Security Vulnerabilities
Improper access control in Azure Resource Manager allows an authorized attacker to elevate privileges over a network.
CVSS Score
9.9
EPSS Score
0.0
Published
2026-01-23
The ArchiveReader.extractContents() function used by cctl image load and container image load performs no pathname validation before extracting an archive member. This means that a carelessly or maliciously constructed archive can extract a file into any user-writable location on the system using relative pathnames. This issue is addressed in container 0.8.0 and containerization 0.21.0.
CVSS Score
7.8
EPSS Score
0.0
Published
2026-01-23
Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network.
CVSS Score
9.3
EPSS Score
0.001
Published
2026-01-22
Azure Entra ID Elevation of Privilege Vulnerability
CVSS Score
9.3
EPSS Score
0.001
Published
2026-01-22
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.
CVSS Score
8.2
EPSS Score
0.001
Published
2026-01-22
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Account allows an unauthorized attacker to perform spoofing over a network.
CVSS Score
9.3
EPSS Score
0.0
Published
2026-01-22
Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector
CVSS Score
7.5
EPSS Score
0.001
Published
2026-01-22
Improper neutralization of escape, meta, or control sequences in Copilot allows an unauthorized attacker to disclose information over a network.
CVSS Score
7.4
EPSS Score
0.001
Published
2026-01-22
Exposure of sensitive information to an unauthorized actor in Azure Data Explorer allows an unauthorized attacker to disclose information over a network.
CVSS Score
7.4
EPSS Score
0.001
Published
2026-01-22
This vulnerability occurs when the system permits multiple simultaneous
connections to the backend using the same charging station ID. This can
result in unauthorized access, data inconsistency, or potential
manipulation of charging sessions. The lack of proper session management
and expiration control allows attackers to exploit this weakness by
reusing valid charging station IDs to establish multiple sessions
concurrently.
CVSS Score
7.3
EPSS Score
0.0
Published
2026-01-22