145732 matches found
KLA91116 SUI vulnerability in Microsoft Dynamics
A spoofing vulnerability was found in Microsoft Dynamics. Malicious users can exploit this vulnerability to spoof user interface. Original advisories CVE-2026-47646 Exploitation CVE list CVE-2026-47646 high KB list Solution Install necessary updates from the KB section, that are listed in your...
PT-2026-50802
Name of the Vulnerable Software and Affected Versions M365 Copilot affected versions not specified Description A missing authentication flaw in a critical function allows an unauthorized attacker to disclose information over a network. Recommendations At the moment, there is no information about ...
CVE-2026-48991 XianYuLauncher: Legacy Microsoft account OAuth sign-in flow lacks PKCE and state validation
XianYuLauncher is a Minecraft Java Edition launcher. In versions prior to 1.5.5, sensitive authentication artifacts could be exposed during a user-initiated login under certain local attack conditions. Affected versions relied on a fixed localhost redirect URI without PKCE or state validation...
CVE-2026-48991
XianYuLauncher (Minecraft Java Edition launcher) is affected in versions prior to 1.5.5. The legacy Microsoft account OAuth sign-in flow used a fixed localhost redirect URI and lacked PKCE and state validation, allowing sensitive authentication artifacts to be exposed under certain local attack c...
June "In the Trend of VM" (#28): Linux kernel, Microsoft Defender, and Palo Alto Networks device vulnerabilities
June "In the Trend of VM" 28: Linux kernel, Microsoft Defender, and Palo Alto Networks device vulnerabilities. Presenting the traditional monthly roundup of trending vulnerabilities according to Positive Technologies. In the previous May edition, we covered four vulnerabilities. This time, there...
Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist
...
httpc leaks Authorization header to cross-origin redirect targets
...
Stack Buffer Overflow in ei_s_print_term at Very Large Integer
...
Exploit for Improper Restriction of Names for Files and Other Resources in Microsoft
cve-id ⚡ Simple Usage Use this project only in safe and...
The vulnerability of Microsoft Teams’ corporate platform for Android, related to the lack of data cleaning at the management level, allows a perpetrator to execute arbitrary commands.
The vulnerability of Microsoft Teams’ corporate platform for Android is related to the lack of measures taken at the management level to secure data. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...
Security Updates for Microsoft Office Products (June 2026) (macOS)
The version of Microsoft Office for Mac installed on the remote host is affected by multiple vulnerabilities as referenced in the june-16-2026 advisory. - Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. CVE-2026-44819, CVE-2026-44824,...
n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints
Impact An endpoint in the Meta and Microsoft Teams trigger nodes reflects a query parameter into the HTTP response without sanitization or Content-Security-Policy headers, enabling reflected XSS in the n8n origin when a logged-in user visits a crafted URL. Patches The issue has been fixed in n8n...
NPM: n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints
NPM: n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints vulnerability discovered by ? in WordPress Npm n8n versions 2.24.0...
GHSA-H86Q-FX34-GFJR n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints
Impact An endpoint in the Meta and Microsoft Teams trigger nodes reflects a query parameter into the HTTP response without sanitization or Content-Security-Policy headers, enabling reflected XSS in the n8n origin when a logged-in user visits a crafted URL. Patches The issue has been fixed in n8n...
NPM: n8n: Microsoft SQL Node Prototype Pollution
NPM: n8n: Microsoft SQL Node Prototype Pollution vulnerability discovered by ? in WordPress Npm n8n versions 2.24.0...
n8n: Microsoft SQL Node Prototype Pollution
Impact An authenticated user with permission to create or modify workflows could achieve global prototype pollution via the Microsoft SQL node by supplying a crafted value as the table parameter. This pollutes Object.prototype process-wide for the lifetime of the n8n server process, causing...
GHSA-X6P3-M6H9-FX7R n8n: Microsoft SQL Node Prototype Pollution
Impact An authenticated user with permission to create or modify workflows could achieve global prototype pollution via the Microsoft SQL node by supplying a crafted value as the table parameter. This pollutes Object.prototype process-wide for the lifetime of the n8n server process, causing...
NPM: n8n: Missing Token Validation on Microsoft Agent 365 Trigger and Stripe Nodes
NPM: n8n: Missing Token Validation on Microsoft Agent 365 Trigger and Stripe Nodes vulnerability discovered by ? in WordPress Npm n8n versions 2.25.7...
n8n: Missing Token Validation on Microsoft Agent 365 Trigger and Stripe Nodes
Impact The MicrosoftAgent365Trigger and StripeTrigger node did not validate that inbound requests. As a result, an unauthenticated attacker who knows the webhook URL could submit a forged payload and cause the workflow to execute with attacker-controlled data. Patches The issue has been fixed in...
GHSA-JVC7-762P-3743 n8n: Missing Token Validation on Microsoft Agent 365 Trigger and Stripe Nodes
Impact The MicrosoftAgent365Trigger and StripeTrigger node did not validate that inbound requests. As a result, an unauthenticated attacker who knows the webhook URL could submit a forged payload and cause the workflow to execute with attacker-controlled data. Patches The issue has been fixed in...