Microsoft
microsoft
15,894 CVEs • 1,072 products
Products (1,072)
Click to collapseToggle
Products (1,072)
Click to collapse
CVEs (15,894)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
Improper neutralization of special elements in output used by a downstream component ('injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over a network. |
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an authorized attacker to execute code over a network. |
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network. |
Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
1Microsoft 1Azure Resource Manager Jul 23, 2026 May 22, 2026 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Improper authentication in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a network. |
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network. |
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network. |
Deserialization of untrusted data in Microsoft Planetary Computer Pro allows an unauthorized attacker to disclose information over a network. |
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network. |
Unrestricted upload of file with dangerous type in Azure Orbital Spatio allows an unauthorized attacker to execute code over a network. |
1Microsoft 1Azure Virtual Network Gateway Jul 23, 2026 May 22, 2026 N/A· v4 8.8 HIGH· v3 N/A· v2 Improper input validation in Azure Virtual Network Gateway allows an authorized attacker to execute code over a network. |
1Microsoft 1Azure Privileged Identity Management Jul 23, 2026 May 22, 2026 N/A· v4 8.8 HIGH· v3 N/A· v2 Authorization bypass through user-controlled key in Azure Privileged Identity Management (PIM) allows an authorized attacker to elevate privileges over a network. |
Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network. |
Improper input validation in Azure Compute Gallery allows an authorized attacker to disclose information over a network. |
Improper privilege management in Azure Entra ID allows an unauthorized attacker to elevate privileges over a network. |
Improper neutralization of special elements used in a command ('command injection') in Microsoft Power Pages allows an unauthorized attacker to execute code over a network. |
1Microsoft 1Malware Protection Engine Jul 23, 2026 May 20, 2026 N/A· v4 8.1 HIGH· v3 N/A· v2 Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network. |
1Microsoft 1Defender Antimalware Platform Jul 23, 2026 May 20, 2026 N/A· v4 7.5 HIGH· v3 N/A· v2 Microsoft Defender Denial of Service Vulnerability |
Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network. |