Threat database

A denial of service vulnerability exists in libexpat through version 2.9.0 related to delayed detection of the Billion Laughs attack pattern. This vulnerability can cause the software to become unresponsive or crash when processing specially crafted XML input. The affected version explicitly noted is version 3.0 of the Microsoft product referencing libexpat. No CVSS score or detailed impact metrics are provided.

Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.

Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.

Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.

Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.

Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.

Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.

BlueHammer (CVE-2026-33825) is a local privilege escalation chain targeting Windows Defender Antimalware Platform versions before 4.18.26030.3011. It requires initial code execution as a standard user and uses a series of legitimate Windows mechanisms to escalate privileges to NT AUTHORITY\SYSTEM. The exploit freezes the MsMpEng.exe process via CloudFilter manipulation and stages malicious update files. Laboratory tests demonstrated successful privilege escalation, recovery of domain-admin credentials from LSASS, and lateral movement using pass-the-hash techniques to compromise domain controllers. Exploitability depends on runtime factors such as pending signature updates, Defender state, filter drivers, VSS, and CloudFilter reachability. No known exploits are reported in the wild, and no patch information is provided.

RabbitMQ versions from 3.13.0 up to but not including 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18 contain a vulnerability where the JWKS key fetching mechanism ignores HTTP response status codes. This causes the system to treat error responses as successful, leading to destruction of cached signing keys and a persistent denial of service for OAuth2 authentication until a new successful JWKS refresh occurs. This allows an attacker to deny access to all OAuth2 users on the RabbitMQ server. The issue is fixed in versions 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18.

RabbitMQ versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 have a vulnerability in the OAuth2 plugin where, if no CA bundle is available, the ssl_options/1 function falls back to no certificate verification without warning. This allows a man-in-the-middle attacker to forge JWKS responses and cause the broker to accept arbitrary JWTs. The vulnerability requires the OAuth2 plugin to be in use without a configured cacertfile and an empty or unreadable OS CA bundle, conditions common in minimal container environments. The issue is fixed in the stated versions.

RabbitMQ prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 contains an authorization bypass vulnerability in the management plugin. The /api/queues/quorum/:vhost/:queue/status API endpoint reads the virtual host (vhost) from the path without verifying user access rights. Consequently, any user with the management tag can access Raft status information for quorum queues in vhosts they should not access, exposing cross-tenant queue names and cluster topology. This issue requires the management plugin to be enabled and the attacker to have a management tag. The vulnerability is fixed in the specified versions.

Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like +(*) or +(*a), which analyzeRepeatedExtglob in lib/parse.js skips, causing exponential backtracking against short crafted strings and denying service to Node.js applications.

CVE-2026-80092 is an authentication bypass vulnerability in Microsoft Identity Web that allows an authorized attacker to elevate privileges over a network. The issue stems from assumed-immutable data leading to improper authentication checks. A fix is available and has been officially released by Microsoft. The vulnerability affects versions from 1.0.0 up to but not including 4.16.1. The CVSS 3.1 base score is 5.3, indicating medium severity.

CVE-2026-109461 is an origin validation error vulnerability in Microsoft Authentication Library (MSAL) for Node.js. It allows an unauthorized attacker to disclose information over a network. The vulnerability affects Microsoft Identity Client for NodeJS versions from 5.0.0 up to but not including 7.1.0. The issue has a medium severity with a CVSS score of 5.9. An official fix is available from Microsoft.

Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.

Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.

Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.