Askany < 2.2.1 - Unauthenticated Chat Session Disclosure and Modification via IDOR

The AskAny WordPress plugin before 2.2.1 does not verify that a chat session belongs to the requester before returning or changing it, allowing unauthenticated users who obtain or guess another visitor's session identifier to read that visitor's chat transcript, name, email address and IP address, and to add messages to their conversation or overwrite their details.

WordPress ElitePress theme <= 3.2.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in webriti ElitePress elitepress allows Cross Site Request Forgery.This issue affects ElitePress: from n/a through 3.2.1.

Microsoft SQL Server Information Disclosure Vulnerability

Use of a broken or risky cryptographic algorithm in SQL Server allows an unauthorized attacker to disclose information over a network.

Security Advisory 0220

On affected Arista EOS platforms with Routing Information Protocol version 2 (RIPv2) configured, under certain conditions, RIPv2 might be silently enabled on management interfaces even when the RIP agent intends to disable it. It allows an unauthenticated attacker with access to the adjacent network to send crafted RIPv2 route advertisements to the device's management IP address. The device could accept and install those routes without authentication. Successful exploitation could allow the attacker to redirect traffic flows to an attacker-controlled destination, install more-specific routes that blackhole legitimate traffic, or otherwise disrupt network reachability for systems whose traffic passes through the affected device.

Security Advisory 0206

On affected platforms running Arista EOS with Bidirectional Forwarding Detection (BFD) configured to use keyed MD5 or keyed SHA1 authentication, an unauthenticated attacker with network adjacency (direct or multi-hop) to a BFD-enabled interface can send a specially crafted BFD packet resulting in a system reboot.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as a duplicate of CVE-2026-82873.

Windows Installer Elevation of Privilege Vulnerability

Time-of-check time-of-use (toctou) race condition in Windows Installer allows an authorized attacker to elevate privileges locally.

Microsoft Office SharePoint Information Disclosure Vulnerability

Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

Microsoft Office SharePoint Elevation of Privilege Vulnerability

Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

Windows Admin Center Elevation of Privilege Vulnerability

Improper authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network.

Azure DevOps Server Elevation of Privilege Vulnerability

Weak authentication in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.

Microsoft High Performance Computing (HPC) Pack Elevation of Privilege Vulnerability

Missing authentication for critical function in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to elevate privileges over a network.

Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability

Improper privilege management in Microsoft Azure Kubernetes Service allows an authorized attacker to elevate privileges locally.

Azure Confidential Clean Rooms Tampering Vulnerability

Missing authorization in Azure Confidential Clean Rooms allows an authorized attacker to perform tampering over a network.

Visual Studio Code Security Feature Bypass Vulnerability

Trust boundary violation in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.

Aspire Information Disclosure Vulnerability

Insertion of sensitive information into log file in Aspire allows an authorized attacker to disclose information locally.

Microsoft SQL Server Elevation of Privilege Vulnerability

Exposed dangerous method or function in SQL Server allows an authorized attacker to elevate privileges over a network.

Visual Studio Code Security Feature Bypass Vulnerability

Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Azure Managed Grafana Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Azure Managed Grafana allows an unauthorized attacker to elevate privileges over a network.

Microsoft Teams for Android Spoofing Vulnerability

Improper control of generation of code ('code injection') in Microsoft Teams for Android allows an unauthorized attacker to perform spoofing over a network.