SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

CVE-2026-108452: Microsoft SharePoint path traversal flaw patched in KB5002927

0
·3 views

A path traversal vulnerability, tracked as CVE-2026-108452, affects Microsoft SharePoint Server Subscription Edition on x64 systems. The vendor rates it 8.8 under CVSS 3.1 and says an authorized, low-privileged attacker over the network could execute code without user interaction. Affected builds run from 16.0.0 up to, but not including, 16.0.20326.20190, and Microsoft's fix ships in KB5002927, dated October 13, 2026. Farms running SharePoint Workflow Manager also need KB5002799 as a prerequisite, and classic installations require an additional debug flag step. Internet scans show large numbers of SharePoint fingerprints, but these counts do not confirm which hosts are actually vulnerable, since builds, ownership, and deployment editions vary. Security teams are advised to verify builds on every server before closing the patch effort.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Entwickler baut iOS-App für Clash-of-Clans-Layouts mit Fokus auf Spielerfilter

A developer has created a free, unofficial iOS app for finding Clash of Clans base layouts, not affiliated with Supercell. The app lets players filter bases by Town Hall level so that lower-level layouts are excluded for higher-level accounts. It separates layouts into modes for war, farming, and Clan War League, and allows a single tap to copy a layout directly into the game. According to the developer, usage data suggests players favor bases with fewer copies, since those are harder for opponents to prepare for.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Record a short repro for coding agents instead of describing bugs in Slack

The author argues that vague bug descriptions in Slack threads give coding agents too little to work with, leading to patches that miss the actual problem. Instead, they recommend a brief, replayable repro such as numbered steps, a failing URL, a minimal network snippet, a short recording, or the relevant console stack trace. The piece stresses keeping the effort proportionate, so the repro is cheaper than guessing. It also offers a reusable template that captures surface, environment, steps, expected and actual results, and artifacts, along with rules for keeping recordings useful. Slack is positioned for routing and triage, while the agent chat or pull request serves as the artifact layer.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Friday app shares corrections across coding agents so fixes carry over between tools

Friday is a free, MIT-licensed desktop app that runs coding agents such as Claude Code, Codex and Cursor side by side on a user's computer. After each run, the coding tool reads the session locally and records lessons like decisions, pitfalls, and conventions for that repository. When a user corrects an agent, that correction is passed to every agent that later works in the same repository, regardless of tool. If a mistake recurs, Friday can run a user-approved read-only or test command after changes and returns failures to the agent, and lessons unused for 60 days are retired. All lessons are viewable and editable in Settings under Memory, stored locally per repository, and the author notes the feature is new with no data yet on its effectiveness.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

LLM filter in a buyer-intent tool was blamed for empty outputs; the cause was a billing guard

A team behind Leadolovets, a service that scans open Telegram chats for buying intent, found that keyword search returned 542,795 matches but only 14,774 were real requests. Their LLM filter appeared to fail under parallel load, returning empty responses in 118 of 225 calls. The real cause was a billing check that returns an empty result instantly for accounts with expired subscriptions, so the model was never called. After fixing the test harness, the model answered all parallel and batched tests without failure. Measured on 100 requests from paying customers, the filter removed 95% of junk while losing about 18% of good requests, a figure the team later estimated closer to 5% after reviewing labeling errors.

0 comments Read more at DEV Community