PT-2026-68829

Name of the Vulnerable Software and Affected Versions Microsoft Entra Provisioning Service SyncFabric affected versions not specified Description An authorized attacker can elevate privileges over a network due to the use of the sequence '.../...//' within the Microsoft Entra Provisioning Service...

CVE-2026-62873: Improper Verification of Cryptographic Signature

Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-63508: Missing Authentication for Critical Function

Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-62830: Missing Authorization

Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network...

CVE-2026-49163: Improper Limitation of a Pathname to a Restricted Directory

Improper limitation of a pathname to a restricted directory 'path traversal' in Application Insights Profiler allows an authorized attacker to elevate privileges over a network...

CVE-2026-59115: Path Traversal: '.../...//'

'.../...//' in Microsoft Entra Provisioning Service SyncFabric allows an authorized attacker to elevate privileges over a network...

CVE-2026-59118: Improper Authorization

Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-62896: Improper Authentication

Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network...

PT-2026-68837

Name of the Vulnerable Software and Affected Versions Microsoft Teams affected versions not specified Description Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a newer...

CVE-2026-56162: Improper Authentication

Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network...

PT-2026-68772

Name of the Vulnerable Software and Affected Versions macOS Tahoe versions prior to 26.6.1 macOS Sequoia versions prior to 15.7.9 macOS Sonoma versions prior to 14.8.9 Description An authentication bypass exists in the built-in Screen Sharing functionality, which allows a network attacker to...

CVE-2026-62836: Improper Restriction of Communication Channel to Intended Endpoints

Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-50481: Modification of Assumed-Immutable Data (MAID)

Modification of assumed-immutable data maid in Azure Active Directory allows an authorized attacker to elevate privileges over a network...

CVE-2026-71260 ESPHome web_server Plaintext Password Disclosure via JSON "value" Field

ESPHome through 2026.7.0-dev discloses plaintext passwords via its webserver component. In WebServer::textjson esphome/components/webserver/webserver.cpp, a text entity configured with mode: password TEXTMODEPASSWORD has its JSON "state" field correctly masked as "", but the same serialization pa...

UBUNTU-CVE-2026-18103

A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI Open Management Application Programming Interface port, especially if not secured with TSIG Transaction Signature key authentication, could send a specially crafted lease creation request. This request, containing...

CVE-2026-12609: Improper Limitation of a Pathname to a Restricted Directory

In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the @theia/plugin-ext backend exposes the /hostedPlugin/:pluginId/:path HTTP endpoint, which resolves the requested file path with path.resolvelocalPath, filePath without verifying that the resolved path stays within the plugin's...

openjdk: Enhance XBM image support (Oracle CPU 2026-07)

A flaw was found in OpenJDK. The regex defined in XbmImageDecoder matchRegex is vulnerable to a DoS attack when the input contains a long string without a closing character; due to excessive backtracking...

EUVD-2026-52530

Improper control of generation of code 'code injection' in Microsoft Edge Chromium-based allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-66326

Missing authorization in Microsoft Edge Chromium-based allows an unauthorized attacker to execute code over a network...

CVE-2026-50506

A flaw was found in ASP.NET Core where an unauthorized remote attacker can cause a Denial of Service DoS over a network. This vulnerability occurs due to the allocation of resources without proper limits or throttling mechanisms, allowing an attacker to exhaust available resources and disrupt...