New Project CAV3RN module abuses Outlook calendar events for C2 and DNS AAAA records for configuration recovery

Introduction In June 2026, as part of our Kaspersky Threat Intelligence Reporting service, we published extensive research on Project CAV3RN, a sophisticated modular framework used for cyberespionage activity against targets in Israel. We have been tracking this cluster since December 2025, and i...

dotnet: .NET Framework: Denial of Service via network-based buffer overflow

A flaw was found in .NET Framework. This vulnerability, a stack-based buffer overflow, allows an unauthorized attacker to remotely exploit the system over a network. Successful exploitation can lead to a denial of service DoS, making the affected system unavailable to legitimate users...

ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass

A flaw was found in ASP.NET Core. An authorized attacker can exploit this authentication bypass vulnerability over a network by manipulating assumed-immutable data. This can allow the attacker to elevate their privileges within the system...

VulnCheck KEV: CVE-2026-50522

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network...

Vulnerabilities of Microsoft Office, Excel, and 365 Apps for Enterprise packages, as well as Microsoft Office Online Server, allow attackers to disclose protected information.

The vulnerability of Microsoft Office, Excel, and 365 Apps for Enterprise programs, as well as Microsoft Office Online Server, is related to reading data beyond the allowed range in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information that is protected by...

NGINX Map directive and Regex matching vulnerability

...

Excon: redact additional sensitive/risky headers when following redirects

...

Chromium: CVE-2026-15900 Use after free in GPU

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-15899 Use after free in CameraCapture

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

EUVD-2026-45344

Authentication bypass using an alternate path or channel in Microsoft Edge Chromium-based allows an unauthorized attacker to perform tampering over a network...

CVE-2026-57980 Microsoft Edge (Chromium-based) Tampering Vulnerability

...

CVE-2026-57980

CVE-2026-57980 refers to a vulnerability in Microsoft Edge (Chromium-based) where an authentication bypass via an alternate path or channel could allow an unauthenticated, network-based tampering by an attacker. The description and connected sources consistently describe this as a network-exposed...

CVE-2026-57980 Microsoft Edge (Chromium-based) Tampering Vulnerability

...

pyasn1: Uncontrolled resource consumption when converting decoded REAL values

...

CVE-2026-21770

HCL Traveler for Microsoft Outlook HTMO is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content...

.NET Framework - Leaking ObjRefs via HTTP .NET Remoting

.NET Framework Information Disclosure Vulnerability id: CVE-2024-29059 info: name: .NET Framework - Leaking ObjRefs via HTTP .NET Remoting author: iamnoooob,rootxharsh,DhiyaneshDk,pdresearch severity: high description: .NET Framework Information Disclosure Vulnerability impact: | Attackers can...

EUVD-2026-45141

HCL Traveler for Microsoft Outlook HTMO is susceptible to a DLL hijacking vulnerability which could allow an attacker to modify or replace the application with malicious content...

CVE-2026-62213

OpenClaw versions before 2026.5.27 contain a token leakage vulnerability in MS Teams outbound requests that allows lower-trust callers to expose Bot Framework tokens. Attackers can access configured input paths to retrieve credentials that should remain within the trusted boundary...

CVE-2026-62212

OpenClaw before 2026.5.28 contains a race condition in the MS Teams safeFetch DNS rebinding check. When the affected feature is enabled and reachable, a lower-trust caller or configured input path could win a timing window between the DNS validation check and use, allowing actions that should hav...

CVE-2026-62205

OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in the MS Teams message actions feature. When the affected feature is enabled and reachable, a lower-trust caller or a configured input path can perform actions that should have required a stronger...