Insights from the 2026 Microsoft Digital Defense Report
Read highlights from the 2026 Microsoft Digital Defense Report, which reflects a security environment that continues to
#microsoft
共收录 2274 条相关情报。
← 返回所有主题Preparing governments for an era of interconnected cyber risk
According to this year’s Microsoft Digital Defense Report, government agencies and services were the sector most impacte
gitoxide gix-fs before 0.23.0 Worktree Escape via Symlink
CVE-2026-100419
gitoxide gix-fs before 0.23.0 Worktree Escape via Symlink
Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)
CVE-2026-95519
Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)
Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm
CVE-2026-95521
Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm
RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint
CVE-2026-67410
RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint
RabbitMQ: Trust-store whitelist by Issuer+Serial only
CVE-2026-67231
RabbitMQ: Trust-store whitelist by Issuer+Serial only
Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape
CVE-2026-93834
Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape
Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram
CVE-2026-81627
Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram
Axios: Header Injection via Inherited headers After Minimal Interceptor
CVE-2026-101904
Axios: Header Injection via Inherited headers After Minimal Interceptor
sprintf-js through 1.1.3 Denial of Service via Unbounded Precision
CVE-2026-97058
sprintf-js through 1.1.3 Denial of Service via Unbounded Precision
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
CVE-2026-102277
brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
CVE-2026-102276
brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion
Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Method
CVE-2026-101902
Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Meth
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
CVE-2026-102278
brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion
PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
CVE-2026-102266
PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validation
PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set
CVE-2026-102274
PyJWT: Malformed RSA JWK aborts parsing of an entire JWK Set
PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion
CVE-2026-102275
PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusion
PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header
CVE-2026-102265
PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token header
PyJWT accepts public JWK containers as HMAC secrets
CVE-2026-102273
PyJWT accepts public JWK containers as HMAC secrets