Microsoft
microsoft
17,821 CVEs • 1,094 products
Products (1,094)
Click to collapseToggle
Products (1,094)
Click to collapse
CVEs (17,821)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
1Microsoft 14Windows 10 1607 Windows 10 1809Windows 10 21h2+11 moreJun 17, 2026 May 12, 2026 N/A· v4 6.7 MEDIUM· v3 N/A· v2 Double free in Windows Rich Text Edit allows an authorized attacker to elevate privileges locally. |
Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network. |
1Microsoft 1Azure Monitor Action Group Notification System Oct 26, 2026 May 7, 2026 N/A· v4 8.1 HIGH· v3 N/A· v2 Server-side request forgery (ssrf) in Azure Notification Service allows an authorized attacker to elevate privileges over a network. |
Improper access control in Azure AI Foundry M365 published agents allows an unauthorized attacker to elevate privileges over a network. |
Improper neutralization of special elements used in a command ('command injection') in Azure Cloud Shell allows an unauthorized attacker to perform spoofing over a network. |
Externally controlled reference to a resource in another sphere in Microsoft Partner Center allows an unauthorized attacker to perform spoofing over a network. |
1Microsoft 1Azure Managed Instance For Apache Cassandra Oct 26, 2026 May 7, 2026 N/A· v4 9.0 CRITICAL· v3 N/A· v2 Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network. |
Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network. |
Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over a network. |
1Microsoft 1Azure Managed Instance For Apache Cassandra Oct 26, 2026 May 7, 2026 N/A· v4 9.9 CRITICAL· v3 N/A· v2 Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network. |
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Machine Learning allows an unauthorized attacker to perform spoofing over a network. |
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network. |
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network. |
Exposure of sensitive information to an unauthorized actor in Azure IOT Central allows an authorized attacker to elevate privileges over a network. |
go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using `...Show more |
Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to perform spoofing over a network. |
Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code over a network. |
Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network. |
Server-side request forgery (ssrf) in Microsoft Dynamics 365 (Online) allows an unauthorized attacker to perform spoofing over a network. |
Uncontrolled search path element in Microsoft Power Apps allows an unauthorized attacker to execute code over a network. |