|
861
|
8.6 |
HIGH
Network
|
-
|
-
|
The OttoKit: All-in-One Automation Platform WordPress plugin before 1.1.23 does not properly sanitize user input before using it in a SQL statement, which could allow unauthenticated attackers to per…
New
|
CWE-89
SQL Injection
|
CVE-2026-4935
|
2026-05-9 00:47 |
2026-05-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
862
|
7.5 |
HIGH
Network
|
-
|
-
|
Improper neutralization of special elements in M365 Copilot allows an unauthorized attacker to disclose information over a network.
New
|
CWE-138
Improper Neutralization of Special Elements
|
CVE-2026-26129
|
2026-05-9 00:47 |
2026-05-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
863
|
7.5 |
HIGH
Network
|
-
|
-
|
Improper neutralization of special elements in output used by a downstream component ('injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.
New
|
CWE-74
Injection
|
CVE-2026-26164
|
2026-05-9 00:47 |
2026-05-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
864
|
8.8 |
HIGH
Network
|
-
|
-
|
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network.
New
|
CWE-79
Cross-site Scripting
|
CVE-2026-32207
|
2026-05-9 00:47 |
2026-05-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
865
|
9.9 |
CRITICAL
Network
|
-
|
-
|
Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network.
New
|
CWE-284
Improper Access Control
|
CVE-2026-33109
|
2026-05-9 00:47 |
2026-05-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
866
|
7.5 |
HIGH
Network
|
-
|
-
|
Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over a network.
New
|
CWE-77
Command Injection
|
CVE-2026-33111
|
2026-05-9 00:47 |
2026-05-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
867
|
9.6 |
CRITICAL
Network
|
-
|
-
|
Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network.
New
|
CWE-285
Improper Authorization
|
CVE-2026-33823
|
2026-05-9 00:47 |
2026-05-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
868
|
9.0 |
CRITICAL
Network
|
-
|
-
|
Improper input validation in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network.
New
|
CWE-20
Improper Input Validation
|
CVE-2026-33844
|
2026-05-9 00:47 |
2026-05-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
869
|
8.2 |
HIGH
Network
|
-
|
-
|
Externally controlled reference to a resource in another sphere in Microsoft Partner Center allows an unauthorized attacker to perform spoofing over a network.
New
|
CWE-610
Externally Controlled Reference to a Resource in Another Sphere
|
CVE-2026-34327
|
2026-05-9 00:47 |
2026-05-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
870
|
9.6 |
CRITICAL
Network
|
-
|
-
|
Improper neutralization of special elements used in a command ('command injection') in Azure Cloud Shell allows an unauthorized attacker to perform spoofing over a network.
New
|
CWE-77
Command Injection
|
CVE-2026-35428
|
2026-05-9 00:47 |
2026-05-8 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
