Microsoft
Page 14 of 100 — Microsoft CVEs from a corpus of 26181, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14012 | Medium | 5.3 | 2026-06-30 | Side-channel information leakage in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from proc… |
CVE-2026-14010 | Medium | 6.5 | 2026-06-30 | Uninitialized Use in Codecs in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from proce… |
CVE-2026-13993 | Medium | 4.2 | 2026-06-30 | Incorrect security UI in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gesture… |
CVE-2026-13990 | Medium | 6.5 | 2026-06-30 | Insufficient validation of untrusted input in DataTransfer in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the… |
CVE-2026-13973 | Medium | 4.2 | 2026-06-30 | Inappropriate implementation in UI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to… |
CVE-2026-13971 | Medium | 5.3 | 2026-06-30 | Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potentially sens… |
CVE-2026-13970 | Medium | 5.3 | 2026-06-30 | Uninitialized Use in Media in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potentially sen… |
CVE-2026-13961 | Medium | 5.3 | 2026-06-30 | Insufficient validation of untrusted input in DevTools in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to eng… |
CVE-2026-13958 | Medium | 6.5 | 2026-06-30 | Uninitialized Use in Codecs in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from proce… |
CVE-2026-13931 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in Media in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-13925 | High | 7.5 | 2026-06-30 | Inappropriate implementation in Downloads in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specif… |
CVE-2026-13920 | Critical | 9.6 | 2026-06-30 | Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the render… |
CVE-2026-13896 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML… |
CVE-2026-13894 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed an attacker in a privileged network position to bypass navigation re… |
CVE-2026-13891 | High | 7.5 | 2026-06-30 | Insufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer pro… |
CVE-2026-13890 | Medium | 5.3 | 2026-06-30 | Out of bounds read in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potential… |
CVE-2026-13888 | High | 8.8 | 2026-06-30 | Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML pa… |
CVE-2026-13886 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in Isolated Web Apps in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass content security policy via a… |
CVE-2026-13883 | Critical | 9.6 | 2026-06-30 | Type Confusion in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chr… |
CVE-2026-13882 | Critical | 9.6 | 2026-06-30 | Race in USB in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape… |
CVE-2026-13881 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTM… |
CVE-2026-13879 | Medium | 6.5 | 2026-06-30 | Use after free in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed an attacker on the local network segment to obtain potentially sensitive informatio… |
CVE-2026-13877 | Medium | 5.3 | 2026-06-30 | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-13875 | Medium | 5.3 | 2026-06-30 | Insufficient validation of untrusted input in GPU in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer… |
CVE-2026-13874 | Medium | 5.3 | 2026-06-30 | Race in DataTransfer in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a cr… |
CVE-2026-13873 | Medium | 6.5 | 2026-06-30 | Out of bounds read in Layout in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory… |
CVE-2026-13869 | Critical | 9.6 | 2026-06-30 | Use after free in Device in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially p… |
CVE-2026-13861 | Critical | 9.6 | 2026-06-30 | Use after free in Core in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sand… |
CVE-2026-13860 | Medium | 4.2 | 2026-06-30 | Incorrect security UI in Autofill in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI ge… |
CVE-2026-13859 | Critical | 9.6 | 2026-06-30 | Inappropriate implementation in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafted H… |
CVE-2026-13853 | Critical | 9.6 | 2026-06-30 | Use after free in Journeys in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2026-13849 | High | 8.6 | 2026-06-30 | Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to potentially perform a s… |
CVE-2026-13848 | High | 8.8 | 2026-06-30 | Use after free in Forms in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (… |
