Microsoft

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2025-59252 1Microsoft 1365 Word Copilot Oct 8, 2026 Oct 9, 2025 N/A· v4 9.3 CRITICAL· v3 N/A· v2 Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose information over a network.
CVE-2025-59247 1Microsoft 1Azure Playfab Oct 8, 2026 Oct 9, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Azure PlayFab Elevation of Privilege Vulnerability
CVE-2025-59246 1Microsoft 1Entra Id Oct 8, 2026 Oct 9, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Azure Entra ID Elevation of Privilege Vulnerability
CVE-2025-59218 1Microsoft 1Entra Id Oct 8, 2026 Oct 9, 2025 N/A· v4 9.6 CRITICAL· v3 N/A· v2 Azure Entra ID Elevation of Privilege Vulnerability
CVE-2025-55321 1Microsoft 1Azure Monitor Oct 8, 2026 Oct 9, 2025 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Improper neutralization of input during web page generation ('cross-site scripting') in Azure Monitor allows an unauthorized attacker to perform spoofing over a network.
CVE-2025-59251 1Microsoft 1Edge Chromium Jun 17, 2026 Sep 24, 2025 N/A· v4 7.6 HIGH· v3 N/A· v2 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
CVE-2025-55322 1Microsoft 1Omniparser Jun 17, 2026 Sep 24, 2025 N/A· v4 7.3 HIGH· v3 N/A· v2 Binding to an unrestricted ip address in GitHub allows an unauthorized attacker to execute code over a network.
CVE-2025-59220 1Microsoft 8Windows 10 21h2 Windows 10 22h2Windows 11 22h2+5 more Jun 17, 2026 Sep 18, 2025 N/A· v4 7.0 HIGH· v3 N/A· v2 Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.
CVE-2025-59216 1Microsoft 2Windows 11 24h2 Windows Server 2025 Oct 18, 2026 Sep 18, 2025 N/A· v4 7.0 HIGH· v3 N/A· v2 Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
CVE-2025-59215 1Microsoft 2Windows 11 24h2 Windows Server 2025 Oct 18, 2026 Sep 18, 2025 N/A· v4 7.0 HIGH· v3 N/A· v2 Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
CVE-2025-49728 1Microsoft 1Pc Manager Jun 17, 2026 Sep 16, 2025 N/A· v4 4.0 MEDIUM· v3 N/A· v2 Cleartext storage of sensitive information in Microsoft PC Manager allows an unauthorized attacker to bypass a security feature locally.
CVE-2025-47967 1Microsoft 1Edge Jun 17, 2026 Sep 16, 2025 N/A· v4 4.7 MEDIUM· v3 N/A· v2 Insufficient ui warning of dangerous operations in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.
CVE-2025-55319 1Microsoft 1Visual Studio Code Jun 17, 2026 Sep 12, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2025-55317 1Microsoft 1Autoupdate Jun 17, 2026 Sep 9, 2025 N/A· v4 7.8 HIGH· v3 N/A· v2 Improper link resolution before file access ('link following') in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally.
CVE-2025-55316 1Microsoft 1Azure Connected Machine Agent Jun 17, 2026 Sep 9, 2025 N/A· v4 7.8 HIGH· v3 N/A· v2 External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally.
CVE-2025-55245 1Microsoft 1Xbox Gaming Services Jun 17, 2026 Sep 9, 2025 N/A· v4 7.8 HIGH· v3 N/A· v2 Improper link resolution before file access ('link following') in Xbox allows an authorized attacker to elevate privileges locally.
CVE-2025-55243 1Microsoft 1Officeplus Jun 17, 2026 Sep 9, 2025 N/A· v4 7.5 HIGH· v3 N/A· v2 Exposure of sensitive information to an unauthorized actor in Microsoft Office Plus allows an unauthorized attacker to perform spoofing over a network.
CVE-2025-55236 1Microsoft 10Windows 10 1809 Windows 10 21h2Windows 10 22h2+7 more Jun 17, 2026 Sep 9, 2025 N/A· v4 7.8 HIGH· v3 N/A· v2 Time-of-check time-of-use (toctou) race condition in Graphics Kernel allows an authorized attacker to execute code locally.
CVE-2025-55234 1Microsoft 15Windows 10 1507 Windows 10 1607Windows 10 1809+12 more Jun 17, 2026 Sep 9, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 SMB Server might be susceptible to relay attacks depending on the configuration. An attacker who successfully exploited these vulnerabilities could perform relay attacks and make the users subject to elevation of privile...Show more SMB Server might be susceptible to relay attacks depending on the configuration. An attacker who successfully exploited these vulnerabilities could perform relay attacks and make the users subject to elevation of privilege attacks. The SMB Server already supports mechanisms for hardening against relay attacks: SMB Server signing SMB Server Extended Protection for Authentication (EPA) Microsoft is releasing this CVE to provide customers with audit capabilities to help them to assess their environment and to identify any potential device or software incompatibility issues before deploying SMB Server hardening measures that protect against relay attacks. If you have not already enabled SMB Server hardening measures, we advise customers to take the following actions to be protected from these relay attacks: Assess your environment by utilizing the audit capabilities that we are exposing in the September 2025 security updates. See Support for Audit Events to deploy SMB Server Hardening—SMB Server Signing & SMB Server EPA. Adopt appropriate SMB Server hardening measures.Show less
CVE-2025-55232 1Microsoft 1Hpc Pack Jun 17, 2026 Sep 9, 2025 N/A· v4 9.8 CRITICAL· v3 N/A· v2 Deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC) allows an unauthorized attacker to execute code over a network.

Previous 1...231232233...892 Next