162929 matches found
EUVD-2026-87271
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the...
CVE-2026-63208 Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the...
CVE-2026-63208 Zammad: Microsoft Graph error logs expose partially masked OAuth access tokens
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the...
CVE-2026-63208
The open source helpdesk system Zammad is vulnerable to sensitive information disclosure in versions prior to 7.1.2 . When a Microsoft Graph request fails, the system logs the authentication token with incomplete masking. Specifically, for JWT formats, only the first part is hidden, leaving the r...
CVE-2026-84458 Zammad: Account takeover via unverified email matching during SSO auto-link
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is enabled, Zammad binds an incoming third-party SSO identity to an existing local account by matching the email address the identity provider reports,...
EUVD-2026-87261
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is enabled, Zammad binds an incoming third-party SSO identity to an existing local account by matching the email address the identity provider reports,...
CVE-2026-84458
Prior to version 7.1.2 , the Zammad helpdesk system is vulnerable to an account takeover when the "Automatic account link on initial logon" setting is enabled. The root cause is that Zammad binds incoming third-party (SSO) identities to existing local accounts by matching reported email addresses...
CVE-2026-84458 Zammad: Account takeover via unverified email matching during SSO auto-link
Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when the "Automatic account link on initial logon" setting is enabled, Zammad binds an incoming third-party SSO identity to an existing local account by matching the email address the identity provider reports,...
From Debugging to Code Execution: RCE in Microsoft DevLabs’ DebugMCP?
Introduction AI-assisted development has crossed a threshold. The question is no longer whether your IDE communicates with an AI, it's how deeply that AI is now wired into your local environment. The Model Context Protocol MCP is one of the plumbing behind this shift: a JSON-RPC-based protocol th...
Microsoft Office Outlook Remote Code Execution Vulnerability
Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network...
Microsoft Office Information Disclosure Vulnerability
Insertion of sensitive information into log file in Microsoft Office allows an authorized attacker to disclose information over a network...
Chromium CVE-2026-95350: Buffer overflow in ANGLE
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium CVE-2026-95369: Inappropriate implementation in XML
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium CVE-2026-95329: Out of bounds write in WebGL
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium CVE-2026-95328: Confused deputy in Mobile
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium CVE-2026-95304: Out of bounds write in V8
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium CVE-2026-95294: UI misrepresentation in Browser
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium CVE-2026-95376: Externally controlled reference in DevTools
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium CVE-2026-95292: Incorrect authorization in Safebrowsing
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...
Chromium CVE-2026-95295: Information leak in Mobile
This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...