Microsoft
microsoft
17,821 CVEs • 1,094 products
Products (1,094)
Click to collapseToggle
Products (1,094)
Click to collapse
CVEs (17,821)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
Improper certificate validation in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network. |
Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network. |
Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network. |
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network. |
1Microsoft 2Exchange Server Exchange Server Subscription EditionOct 15, 2026 Oct 2, 2026 N/A· v4 8.8 HIGH· v3 N/A· v2 Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
1Microsoft 3365 Apps Office 2021Office 2024Oct 28, 2026 Sep 25, 2026 N/A· v4 8.1 HIGH· v3 N/A· v2 Integer overflow or wraparound in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network. |
1Microsoft 3365 Apps Office 2021Office 2024Oct 30, 2026 Sep 23, 2026 N/A· v4 7.8 HIGH· v3 N/A· v2 Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code locally. |
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges locally. |
Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network. |
Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network. |
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Portal allows an unauthorized attacker to perform spoofing over a network. |
Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network. |
Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network. |
Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network. |
Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network. |
Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network. |
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network. |
Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network. |
Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network. |
Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network. |