PT-2026-64435

Name of the Vulnerable Software and Affected Versions Cloudreve versions prior to 4.17.0 Description An OAuth scope authorization bypass exists in the admin storage policy routes. A user with an OAuth bearer token scoped only to Admin.Read can access the 'POST /api/v4/admin/policy/oauth/signin'...

January 24, 2026—KB5078135 (OS Build 26100.32236) Out-of-band

None None...

May 24, 2023—KB5026446 (OS Build 22621.1778) Preview

None None...

OneDrive for iOS Disclosure

The vulnerability of the OneDrive for iOS file storage service is related to the lack of protection for service-related data. Exploiting this vulnerability can allow a malicious actor to disclose protected information...