CVE-2026-55558 aiosmtplib: STARTTLS response injection

aiosmtplib is an asynchronous SMTP client for use with asyncio. Prior to 5.1.2, SMTPProtocol.starttls in src/aiosmtplib/protocol.py consumes the server's 220 response and starts the TLS handshake without clearing SMTPProtocol.buffer. An active network attacker can place attacker-chosen SMTP...

CVE-2026-55558

CVE-2026-55558 affects aiosmtplib , an asynchronous SMTP client for Python's asyncio, in versions prior to 5.1.2 . The vulnerability resides in SMTPProtocol.start_tls (src/aiosmtplib/protocol.py), which consumes the server's 220 response and initiates the TLS handshake without clearing SMTPProtoc...

Microsoft Word Information Disclosure Vulnerability

Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...

Azure Virtual Machines Elevation of Privilege Vulnerability

Server-side request forgery ssrf in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network...

Azure Arc Elevation of Privilege Vulnerability

Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network...

Microsoft Fabric Elevation of Privilege Vulnerability

Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over a network...

Microsoft Exchange Online Elevation of Privilege Vulnerability

Server-side request forgery ssrf in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network...

Azure SQL Database Elevation of Privilege Vulnerability

Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network...

Azure Data Factory Elevation of Privilege Vulnerability

Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network...

K000163004: Oracle Java vulnerability CVE-2026-47035

Security Advisory Description Vulnerability in Oracle Java SE component: JavaFX. The supported version that is affected is Oracle Java SE: 8u491. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful...

OpenJDK: Improve Resource Resolving (2026-08 Security Update)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12;...

EUVD-2026-63100

Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network...

OpenJDK: Improve Resource Resolving (2026-08 Security Update)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Java SE: 8u501, 11.0.32, 17.0.20, 21.0.12, 25.0.4, 26.0.2; Oracle GraalVM for JDK: 17.0.20 and 21.0.12;...

CVE-2026-70105: Improper Input Validation

Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...

CVE-2026-69851: Server-Side Request Forgery (SSRF)

Server-side request forgery ssrf in Azure Active Directory allows an authorized attacker to elevate privileges over a network...

CVE-2026-69555: Incorrect Authorization

Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-69558: Authorization Bypass Through User-Controlled Key

Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network...

CVE-2026-69519: Observable Response Discrepancy

Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network...

CVE-2026-69400: Improper Limitation of a Pathname to a Restricted Directory

Improper limitation of a pathname to a restricted directory 'path traversal' in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-65816: Use of Incorrectly-Resolved Name or Reference

Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network...