Microsoft
Page 29 of 100 — Microsoft CVEs from a corpus of 26181, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-5911 | Medium | 4.3 | 2026-04-08 | Policy bypass in ServiceWorkers in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass content security policy via a crafted HTML page. (C… |
CVE-2026-5910 | High | 8.8 | 2026-04-08 | Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (C… |
CVE-2026-5909 | High | 8.8 | 2026-04-08 | Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (C… |
CVE-2026-5908 | High | 8.8 | 2026-04-08 | Integer overflow in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted video file. (C… |
CVE-2026-5907 | High | 8.1 | 2026-04-08 | Insufficient data validation in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform an out of bounds memory read via a crafted v… |
CVE-2026-5906 | Medium | 4.3 | 2026-04-08 | Incorrect security UI in Omnibox in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) vi… |
CVE-2026-5905 | Medium | 6.5 | 2026-04-08 | Incorrect security UI in Permissions in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to perform domain spoofing via a crafted HTML… |
CVE-2026-5903 | Medium | 6.5 | 2026-04-08 | Policy bypass in IFrameSandbox in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypa… |
CVE-2026-5902 | Critical | 9.8 | 2026-04-08 | Race in Media in Google Chrome on Android prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to corrupt media stream met… |
CVE-2026-5901 | Medium | 6.5 | 2026-04-08 | Insufficient policy enforcement in DevTools in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2026-5900 | Medium | 4.3 | 2026-04-08 | Policy bypass in Downloads in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass of multi-download protections via a crafted HTML page. (… |
CVE-2026-5899 | Medium | 6.1 | 2026-04-08 | Insufficient policy enforcement in History Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in speci… |
CVE-2026-5898 | Medium | 4.3 | 2026-04-08 | Incorrect security UI in Omnibox in Google Chrome on iOS prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chro… |
CVE-2026-5897 | Medium | 4.3 | 2026-04-08 | Incorrect security UI in Downloads in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to… |
CVE-2026-5896 | Medium | 6.1 | 2026-04-08 | Policy bypass in Audio in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass sandb… |
CVE-2026-5895 | Medium | 5.4 | 2026-04-08 | Incorrect security UI in Omnibox in Google Chrome on iOS prior to 147.0.7727.55 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a… |
CVE-2026-5894 | Medium | 4.3 | 2026-04-08 | Inappropriate implementation in PDF in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page… |
CVE-2026-5893 | Medium | 6.8 | 2026-04-08 | Race in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security… |
CVE-2026-5892 | Medium | 6.6 | 2026-04-08 | Insufficient policy enforcement in PWAs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to install a… |
CVE-2026-5891 | Medium | 4.3 | 2026-04-08 | Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to per… |
CVE-2026-5890 | Medium | 5.3 | 2026-04-08 | Race in WebCodecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory via a craft… |
CVE-2026-5889 | Medium | 4.3 | 2026-04-08 | Cryptographic Flaw in PDFium in Google Chrome prior to 147.0.7727.55 allowed an attacker to read potentially sensitive information from encrypted PDFs via a br… |
CVE-2026-5888 | Medium | 6.5 | 2026-04-08 | Uninitialized Use in WebCodecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memor… |
CVE-2026-5887 | Medium | 4.3 | 2026-04-08 | Insufficient validation of untrusted input in Downloads in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to bypass download restric… |
CVE-2026-5885 | Medium | 6.5 | 2026-04-08 | Insufficient validation of untrusted input in WebML in Google Chrome on Windows prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitiv… |
CVE-2026-5884 | High | 8.8 | 2026-04-08 | Insufficient validation of untrusted input in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-5883 | High | 8.8 | 2026-04-08 | Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (… |
CVE-2026-5882 | Medium | 4.3 | 2026-04-08 | Incorrect security UI in Fullscreen in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium… |
CVE-2026-5881 | Medium | 6.5 | 2026-04-08 | Policy bypass in LocalNetworkAccess in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page… |
