PT-2026-70603

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description Improper input validation allows an authorized attacker to perform spoofing over a network, which enables them to affect the system. Recommendations At the moment, there i...

PT-2026-70665

Name of the Vulnerable Software and Affected Versions Microsoft Teams for Android affected versions not specified Description Improper neutralization of input during web page generation leads to cross-site scripting XSS, a technique where malicious scripts are injected into trusted websites. This...

KLA91207 Multiple vulnerabilities in Microsoft Products (ESU)

Multiple vulnerabilities were found in Microsoft Products ESU. Malicious users can exploit these vulnerabilities to bypass security restrictions, cause denial of service, execute arbitrary code, gain privileges, obtain sensitive information, perform cross-site scripting attack, spoof user...

Security Updates for Microsoft Outlook Products (August 2026)

The Microsoft Outlook Products are missing a security update. They are, therefore, affected by multiple vulnerabilities: - Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. CVE-2026-70329 - Heap-based buffer overflow in...

CVE-2026-72918

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the stream-notify-user stream in the WebSocket protocol allows an authenticated user to write arbitrary notification bodies because the sender ...

CVE-2026-72918 Rocket.Chat: Insecure implementation of websocket notifications

Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the stream-notify-user stream in the WebSocket protocol allows an authenticated user to write arbitrary notification bodies because the sender ...

CVE-2026-71576

A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source...

CVE-2026-71576

CVE-2026-71576 affects multicluster-global-hub: the manager component improperly validates the source identity of CloudEvents on Kafka status topics. A remote attacker who compromises a managed hub and obtains its Kafka client certificate can manipulate the self-asserted source identity, enabling...

CVE-2026-71576 Multicluster-global-hub: multicluster-global-hub: manager trusts self-asserted evt.source() for leaf-hub identity in all status handlers

A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source...

CVE-2026-71576

A flaw was found in multicluster-global-hub. The manager component improperly validates the source identity of incoming CloudEvents on Kafka status topics. A remote attacker, after compromising a managed hub and obtaining its Kafka client certificate, can manipulate the self-asserted source...

CVE-2026-66801

A flaw was found in multicluster-global-hub. An attacker who compromises a managed hub can leverage its legitimate Kafka client certificate to publish a CloudEvent a specification for describing event data in a common way message to the shared gh-spec topic. This message can spoof its source as...

EUVD-2026-55103

Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to spoof device identity...

CVE-2026-21078

Insufficient verification of data authenticity in Smart Switch trouble scanning mode prior to version 3.7.72.6 allows adjacent attackers to spoof device identity...

The vulnerability of the Web Speech component in the Firefox web browser and the Thunderbird email client allows attackers to compromise data integrity.

The vulnerability of the Web Speech component in the Firefox web browser and the Thunderbird email client involves bypassing authentication through spoofing. Exploiting this vulnerability allows a malicious actor to compromise data integrity...

The vulnerability of the Popup Blocker component in the Firefox web browser and Thunderbird email client allows a hacker to compromise data integrity.

The vulnerability of the Popup Blocker component in the Firefox web browser and Thunderbird email client is related to the false representation of critical information to the user interface. Exploiting this vulnerability could allow a malicious actor to compromise data integrity remotely...

EUVD-2026-51396

CodeIgniter: Spoofable forwarded HTTPS headers in IncomingRequest::isSecure...

SUSE CVE-2026-7867

A flaw was found in udisks2. A local attacker with an active console session can exploit insufficient authorization checking on the 'as-user' option in the org.freedesktop.UDisks2.Filesystem.Mount D-Bus method. This allows the attacker to spoof the 'as-user' parameter, mounting filesystems on...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1x) is affected by multiple vulnerabilities due to Eclipse Jetty

Summary Eclipse Jetty is used by IBM Cloud Pak for Data System 1x to provide web application server functionality. CVE-2026-10051 affects Jetty's HTTP/1.1 request handling when trailers are retained across multiple requests on the same connection, potentially exposing sensitive information from...

New NatJack Attacks Hijack TCP Sessions and Spoof DNS by Manipulating NAT Tables

Security researcher Malcolm Stagg has disclosed a new attack class called NatJack that manipulates network address translation NAT connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables. Presented at Black Hat USA 2026, the research found...

CVE-2026-15148 WP Events Manager < 2.2.5 - Unauthenticated Payment Bypass and Booking Status Update via IDOR

The WP Events Manager WordPress plugin before 2.2.5 does not verify that an incoming payment notification originates from the site's configured merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to mark any booking as paid without a legitimate...