🚨 CVE-2024-30097
Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution Vulnerability
🎖@cveNotify
Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution Vulnerability
🎖@cveNotify
🚨 CVE-2024-35248
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
🎖@cveNotify
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
🎖@cveNotify
🚨 CVE-2024-35249
Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability
🎖@cveNotify
Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability
🎖@cveNotify
🚨 CVE-2024-35255
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
🎖@cveNotify
Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
🎖@cveNotify
🚨 CVE-2024-35263
Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
🎖@cveNotify
Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
🎖@cveNotify
🚨 CVE-2024-37325
Azure Science Virtual Machine (DSVM) Elevation of Privilege Vulnerability
🎖@cveNotify
Azure Science Virtual Machine (DSVM) Elevation of Privilege Vulnerability
🎖@cveNotify
🚨 CVE-2024-35260
An authenticated attacker can exploit an untrusted search path vulnerability in Microsoft Dataverse to execute code over a network.
🎖@cveNotify
An authenticated attacker can exploit an untrusted search path vulnerability in Microsoft Dataverse to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-57956
SigNoz before 0.133.0 contains a broken access control vulnerability that allows authenticated users to access other organizations' alert rules by supplying a target rule UUID, as the alert rule store predicates fail to filter by organization ID. Attackers can read, edit, and delete alert rules belonging to other organizations by exploiting the missing tenant isolation check, bypassing multi-tenant access controls.
🎖@cveNotify
SigNoz before 0.133.0 contains a broken access control vulnerability that allows authenticated users to access other organizations' alert rules by supplying a target rule UUID, as the alert rule store predicates fail to filter by organization ID. Attackers can read, edit, and delete alert rules belonging to other organizations by exploiting the missing tenant isolation check, bypassing multi-tenant access controls.
🎖@cveNotify
GitHub
[security] cross-organization IDOR on alert rules (read/edit/delete by UUID, no org scoping) · Issue #11830 · SigNoz/signoz
(I've reported the following cross-org IDOR via email on 13 June 2026 with no response) The rule store predicates (pkg/ruler/rulestore/sqlrulestore/rule.go) filter on id only: GetStoredRule (~1...