CVE-2026-18215 Keycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenant

Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization tenant. A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token from a completely...

CVE-2026-18215

Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization tenant. A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token from a completely...

CVE-2026-18215

Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization tenant. A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token from a completely...

PT-2026-66728

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description Keycloak allows users to authenticate using Microsoft accounts with restrictions limited to a specific organization tenant. A flaw exists where this tenant restriction is ignored during the...

KLA91186 ACE vulnerability in Microsoft Office

Arbitrary code execution vulnerability was found in Microsoft Office. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2026-62870 Exploitation CVE list CVE-2026-62870 critical KB list 5002886 Solution Install necessary updates from the KB section,...

HCL Traveler for Microsoft Outlook < 3.0.16 DLL Hijacking (CVE-2026-21770)

The version of HCL Traveler for Microsoft Outlook HTMO installed on the remote host is prior to 3.0.16. It is, therefore, affected by a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content. Note that Nessus has not tested for this...

Top 10 Companies to Hire Power BI Developers in 2026

Compare 10 Power BI development companies for 2026, covering DAX, Microsoft Fabric, data engineering, security, compliance, AI, and enterprise BI project needs...

CLEANSTART-2026-RW79431 Security fixes in velero-plugin-for-microsoft-azure-fips 1.14.0-r1

Package velero-plugin-for-microsoft-azure-fips version 1.14.0-r1 fixes 9 vulnerabilities: CVE-2026-27143, CVE-2026-32281, CVE-2026-32280, CVE-2026-32283, CVE-2026-27140...

CLEANSTART-2026-RE00985 Security fixes in velero-plugin-for-microsoft-azure-fips 1.14.0-r2

Package velero-plugin-for-microsoft-azure-fips version 1.14.0-r2 fixes 11 vulnerabilities: CVE-2026-39820, CVE-2026-42499, CVE-2026-39836, CVE-2026-33814, CVE-2026-33811...

BELL-CVE-2026-16043

Bulletin has no description...

Security Updates for Microsoft Malware Protection Engine (July 2026)

The Microsoft Malware Protection Engine installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Integer underflow wrap or wraparound in Microsoft Defender allows an unauthorized attacker to execute code locally. CVE-2026-55011 - Integ...

Chromium: CVE-2026-15126 Use after free in Forms

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-15117 Use after free in Payments

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-62828

Improper input validation in Microsoft Edge for Android allows an unauthorized attacker to perform tampering over a network...

CVE-2026-62828 Microsoft Edge for Android (Chromium-based) Tampering Vulnerability

...

Chromium: CVE-2026-15767 Heap buffer overflow in libyuv

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Improper Authentication

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improper Authentication through the Microsoft account token exchange flow in the Microsoft identity provider...

Fake IT Calls on Microsoft Teams Lead to GoGRPC Backdoor Infections

Fake helpdesk callers use Microsoft Teams and Quick Assist to access employee computers, where attackers install new GoGRPC backdoor in suspected ransomware operations...

PT-2026-65516

Improper input validation in Microsoft Edge for Android allows an unauthorized attacker to perform tampering over a network...

Hackers Compromise Hotel Wi-Fi Gateways to Hijack Microsoft 365 Accounts

Compromised hotel Wi-Fi gateways redirect business travelers to fake Microsoft 365 login pages allowing attackers to steal credentials and authorization tokens...