert protocol when an unauthenticated attacker sends malicious payload to occupy active communication channels...

CVE-2025-13901

CVE-2025-13901 : CWE-404, Improper Resource Shutdown or Release, causing partial Denial of Service on the Machine Expert protocol when an unauthenticated attacker sends a malicious payload to occupy active communication channels. CVSSv4 base score 6.9 (MEDIUM); vector: Network, Low attack complex...

CVE-2025-13901

CWE-404 Improper Resource Shutdown or Release vulnerability exists that could cause partial Denial of Service on Machine Expert protocol when an unauthenticated attacker sends malicious payload to occupy active communication channels...

Arc Enabled Servers - Azure Connected Machine Agent Elevation of Privilege Vulnerability

Authentication bypass using an alternate path or channel in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally...

CVE-2026-25679 vulnerabilities

Vulnerabilities for packages: istio, dask-gateway, aws-otel-collector-fips, teleport-operator-fips, argo-cd, http-echo, containerd, logstash-exporter-fips, kaniko, x509-certificate-exporter, kyverno-policy-reporter-kyverno-plugin-fips, gomplate-fips, k6-operator, kubescape,...

GHSA-J4J7-VW47-RHFQ vulnerabilities

Vulnerabilities for packages: istio, dask-gateway, teleport-operator-fips, argo-cd, containerd, x509-certificate-exporter, kyverno-policy-reporter-kyverno-plugin-fips, gomplate-fips, k6-operator, kubescape, kubernetes-event-exporter-fips, consul-fips, tigera-operator-fips, azuredisk-csi-fips,...

pentesting-notes

🔐 Pentesting Notes Personal penetration testing documentati...

OneUptime has Synthetic Monitor RCE via exposed Playwright browser object

Summary OneUptime Synthetic Monitors allow a low-privileged authenticated project user to execute arbitrary commands on the oneuptime-probe server/container. The root cause is that untrusted Synthetic Monitor code is executed inside Node's vm while live host-realm Playwright browser and page...

Exposed Dangerous Method or Function

Overview @oneuptime/common is a The OneUptime Common UI Library is a collection of shared components, utilities that are used across the OneUptime platform. It is designed to be easy to install and use, and to be extensible. This library is built with React and TypeScript. It includes c Affected...

MAL-2026-1312 Malicious code in iron-overlay-behavior (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f1c6c5a0c7da957deff9af5f6e981a6d5cf588394ad85aaaa9456657d49604e The package iron-overlay-behavior was found to contain malicious code. Source: ghsa-malware...

OneUptime security vulnerabilities

OneUptime is a comprehensive open-source solution developed by OneUptime. It is designed for monitoring and managing your online services. Versions of OneUptime prior to 10.0.18 contained security vulnerabilities. These vulnerabilities stemmed from the execution of untrusted user code within the...

CVE-2025-13901: Improper Resource Shutdown or Release

CWE-404 Improper Resource Shutdown or Release vulnerability exists that could cause partial Denial of Service on Machine Expert protocol when an unauthenticated attacker sends malicious payload to occupy active communication channels...

PT-2026-24228

Name of the Vulnerable Software and Affected Versions Machine Expert affected versions not specified Description An issue exists where a malicious payload sent by an unauthenticated attacker can occupy active communication channels, potentially leading to a partial Denial of Service. This relates...

PT-2026-24327

Name of the Vulnerable Software and Affected Versions Azure Windows Virtual Machine Agent affected versions not specified Azure Arc on Windows affected versions not specified Description A security issue exists in Azure Windows Virtual Machine Agent and Azure Arc on Windows that allows an attacke...

Microsoft Azure Connected Machine Agent security vulnerabilities

Microsoft Azure Connected Machine Agent is a core component of Microsoft that connects non-Azure servers to the Azure console. There is a security vulnerability present in Microsoft Azure Connected Machine Agent. Attackers can exploit this vulnerability to gain higher privileges...

CVE-2026-26117: Authentication Bypass Using an Alternate Path or Channel

Authentication bypass using an alternate path or channel in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally...

PT-2026-24190

Name of the Vulnerable Software and Affected Versions OneUptime versions prior to 10.0.21 Description OneUptime Synthetic Monitors allow a low-privileged authenticated project user to execute arbitrary commands on the oneuptime-probe server/container. The root cause is that untrusted Synthetic...

Schneider Electric’s various products have security vulnerabilities

Schneider Electric Modicon M241, among others, are programmable logic controllers produced by Schneider Electric, a French company. Several products from Schneider Electric have security vulnerabilities. These vulnerabilities stem from improper resource closure or release procedures, which may...