162938 matches found
NightEagle targets Russian companies
Over the past year, our Global Emergency Response Team GERT has investigated several incidents involving the NightEagle group also tracked as APT-Q-95. This group has been active since at least 2023 and originally focused on organizations in Asia. We have now identified attacks by the group...
CVE-2026-77490
creationtimestamp| type| source ---|---|--- 2026-09-16 04:46:48+00:00| seen| https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities20260916...
CVE-2026-76019
creationtimestamp| type| source ---|---|--- 2026-09-16 04:46:37+00:00| seen| https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities20260916...
CVE-2026-76018
creationtimestamp| type| source ---|---|--- 2026-09-16 04:46:35+00:00| seen| https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities20260916...
Exploit for Heap-based Buffer Overflow in Microsoft
!Rulehttps://img.shields.io/badge/RULE-SOC335-00FF41?style=fo...
EUVD-2026-80050
Heap-based buffer overflow in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...
EUVD-2026-80051
Use after free in Microsoft Edge Chromium-based allows an unauthorized attacker to elevate privileges over a network...
(0Day) Microsoft Windows HTTP Proxy Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of...
VulnCheck KEV: CVE-2026-32996
This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation...
Security Updates for Microsoft Office Products (September 2026) (macOS)
The version of Microsoft Office for Mac installed on the remote host is affected by multiple vulnerabilities as referenced in the september-16-2026 advisory. - Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code over a network. CVE-2026-69678,...
CVE-2026-85893
Use after free in Microsoft Edge Chromium-based allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-69486
Heap-based buffer overflow in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...
CVE-2026-85893
Microsoft Edge (Chromium-based) contains a use-after-free vulnerability that allows an unauthorized attacker to achieve elevation of privileges over a network. The CVSS 3.1 base score is 8.8 (High) , with an attack vector of network, low complexity, no required privileges, but user interaction is...
CVE-2026-69486
CVE-2026-69486 is a heap-based buffer overflow in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to achieve remote code execution over a network. The CVSS 3.1 score is 8.8 (HIGH) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating that exploitation requires user inte...
CVE-2026-92237
Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log read permission to obtain application tokens, data protection key material and other stored credentials via SQL paramet...
Exploit for CVE-2026-32996
CVE-2026-32996 A vu...
CVE-2026-58201
Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the management.azure.com base URL. A specially...
CVE-2024-58385
Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to...
CVE-2024-58385 Yonyou U8 CRM SQL Injection via fillbacksettingedit.php
Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to...
