146769 matches found
CVE-2025-9611 Microsoft Playwright MCP Server < 0.0.40 DNS Rebinding via Missing Origin Header Validation
Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via a victim’s web browser and send unauthorized requests to a locally running MCP server, resulting in unintended...
EUVD-2026-1179
Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via a victim’s web browser and send unauthorized requests to a locally running MCP server, resulting in unintended...
CVE-2025-9611 Microsoft Playwright MCP Server < 0.0.40 DNS Rebinding via Missing Origin Header Validation
Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via a victim’s web browser and send unauthorized requests to a locally running MCP server, resulting in unintended...
KLA90843 SUI vulnerability in Microsoft Browser
A spoofing vulnerability was found in Microsoft Browser. Malicious users can exploit this vulnerability to spoof user interface. Original advisories CVE-2025-62224 Related products Microsoft-Edge CVE list CVE-2025-62224 warning KB list Solution Install necessary updates from the Settings and more...
Microsoft Playwright 安全漏洞
Microsoft Playwright is an automation framework from Microsoft Corporation USA. A security vulnerability exists in Microsoft Playwright MCP Server versions prior to 0.0.40 that stems from an unvalidated Origin header and could lead to DNS rebinding attacks and unauthorized requests...
Phishing actors exploit complex routing and misconfigurations to spoof domains
Phishing actors are exploiting complex routing scenarios and misconfigured spoof protections to effectively spoof organizations’ domains and deliver phishing emails that appear, superficially, to have been sent internally. Threat actors have leveraged this vector to deliver a wide variety of...
Phishing campaign abuses Google Cloud services to steal Microsoft 365 logins
Attackers are sending very convincing fake “Google” emails that slip past spam filters, route victims through several trusted Google-owned services, and ultimately lead to a look-alike Microsoft 365 sign-in page designed to harvest usernames and passwords. Researchers found that cybercriminals us...
crypto: starfive - Correctly handle return of sg_nents_for_len
...
Congratulations to the top MSRC 2025 Q4 security researchers!
Congratulations to all the researchers recognized in this quarter’sMicrosoft Researcher Recognition Programleaderboard! Thank you to everyone for your hard work and continued partnership to secure customers...
URI Credential Leakage Bypass over CVE-2025-27221
...
HoneyMyte (aka Mustang Panda) Deploys ToneShell Backdoor in New Attacks
HoneyMyte Mustang Panda is back with a new ToneShell backdoor. Read how this stealthy attack blinds Microsoft Defender to target government entities in Asia...
Exploit for Improper Access Control in Microsoft
CVE-2025-47962-POC Reproduction process： i686-w64-mingw32-gcc...
27 Malicious npm Packages Used as Phishing Infrastructure to Steal Login Credentials
Cybersecurity researchers have disclosed details of what has been described as a "sustained and targeted" spear-phishing campaign that has published over two dozen packages to the npm registry to facilitate credential theft. The activity, which involved uploading 27 npm packages from six differen...
NULL Pointer Dereference in PDO quoting
...
Heap buffer overflow in array_merge()
...
Information Leak of Memory in getimagesize
...
Exploit for Deserialization of Untrusted Data in Microsoft
No d...
Exploit for Deserialization of Untrusted Data in Microsoft
No d...