PT-2026-65020

Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network...

PT-2026-65002

Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network...

CVE-2026-57989

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to disclose information over a network...

EUVD-2026-49059

Files or directories accessible to external parties in Microsoft Edge Chromium-based allows an unauthorized attacker to disclose information over a network...

CVE-2026-57989

Origin validation error in Microsoft Edge Chromium-based allows an unauthorized attacker to disclose information over a network...

CVE-2026-62835

Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network...

Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

Files or directories accessible to external parties in Microsoft Edge Chromium-based allows an unauthorized attacker to disclose information over a network...

CVE-2026-62825

Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network...

PT-2026-64313

Name of the Vulnerable Software and Affected Versions Microsoft Azure Kubernetes Service affected versions not specified Description Missing authentication for a critical function allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no...

CVE-2026-60367

Vulnerability in the Oracle Platform Security for Java product of Oracle Fusion Middleware component: Centralized Thirdparty Jars. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to...

EUVD-2026-46923

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware component: Runtime Tools. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCente...

CVE-2026-60247

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Coherence. Successful...

CVE-2026-60230

Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0 and 15.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TCP to compromise Oracle...

@vitest/browser: Browser Mode provider commands bypass the file-access permission gate

Summary Browser Mode exposes a set of built-in "commands" that run on the Node.js side of the test runner and can touch the local filesystem taking screenshots, managing Playwright traces, uploading files for , comparing screenshots. Several of these commands accept a file path from the browser a...

GHSA-P63J-VCC4-9VMV @vitest/browser: Browser Mode provider commands bypass the file-access permission gate

Summary Browser Mode exposes a set of built-in "commands" that run on the Node.js side of the test runner and can touch the local filesystem taking screenshots, managing Playwright traces, uploading files for , comparing screenshots. Several of these commands accept a file path from the browser a...

Rockwell Automation 1734 POINT I/O (Update A)

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow for an attacker to cause a denial-of-service condition on the product. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network...

CVE-2026-44583 Paymenter: Blind Unauthenticated SSRF on the Paypal gateway module

Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the PayPal webhook endpoint /extensions/paypal/webhook processes the PAYPAL-CERT-URL HTTP header without validation, allowing attackers to control server-side HTTP request...

dotnet: .NET: Security feature bypass due to incorrect authorization

A flaw was found in .NET where incorrect authorization allows an unauthorized attacker to bypass a security feature over a network. This vulnerability enables an attacker to circumvent intended security controls, potentially leading to unauthorized access or actions within the affected system...

dotnet: .NET Framework: Denial of Service via improper input validation

A flaw was found in .NET Framework. This improper validation of input allows an unauthorized attacker to remotely deny service over a network. This vulnerability can lead to a Denial of Service DoS condition, making the affected system unavailable to legitimate users...

ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass

A flaw was found in ASP.NET Core. An authorized attacker can exploit this authentication bypass vulnerability over a network by manipulating assumed-immutable data. This can allow the attacker to elevate their privileges within the system...