79072 matches found
CVE-2026-69400
Improper limitation of a pathname to a restricted directory 'path traversal' in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-68789
Improper neutralization of special elements used in an sql command 'sql injection' in Azure SQL Database allows an authorized attacker to elevate privileges over a network...
CVE-2026-66800
Server-side request forgery ssrf in Azure Data Factory allows an unauthorized attacker to disclose information over a network...
CVE-2026-65816
Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-65801
Server-side request forgery ssrf in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-54509 TREK IDOR: any authenticated user can read another user's journey share token (full journey leak)
TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink from server/src/services/journeyShareService.ts without checking whether the authenticated requester can access the...
CVE-2026-69400
Azure Logic Apps path traversal flaw allows unauthenticated network attackers to elevate privileges. CVSS 9.6 (Critical) with high confidentiality, integrity, and availability impact. Microsoft Security Response Center is tracking the issue at the linked update guide; no patch version or exploita...
CVE-2026-66800
An SSRF flaw in Azure Data Factory lets an unauthenticated network attacker disclose sensitive information (CVSS 8.6 HIGH, scope changed). No exploit details are provided; Microsoft has published an update guide at the referenced MSRC link. Monitor for patch details and apply Azure Data Factory u...
CVE-2026-65816
Azure Arc (Microsoft) is affected by an elevation of privilege vulnerability caused by the use of an incorrectly-resolved name or reference. An unauthorized, unauthenticated attacker can exploit this over the network to gain elevated privileges, with high impact on confidentiality, integrity, and...
CVE-2026-65770
Azure Managed Instance for Apache Cassandra is affected by an argument injection vulnerability (improper neutralization of argument delimiters in a command) that allows an unauthorized attacker to execute code over a network without any privileges or user interaction. The CVSS 3.1 score is 10.0 (...
CVE-2026-69519
Azure Stack HCI has an observable response discrepancy vulnerability allowing an unauthenticated remote attacker to disclose sensitive information over the network. CVSS 3.1 scores it HIGH (8.6) with network attack vector and no privileges required. No patch version or exploitation details are pr...
CVE-2026-62834
CVE-2026-62834 is a critical elevation of privilege vulnerability in Azure Data Factory caused by improper verification of a cryptographic signature. An unauthorized attacker can exploit this over the network to elevate privileges, with high impact on both confidentiality and integrity (CVSS 3.1:...
Wagtail: Improper permission handling in image preview
Impact Due to a missing permission check on the image preview endpoint, a user with access to the Wagtail admin can preview any image. The existing data of the image object itself is not exposed. The vulnerability is not exploitable by an ordinary site visitor without access to the Wagtail admin...
EUVD-2026-63568
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the copyplugins endpoint in cms/admin/placeholderadmin.py authorizes only the destination clipboard. The copyplugintoclipboard and copyplaceholdertoclipboard paths accept...
MINI-3JQ8-Q8FC-HPWJ
Bulletin has no description...
CVE-2026-19611 Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords wer...
EUVD-2026-63478
A flaw was found in WildFly Elytron. Password hashing and verification normalize input with Unicode NFKC, which can collapse fullwidth characters to ASCII equivalents. A remote attacker can more easily guess affected passwords by using an ASCII-only dictionary against accounts whose passwords wer...
EUVD-2026-63403
Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or...
CVE-2026-56654
A flaw was found in Gitea. This vulnerability allows an attacker to escalate their privileges by manipulating the scope of an access token within the API. This means an attacker could gain unauthorized access to sensitive functions or data, potentially leading to full control over affected...