CVE-2026-13845 | High | 8.8 | 2026-06-30 | Use after free in DOM in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Ch… |
CVE-2026-13844 | High | 7.8 | 2026-06-30 | Use after free in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation via a malicious… |
CVE-2026-13831 | High | 7.5 | 2026-06-30 | Out of bounds read and write in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to execute arbit… |
CVE-2026-13829 | High | 8.3 | 2026-06-30 | Insufficient validation of untrusted input in Settings in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the ren… |
CVE-2026-13828 | Medium | 6.5 | 2026-06-30 | Inappropriate implementation in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from p… |
CVE-2026-13825 | High | 8.8 | 2026-06-30 | Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2026-13824 | High | 7.5 | 2026-06-30 | Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to per… |
CVE-2026-13821 | High | 8.8 | 2026-06-30 | Use after free in Canvas in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-13811 | High | 8.8 | 2026-06-30 | Use after free in IME in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Ch… |
CVE-2026-13801 | High | 8.3 | 2026-06-30 | Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perfor… |
CVE-2026-13800 | High | 7.8 | 2026-06-30 | Inappropriate implementation in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation vi… |
CVE-2026-13799 | High | 8.1 | 2026-06-30 | Use after free in QUIC in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via malicious network traffic… |
CVE-2026-13798 | Critical | 9.6 | 2026-06-30 | Heap buffer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially pe… |
CVE-2026-13797 | Critical | 9.6 | 2026-06-30 | Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer pro… |
CVE-2026-13796 | Critical | 9.6 | 2026-06-30 | Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perfor… |
CVE-2026-13794 | High | 7.5 | 2026-06-30 | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user… |
CVE-2026-13793 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Ch… |
CVE-2026-13791 | High | 8.1 | 2026-06-30 | Insufficient validation of untrusted input in Downloads in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious… |
CVE-2026-13787 | High | 8.1 | 2026-06-30 | Use after free in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traff… |
CVE-2026-13784 | High | 8.8 | 2026-06-30 | Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially… |
CVE-2026-13783 | High | 8.8 | 2026-06-30 | Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially… |
CVE-2026-13782 | Critical | 10.0 | 2026-06-30 | Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
CVE-2026-13781 | Critical | 9.6 | 2026-06-30 | Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process t… |
CVE-2026-13780 | Critical | 9.6 | 2026-06-30 | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-13777 | High | 8.8 | 2026-06-30 | Insufficient validation of untrusted input in iOSWeb in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corru… |
CVE-2026-13776 | Critical | 9.8 | 2026-06-30 | Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sand… |
CVE-2026-13775 | Critical | 9.8 | 2026-06-30 | Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandb… |
CVE-2026-13774 | High | 8.1 | 2026-06-30 | Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to execute arbit… |
CVE-2026-11906 | Medium | 6.5 | 2026-06-30 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow an authenticated user to cause a… |
CVE-2025-36372 | Medium | 5.5 | 2026-06-30 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive information to an a… |
CVE-2026-49451 | High | 7.5 | 2026-06-30 | The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to extract raw OpenAPI JSON and YAML documents f… |
CVE-2026-48286 | Critical | 10.0 | 2026-06-30 | Adobe Campaign Classic (ACC) versions 7.4.3 build 9396 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code… |
CVE-2026-13281 | High | 8.3 | 2026-06-25 | Integer overflow in Mojo in Google Chrome prior to 149.0.7827.201 allowed a remote attacker who had compromised the renderer process to potentially perform a s… |
CVE-2026-13038 | High | 8.8 | 2026-06-24 | Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Ch… |
CVE-2026-13036 | High | 8.8 | 2026-06-24 | Use after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-13034 | Medium | 4.7 | 2026-06-24 | Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to bypass… |
CVE-2026-13033 | High | 8.8 | 2026-06-24 | Out of bounds read and write in Blink>InterestGroups in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code via a crafted… |
