Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.

Improper neutralization of special elements in data query logic in Microsoft Discovery Studio allows an unauthorized attacker to disclose information over a network.

Azure AI Language Elevation of Privilege Vulnerability

Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network.

Microsoft Fabric Elevation of Privilege Vulnerability

Power Automate Elevation of Privilege Vulnerability

Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.

Copilot Studio Elevation of Privilege Vulnerability

Entra ID Elevation of Privilege Vulnerability

A CSV injection vulnerability exists in SYS600. Injected malicious formulas can add or modify data to the spreadsheet, insert links, exfiltrate data, and in some cases, depending on how the user has their environment configured, execute malicious code on the user’s machine. To exploit this issue attackers would need a way to create arbitrary log messages. This could be achieved through normal functionality via SCIL scripts, a log injection vulnerability, or via the SYS600 broker. This vulnerability affects all Windows users regardless of their privilege level who can run the Notify service and export the log.

Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cliapi.py component exposes WinML CLI commands through a localhost HTTP API without authentication and configures the alloworigins setting as a wildcard in both src/winml/modelkit/serve/cliapi.py and src/winml/modelkit/serve/app.py. A malicious website loaded by a user can send cross-origin requests to /v1/cli/build or /v1/cli/config and set the trustremotecode parameter to true, which is converted to the --trust-remote-code command-line flag without validation. This reaches AutoConfig.frompretrained with trustremotecode=True in src/winml/modelkit/loader/autoconfig.py and imports Python code from an attacker-controlled model repository, resulting in arbitrary code execution as the server user. This issue is fixed in version 0.4.0.

Jenkins Microsoft Entra ID (previously Azure AD) Plugin 710.v0bff8e9cc2d2 and earlier grants Entra group permissions using both the group's unique object ID and its display name, allowing attackers who can create an Entra group with a colliding display name to gain the permissions configured for a privileged group.

A malicious virtual function can invoke the certain command handlers in the SMU, causing a denial of service due to out-of-bounds memory read.

Hey everyone, I recently finished a write-up on CVE-2026-68820, the Windows AFD.sys vulnerability exploited by Lazarus. I tried to explain the attack chain from start to finish — starting with the fake recruiter/job offer, moving through the initial malware execution, the AFD.sys use-after-free vulnerability, and finally how FudModule 3.1 was used after gaining SYSTEM-level access. I also covered some of the things I found interesting while researching it, especially how the rootkit interfered with Windows telemetry and how AFD.sys has been targeted by Lazarus before. The goal was to make it understandable even if you’re still learning Windows internals, while keeping enough technical detail for people working with threat hunting, DFIR, or malware analysis.

Write-up: https://medium.com/@R00tPi/inside-cve-2026-68820-how-lazarus-turned-a-core-windows-networking-driver-into-a-system-level-216656703750

Would be interested to hear what you think, especially if you spot anything I could improve or explain better.

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Improper neutralization of parameter/argument delimiters in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

Improper neutralization of input used for llm prompting in Microsoft Edge for iOS allows an unauthorized attacker to perform spoofing over a network.

Concurrent execution using shared resource with improper synchronization ('race condition') in Copilot Chat (Microsoft Edge) allows an authorized attacker to disclose information over a network.

Mail content stored by a user can be crafted so that it is interpreted as dsync protocol commands when an administrator later runs dsync with the stream protocol, for example during a migration. Injected commands can modify mailbox state on the destination during migration or replication, including internal mailbox attributes that a user should not be able to set directly. It can also cause dsync errors. Avoid running dsync with the stream protocol on mailboxes with untrusted content. Update to non-vulnerable version. No publicly available exploits are known.

Chromium: CVE-2026-84325 Improper input validation in DataTransfer

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.

In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions.