Vulnerability intelligence

CVE-2026-96207 is an elevation of privilege vulnerability affecting Microsoft Partner Center, a platform used by enterprises to manage cloud services, licenses, and customer accounts. The vulnerability stems from improper certificate validation mechanisms within the platform. This flaw allows an unauthorized attacker to exploit the validation process over a network, enabling them to elevate their privileges within the Microsoft Partner Center environment. Successful exploitation of this vulnerability can lead to unauthorized access and control over affected systems within the network. Microsoft has addressed the issue by incorporating it into its security update guidance. To mitigate potential exploitation risks, organizations are advised to apply the official patches provided by Microsoft and review their access controls.

CVE-2025-24201 is a zero-day vulnerability found in Apple's WebKit browser engine. This vulnerability allows attackers to bypass the Web Content sandbox using maliciously crafted web content. It affects various Apple devices and operating systems, including iOS, macOS, iPadOS, visionOS, and Safari, as well as Linux and Windows systems where WebKit is utilized. The vulnerability is an out-of-bounds write issue, and Apple has addressed it with improved checks in updates iOS 18.3.2, iPadOS 18.3.2, macOS Sequoia 15.3.2, visionOS 2.3.2, and Safari 18.3.1. This zero-day vulnerability was reportedly exploited in highly sophisticated attacks targeting specific individuals before the release of iOS 17.2, which contained a partial mitigation. While the attacks were not widespread, Apple urges users to install the latest security updates to prevent further exploitation attempts. The vulnerability was discovered by Bill Marczak of The Citizen Lab at the University of Toronto. It affects a wide range of Apple devices, including iPhone XS and later, several iPad models, Macs running macOS Sequoia, and Apple Vision Pro.

CVE-2026-82078 identifies an unsafe dynamic class-loading vulnerability present in the database connection utilities of PaperCut MF and PaperCut NG. This flaw allows the application to instantiate database driver classes using configurable driver names without proper validation against an approved allowlist of drivers. When exploited, particularly in conjunction with CVE-2026-81578 (an improper access control vulnerability), this vulnerability can enable an unauthenticated attacker to execute arbitrary Java bytecode. This chain of vulnerabilities ultimately facilitates pre-authentication remote code execution within the PaperCut Application Server.

Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API users with a lower privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for all API users but not other admin accounts.

Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence in an image upload parameter.

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.