Microsoft Ufo
17 CVEs affecting Microsoft Ufo. Latest disclosed: 2026-10-06. Critical: 2, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-73296 | Critical | 9.4 | 2026-08-12 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mo… |
CVE-2026-105793 | Critical | 9.1 | 2026-10-06 | Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the press_key tool in ufo/client/mcp/http_se… |
CVE-2026-105788 | High | 8.8 | 2026-10-06 | Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the type_text and launch_app tools in ufo/c… |
CVE-2026-62316 | High | 8.8 | 2026-08-21 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, ufo/client/mcp/http_servers/linux_mcp_server.py bi… |
CVE-2026-46414 | High | 8.8 | 2026-05-27 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO's WebSocket control plane trus… |
CVE-2026-46402 | High | 8.1 | 2026-05-27 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO uses the user-controlled task_… |
CVE-2026-45322 | High | 7.8 | 2026-05-27 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Microsoft UFO tagged releases up to and including v3.0.0 contain a… |
CVE-2026-105791 | High | 7.5 | 2026-10-06 | Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the run_shell tool in the CommandLineExecuto… |
CVE-2026-105792 | Medium | 6.5 | 2026-10-06 | Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the /api/task_result/{task_name} endpoint ca… |
CVE-2026-55440 | Medium | 6.5 | 2026-07-16 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.7, the COMMAND_RESULTS handler in ufo/server/ws/handl… |
CVE-2026-105790 | Medium | 6.4 | 2026-10-06 | Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, authenticated device registration through /a… |
CVE-2026-46416 | Medium | 6.3 | 2026-05-27 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO creates one shared UFOWebSocke… |
CVE-2026-46538 | Medium | 5.9 | 2026-05-27 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO's constellation client tracks… |
CVE-2026-105789 | Medium | 5.4 | 2026-10-06 | Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the execute_command tool in ufo/client/mcp/h… |
CVE-2026-46544 | Medium | 5.3 | 2026-05-27 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO accepts client-supplied sessio… |
CVE-2026-54568 | Medium | 4.3 | 2026-07-16 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a client connected to the UFO WebSocket se… |
CVE-2026-73297 | | 2026-08-12 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, _is_blocked_ip in ufo/utils/url_security.py did no… |