memory-poisoning-axis

memory-poisoning-axis Deterministic memory-poisoning / prompt-injection measurement — anchored to CVE-2026-24301 "CoSnitch" Microsoft Copilot Personal, CVSS 3.1 8.8, patched 18 Aug 2026. CoSnitch chained: i automatic prompt execution ?q= + undocumented ?autorun=1, ii data exfiltration via...

Windows Secure Kernel Mode Elevation of Privilege Vulnerability

Double free in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally...

Astra Linux – Vulnerability in Linux 5.10, Linux

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Fixed potential crashes during module unloading. The vmbus driver relies on the panic notifier infrastructure to perform certain operations when a panic event is detected. Since vmbus can be built as a module,...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.0, there was a buffer overflow vulnerability in the MS-ADPCM and IMA-ADPCM decoders, due to unchecked predictor and stepindex values from input data. This vulnerability has been fixed in version 3.24.0...

CVE-2026-10556

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service t...

Microsoft’s Patching

Once a month, Microsoft pushes a security update to all Windows users. Tomorrow's is a new record: Microsoft's patch for September is a doozy, with a record number of roughly 972 vulnerabilities fixed and 112 of them meeting the high critical-severity threshold. It was only two months ago that...

CVE-2026-10556 Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service t...

EUVD-2026-77379

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service t...

CVE-2026-10556 Unauthenticated webhook request with null notification entry could crash the Microsoft Calendar plugin.

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service t...

CVE-2026-10556

Mattermost versions 11.9.x ≤ 11.9.0, 11.8.x ≤ 11.8.4, 11.7.x ≤ 11.7.7, and 10.11.x ≤ 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads. This allows an unauthenticated attacker to send a crafted POST request to the public webhook endpoint, crashing the Microso...

Vulnerabilities in Microsoft Azure

Microsoft has identified 4 vulnerabilities in various Azure components. A malicious individual could exploit these vulnerabilities to carry out attacks that can lead to various types of damage, as mentioned in the table below. The vulnerability with identifier CVE-2026-69854 has a CVSS score of...

A week in security (September 7 – September 13)

Here's what we've covered in the last seven days on Malwarebytes Labs: Crypto customers targeted by scammers after email marketing provider breach Android malware creates a hidden copy of your banking app BlueMoon exploit kit turns Chrome and Windows flaws into attacks Will AI kill us all within...

MDT-XXE-exploit

MDT-XXE-exploi...

ROS-20260914-73-0125

The vulnerability of the Input component in Google Chrome and Microsoft Edge is related to insufficient validation of entered data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260914-73-0067

The vulnerability of the Web Share component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

ROS-20260914-73-0053

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge is related to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

ROS-20260914-73-0075

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge is related to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...

ROS-20260914-73-0084

The vulnerability of the Dawn component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

PT-2026-91140

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7, 10.11.x = 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service t...

ROS-20260914-73-0082

The vulnerability of the Media component in Google Chrome and Microsoft Edge browsers is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure using a specially created video file...