CVE-2026-13031 | High | 8.8 | 2026-06-24 | Use after free in Blink in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-13029 | High | 7.5 | 2026-06-24 | Use after free in Web Authentication in Google Chrome prior to 149.0.7827.197 allowed an attacker who convinced a user to install a malicious extension to pote… |
CVE-2026-13027 | High | 8.8 | 2026-06-24 | Use after free in FileSystem in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2026-13025 | High | 8.3 | 2026-06-24 | Race in DevTools in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox e… |
CVE-2026-13024 | Medium | 4.2 | 2026-06-24 | Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer pr… |
CVE-2026-13023 | Medium | 5.3 | 2026-06-24 | Uninitialized Use in GPU in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to obtain potentially sens… |
CVE-2026-13022 | Medium | 6.5 | 2026-06-24 | Inappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised the renderer process to leak cr… |
CVE-2026-13021 | Medium | 4.3 | 2026-06-24 | Inappropriate implementation in DeviceBoundSessionCredentials in Google Chrome prior to 149.0.7827.197 allowed a remote attacker to bypass same origin policy v… |
CVE-2026-52844 | High | 7.5 | 2026-06-23 | Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, on Windows, Caddy path matchers treat /private\secret.txt as outside /private… |
CVE-2026-49402 | High | 8.1 | 2026-06-23 | Deno is a JavaScript, TypeScript, and WebAssembly runtime. Prior to 2.7.10, Deno's node:child_process implementation provided an escapeShellArg() helper used w… |
CVE-2020-9713 | Medium | 5.5 | 2026-06-23 | Adobe Acrobat and Reader versions 2020.009.20074 and earlier, 2020.001.30002, 2017.011.30171 and earlier, and 2015.006.30523 and earlier are affected by an out… |
CVE-2020-9711 | Medium | 5.5 | 2026-06-23 | Acrobat Reader versions 2020.009.20074, 2020.001.30002, 2017.011.30171, 2015.006.30523 and earlier are affected by an out-of-bounds read vulnerability that cou… |
CVE-2020-9695 | High | 7.8 | 2026-06-23 | Acrobat Reader versions 2020.009.20074, 2020.001.30002, 2017.011.30171, 2015.006.30523 and earlier are affected by an out-of-bounds write vulnerability that co… |
CVE-2026-53571 | High | 7.5 | 2026-06-22 | Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents of files that are specified by server.fs.deny can be retur… |
CVE-2026-9320 | Medium | 5.9 | 2026-06-22 | IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, c… |
CVE-2026-9071 | High | 7.5 | 2026-06-22 | IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to a denial of service, c… |
CVE-2026-9006 | High | 7.4 | 2026-06-22 | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) with the Ajax Proxy configured. This may allow an attacker to… |
CVE-2026-8646 | High | 7.4 | 2026-06-22 | IBM WebSphere Application Server 9.0 and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.6 are vulnerable to HTTP request smuggling… |
CVE-2026-10845 | High | 7.3 | 2026-06-22 | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to bypass authentication and gain unauthorized access to JAX-WS applications. |
CVE-2025-66389 | High | 7.5 | 2026-06-22 | GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter to fetch_webpage. Theref… |
CVE-2026-50519 | Medium | 6.5 | 2026-06-19 | Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a n… |
CVE-2026-48584 | Critical | 9.9 | 2026-06-19 | Execution with unnecessary privileges in Azure Synapse allows an authorized attacker to elevate privileges over a network. |
CVE-2026-48582 | Critical | 9.6 | 2026-06-19 | Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network. |
CVE-2026-47645 | High | 8.8 | 2026-06-19 | Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a netwo… |
CVE-2026-45480 | Critical | 10.0 | 2026-06-19 | Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-42895 | Medium | 6.5 | 2026-06-19 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering o… |
CVE-2026-32208 | High | 8.8 | 2026-06-19 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Entra ID allows an authorized attacker to perform spoofing ov… |
CVE-2026-49336 | | 2026-06-19 | @microsoft/kiota-http-fetchlibrary provides TypeScript libraries for Kiota-generated API clients. In versions 1.0.0-preview.97 through 1.0.0-preview.101, `@mic… | |
CVE-2025-62821 | Critical | 9.1 | 2026-06-19 | Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry_GetDataSize can return success while leaving the reported data si… |
CVE-2026-54130 | Critical | 9.8 | 2026-06-18 | Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network. |