145727 matches found
ROS-20260515-73-0039
A vulnerability in the WindowDialog component of Google Chrome and Microsoft Edge browser is related to memory usage after it is freed. Exploitation of the vulnerability could allow a remote attacker to compromise the rendering process and affect the confidentiality, integrity and availability of...
Microsoft Power Automate for Desktop < 2.68.237.26118 Information Disclosure (May 2026)
The version of Microsoft Power Automate for desktop installed on the remote Windows host is prior to 2.68.237.26118. It is, therefore, affected by an information disclosure vulnerability: - Exposure of sensitive information to an unauthorized actor in Power Automate allows an authorized attacker ...
User Impersonation
Overview Affected versions of this package are vulnerable to User Impersonation due to improper validation of JWT aud and iss claims in the Windows MDM authentication flow. An attacker can enroll unauthorized devices by presenting a valid Microsoft-signed Azure AD token from any tenant. This is...
CVE-2026-42897
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-41615
Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose information over a network...
CVE-2026-41615
Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose information over a network...
CVE-2026-41615 Microsoft Authenticator Information Disclosure Vulnerability
...
EUVD-2026-30342
Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose information over a network...
CVE-2026-41615
CVE-2026-41615 affects Microsoft Authenticator. The available documents identify an information disclosure vulnerability that could allow an unauthorized network actor to exfiltrate sensitive data from the Microsoft Authenticator component. The CVSS 3.1 score is 9.6 (CRITICAL) with Network attack...
CVE-2026-41615 Microsoft Authenticator Information Disclosure Vulnerability
...
CVE-2026-42897 Microsoft Exchange Server Spoofing Vulnerability
...
EUVD-2026-30343
Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-42897
CVE-2026-42897 affects on-prem Microsoft Exchange Server (2016, 2019, SE) with an XSS flaw in Outlook Web Access caused by improper neutralization of input during web page generation. An attacker could send a crafted email to trigger arbitrary JavaScript execution in the victim’s browser, enablin...
CVE-2026-42897 Microsoft Exchange Server Spoofing Vulnerability
...
Achieve Federal-Grade M365 Security: Governing with Qualys SSPM and SCuBA
Qualys SaaS Security Posture Management SSPM introduces native support for the Secure Cloud Business Applications SCuBA compliance framework, bringing CISA's toughest M365 security benchmarks directly into your continuous posture monitoring workflow. Key Takeaways CISA’s Secure Cloud Business...
Kazuar: Anatomy of a nation-state botnet
In this article 1. Delivery 2. Module types 3. Botnet operations 4. Who is Secret Blizzard? 5. Mitigation and protection guidance 6. Microsoft Defender detections Kazuar, a sophisticated malware family attributed to the Russian state actor Secret Blizzard, has been under constant development for...
Description of the security update for Microsoft Exchange Server 2016 CU23: June 09, 2026 (KB5094144)
None None...
Description of the security update for Microsoft Exchange Server 2019 CU14: June 09, 2026 (KB5094142)
None None...