Microsoft

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2026-26125 1Microsoft 1Payment Orchestrator Service Jun 17, 2026 Mar 5, 2026 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Payment Orchestrator Service Elevation of Privilege Vulnerability
CVE-2026-26124 1Microsoft 1Aci Confidential Containers Jun 17, 2026 Mar 5, 2026 N/A· v4 6.7 MEDIUM· v3 N/A· v2 '.../...//' in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.
CVE-2026-26122 1Microsoft 1Aci Confidential Containers Jun 17, 2026 Mar 5, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Initialization of a resource with an insecure default in Azure Compute Gallery allows an authorized attacker to disclose information over a network.
CVE-2026-23651 1Microsoft 1Aci Confidential Containers Jun 17, 2026 Mar 5, 2026 N/A· v4 6.7 MEDIUM· v3 N/A· v2 Permissive regular expression in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.
CVE-2026-21536 1Microsoft 1Devices Pricing Program Jun 17, 2026 Mar 5, 2026 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Microsoft Devices Pricing Program Remote Code Execution Vulnerability
CVE-2026-21535 1Microsoft 1Teams Jun 17, 2026 Feb 19, 2026 N/A· v4 7.5 HIGH· v3 N/A· v2 Improper access control in Microsoft Teams allows an unauthorized attacker to disclose information over a network.
CVE-2026-26030 1Microsoft 1Semantic Kernel Jun 17, 2026 Feb 19, 2026 N/A· v4 9.9 CRITICAL· v3 N/A· v2 Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically within the `InMemoryVectorStore` filter functionality. The problem has been fix...Show more Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically within the `InMemoryVectorStore` filter functionality. The problem has been fixed in version `python-1.39.4`. Users should upgrade this version or higher. As a workaround, avoid using `InMemoryVectorStore` for production scenarios.Show less
CVE-2026-26119 1Microsoft 1Windows Admin Center Jun 17, 2026 Feb 17, 2026 N/A· v4 8.8 HIGH· v3 N/A· v2 Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
CVE-2026-0102 1Microsoft 1Edge Chromium Jun 17, 2026 Feb 17, 2026 N/A· v4 3.1 LOW· v3 N/A· v2 Under specific conditions, a malicious webpage may trigger autofill population after two consecutive taps, potentially without clear or intentional user consent. This could result in disclosure of stored autofill data su...Show more Under specific conditions, a malicious webpage may trigger autofill population after two consecutive taps, potentially without clear or intentional user consent. This could result in disclosure of stored autofill data such as addresses, email, or phone number metadata.Show less
CVE-2026-23655 1Microsoft 1Confidential Sidecar Containers Jun 17, 2026 Feb 10, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Cleartext storage of sensitive information in Azure Compute Gallery allows an authorized attacker to disclose information over a network.
CVE-2026-21537 1Microsoft 1Defender For Endpoint Jun 17, 2026 Feb 10, 2026 N/A· v4 8.8 HIGH· v3 N/A· v2 Improper control of generation of code ('code injection') in Microsoft Defender for Linux allows an unauthorized attacker to execute code over an adjacent network.
CVE-2026-21533 1Microsoft 13Windows 10 1607 Windows 10 1809Windows 10 21h2+10 more Jun 17, 2026 Feb 10, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.
CVE-2026-21531 1Microsoft 1Azure Conversation Authoring Client Library Jun 17, 2026 Feb 10, 2026 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network.
CVE-2026-21529 1Microsoft 1Azure Hdinsight Jun 17, 2026 Feb 10, 2026 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Improper neutralization of input during web page generation ('cross-site scripting') in Azure HDInsights allows an authorized attacker to perform spoofing over a network.
CVE-2026-21528 1Microsoft 1Azure Iot Explorer Jun 17, 2026 Feb 10, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Binding to an unrestricted ip address in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.
CVE-2026-21527 1Microsoft 2Exchange Server Exchange Server Subscription Edition Jun 17, 2026 Feb 10, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-21525 1Microsoft 13Windows 10 1607 Windows 10 1809Windows 10 21h2+10 more Jun 17, 2026 Feb 10, 2026 N/A· v4 6.2 MEDIUM· v3 N/A· v2 Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.
CVE-2026-21523 1Microsoft 1Visual Studio Code Jun 17, 2026 Feb 10, 2026 N/A· v4 8.0 HIGH· v3 N/A· v2 Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.
CVE-2026-21522 1Microsoft 1Confcom Jun 17, 2026 Feb 10, 2026 N/A· v4 6.7 MEDIUM· v3 N/A· v2 Improper neutralization of special elements used in a command ('command injection') in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.
CVE-2026-21519 1Microsoft 12Windows 10 1607 Windows 10 1809Windows 10 21h2+9 more Jun 17, 2026 Feb 10, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

Previous 1...626364...748 Next