GHSA-HFRJ-R4V7-3997 vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-aws, linux-qemu-melange, linux-qemu, linux-azure, linux-vmware...

GHSA-5Q2P-7748-G6QP vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-aws, linux-qemu-melange, linux-qemu, linux-azure, linux-vmware...

GHSA-7Q5M-QV9W-C8XX vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-aws, linux-qemu-melange, linux-qemu, linux-azure, linux-vmware...

GHSA-5R3H-V82J-R7RR vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-aws, linux-qemu-melange, linux-qemu, linux-azure, linux-vmware...

GHSA-FJ73-9FR6-G7MW vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-aws, linux-qemu-melange, linux-qemu, linux-azure, linux-vmware...

GHSA-JPVF-6235-4RH8 vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-aws, linux-qemu-melange, linux-qemu, linux-azure, linux-vmware...

CVE-2026-53218 vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-aws, linux-qemu-melange, linux-qemu, linux-azure, linux-vmware...

DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts

A Microsoft 365 device code phishing campaign has been observed leveraging collaboration-themed lures to take control of victim accounts between the last week of June 2026 and into early July, per findings from ZeroBEC. "The campaign did not depend on a fake Microsoft password page. It used a...

PYSEC-2026-1209 Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability...

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability...

PYSEC-2026-1684 Remote Code Execution Vulnerability in Microsoft Django Backend for SQL Server

Microsoft Django Backend for SQL Server Remote Code Execution Vulnerability...

PYSEC-2026-1261 Microsoft Common Data Model SDK Denial of Service Vulnerability

Microsoft Common Data Model SDK Denial of Service Vulnerability...

Apache Airflow ODBC Provider, Apache Airflow MSSQL Provider Improper Input Validation vulnerability

Input Validation vulnerability in Apache Software Foundation Apache Airflow ODBC Provider, Apache Software Foundation Apache Airflow MSSQL Provider.Thisvulnerability is considered low since it requires DAG code to use getsqlalchemyconnection and someone with access to connection resources...

Arbitrary HDF5 File Read via Virtual Dataset Bypass in keras-team/keras

...

CVE-2026-54893

URL path injection in the Microsoft Graph adapter of Swoosh. Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address into the URL path /users/from/sendMail without percent-encoding or validation. In applications that derive the from address...

CVE-2026-54893

URL path injection in the Microsoft Graph adapter of Swoosh. Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address into the URL path /users/from/sendMail without percent-encoding or validation. In applications that derive the from address...

CVE-2026-54893 Email-derived URL path injection in the Swoosh Microsoft Graph adapter

URL path injection in the Microsoft Graph adapter of Swoosh. Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address into the URL path /users/from/sendMail without percent-encoding or validation. In applications that derive the from address...

CVE-2026-54893 Email-derived URL path injection in the Swoosh Microsoft Graph adapter

URL path injection in the Microsoft Graph adapter of Swoosh. Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address into the URL path /users/from/sendMail without percent-encoding or validation. In applications that derive the from address...

CVE-2026-54893

Swoosh.Adapters.MsGraph is vulnerable to URL path injection via the from-address interpolation into /users/{from}/sendMail without percent-encoding or validation. If from derives from untrusted input, an attacker can inject URL-special characters (/, ?, #) to escape the intended path and rewrite ...

CVE-2026-54893 Email-derived URL path injection in the Swoosh Microsoft Graph adapter

URL path injection in the Microsoft Graph adapter of Swoosh. Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address into the URL path /users/from/sendMail without percent-encoding or validation. In applications that derive the from address...