IT security 2026-07-24

Level Calm — 34/100 — 2026-07-24

Calm day: 10 stories ranked, 0 of the top 10 reported as actively exploited, 0 flaws newly added to CISA’s exploited-vulnerabilities catalogue. Top story: microsoft azure app service for linux: Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a net… (38/100).

  1. microsoft azure app service for linux: Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a net… — 38/100 (CVE-2026-58630)
  2. microsoft azure red hat openshift: Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges o… — 31/100 (CVE-2026-56160)
  3. microsoft azure key vault: Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a netwo… — 31/100 (CVE-2026-62825)
  4. microsoft azure dns: Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network. — 30/100 (CVE-2026-58275)
  5. CVE-2026-65906 — In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible — 30/100 (CVE-2026-65906)
  6. CVE-2026-64815 — In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files — 29/100 (CVE-2026-64815)
  7. CVE-2026-10697 — Improper Authentication vulnerability in Progress MOVEit Transfer. — 29/100 (CVE-2026-10697)
  8. CVE-2026-15966 — Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. — 29/100 (CVE-2026-15966)
  9. CVE-2026-15967 — Insufficient session expiration vulnerability in Progress MOVEit Transfer. — 29/100 (CVE-2026-15967)
  10. katacontainers kata containers: Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machin… — 18/100 (CVE-2026-44210)