CVE-2026-100681

Budibase versions prior to 3.45.0 are vulnerable to an unauthenticated server-side request forgery (SSRF) and credential exfiltration flaw within the Microsoft Teams webhook endpoint . The root cause is the acceptance of forged Bot Framework activities containing arbitrary serviceUrl values. An a...

SharePoint RCE and MikroTik RouterOS Flaws Actively Exploited in the Wild

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Friday added two security flaws impacting Microsoft SharePoint and Mikrotik RouterOS to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. The vulnerabilities in question are as follows -...

CVE-2026-100550

OpenClaw npm package 'openclaw' before 2026.8.1 contains an access-control bypass in the Microsoft Teams integration. When groupPolicy is set to allowlist, a missing or unsupported configured access group produces a denied group-resolution result that is not rejected by the final message-admissio...

CVE-2026-100550 OpenClaw before 2026.8.1 Authentication Bypass via Access Group

OpenClaw npm package 'openclaw' before 2026.8.1 contains an access-control bypass in the Microsoft Teams integration. When groupPolicy is set to allowlist, a missing or unsupported configured access group produces a denied group-resolution result that is not rejected by the final message-admissio...

EUVD-2026-87500

OpenClaw npm package 'openclaw' before 2026.8.1 contains an access-control bypass in the Microsoft Teams integration. When groupPolicy is set to allowlist, a missing or unsupported configured access group produces a denied group-resolution result that is not rejected by the final message-admissio...

CVE-2026-100550

The OpenClaw npm package (openclaw) prior to version 2026.8.1 is vulnerable to an access-control bypass within its Microsoft Teams integration . When groupPolicy is configured to use an allowlist, a missing or unsupported access group generates a denied group-resolution result. Because this resul...

CVE-2026-100550 OpenClaw before 2026.8.1 Authentication Bypass via Access Group

OpenClaw npm package 'openclaw' before 2026.8.1 contains an access-control bypass in the Microsoft Teams integration. When groupPolicy is set to allowlist, a missing or unsupported configured access group produces a denied group-resolution result that is not rejected by the final message-admissio...

CVE-2026-100550 OpenClaw before 2026.8.1 Authentication Bypass via Access Group

OpenClaw npm package 'openclaw' before 2026.8.1 contains an access-control bypass in the Microsoft Teams integration. When groupPolicy is set to allowlist, a missing or unsupported configured access group produces a denied group-resolution result that is not rejected by the final message-admissio...

CVE-2026-100681: Server-Side Request Forgery (SSRF)

Budibase before 3.45.0 contains an unauthenticated server-side request forgery and credential exfiltration vulnerability in the Microsoft Teams webhook endpoint that accepts forged Bot Framework activities with arbitrary serviceUrl values. Attackers can submit a crafted POST request to inject an...

CVE-2026-100550: Incorrect Authorization

OpenClaw npm package 'openclaw' before 2026.8.1 contains an access-control bypass in the Microsoft Teams integration. When groupPolicy is set to allowlist, a missing or unsupported configured access group produces a denied group-resolution result that is not rejected by the final message-admissio...

PT-2026-99352

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.45.0 Description An unauthenticated server-side request forgery SSRF and credential exfiltration issue exists in the Microsoft Teams webhook endpoint. The system accepts forged Bot Framework activities containing...

PT-2026-99187

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description An access-control bypass exists in the Microsoft Teams integration. When the groupPolicy is configured as allowlist, a missing or unsupported access group results in a denied group-resolution tha...

Exploit for Code Injection in Microsoft

MS SharePoint CVE-2026-65660 - Malicious Register Directive Co...

CVE-2026-100208

Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network...

EUVD-2026-87317

Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network...

CVE-2026-100208

A vulnerability exists in Microsoft Office Outlook due to an integer overflow or wraparound condition. This flaw allows an unauthorized attacker to achieve remote code execution over a network. While specific component details or patch versions are not provided in the documents, the vulnerability...

CVE-2026-63208

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the...

CVE-2026-63208 Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the...

EUVD-2026-87271

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the...

CVE-2026-63208 Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens

Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the...