CVE-2026-5880 | Medium | 4.3 | 2026-04-08 | Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to spo… |
CVE-2026-5878 | Medium | 4.3 | 2026-04-08 | Incorrect security UI in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium secu… |
CVE-2026-5877 | High | 8.8 | 2026-04-08 | Use after free in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML pa… |
CVE-2026-5876 | Medium | 6.5 | 2026-04-08 | Side-channel information leakage in Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to leak cross-origin data via a crafted HTML p… |
CVE-2026-5875 | Medium | 4.3 | 2026-04-08 | Policy bypass in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security sev… |
CVE-2026-5874 | Critical | 9.6 | 2026-04-08 | Use after free in PrivateAI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to potenti… |
CVE-2026-5873 | High | 8.8 | 2026-04-08 | Out of bounds read and write in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted H… |
CVE-2026-5872 | High | 8.8 | 2026-04-08 | Use after free in Blink in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (… |
CVE-2026-5871 | High | 8.8 | 2026-04-08 | Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chr… |
CVE-2026-5870 | High | 8.8 | 2026-04-08 | Integer overflow in Skia in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-5869 | Medium | 4.3 | 2026-04-08 | Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory… |
CVE-2026-5867 | Medium | 4.3 | 2026-04-08 | Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process memory… |
CVE-2026-5866 | High | 8.8 | 2026-04-08 | Use after free in Media in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (… |
CVE-2026-5865 | High | 8.8 | 2026-04-08 | Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chr… |
CVE-2026-5864 | Medium | 4.3 | 2026-04-08 | Heap buffer overflow in WebAudio in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to obtain potentially sensitive information from process mem… |
CVE-2026-5863 | High | 8.8 | 2026-04-08 | Inappropriate implementation in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted H… |
CVE-2026-5862 | High | 8.8 | 2026-04-08 | Inappropriate implementation in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted H… |
CVE-2026-5861 | High | 8.8 | 2026-04-08 | Use after free in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chr… |
CVE-2026-5860 | High | 8.8 | 2026-04-08 | Use after free in WebRTC in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-5859 | High | 8.8 | 2026-04-08 | Integer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2026-5858 | High | 8.8 | 2026-04-08 | Heap buffer overflow in WebML in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium se… |
CVE-2026-39844 | Medium | 5.9 | 2026-04-08 | NiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes (/) as path separators, an attacker can bypass thi… |
CVE-2025-65116 | Medium | 5.5 | 2026-04-07 | Buffer Overflow Vulnerability in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Management… |
CVE-2025-65115 | High | 8.8 | 2026-04-07 | Remote Code Execution Vulnerability in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Mana… |
CVE-2026-35199 | Medium | 6.1 | 2026-04-06 | SymCrypt is the core cryptographic function library currently used by Windows. From 103.5.0 to before 103.11.0, The SymCryptXmssSign function passes a 64-bit l… |
CVE-2026-35562 | High | 7.5 | 2026-04-03 | Allocation of resources without limits in the parsing components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat actor to cause a denial of se… |
CVE-2026-35561 | High | 7.4 | 2026-04-03 | Insufficient authentication security controls in the browser-based authentication components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat a… |
CVE-2026-35560 | High | 7.4 | 2026-04-03 | Improper certificate validation in the identity provider connection components in Amazon Athena ODBC driver before 2.1.0.0 might allow a man-in-the-middle thre… |
CVE-2026-35559 | Medium | 6.5 | 2026-04-03 | Out-of-bounds write in the query processing components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat actor to crash the driver by using spec… |
CVE-2026-35558 | High | 7.8 | 2026-04-03 | Improper neutralization of special elements in the authentication components in Amazon Athena ODBC driver before 2.1.0.0 might allow a threat actor to execute… |
CVE-2026-32186 | Critical | 10.0 | 2026-04-03 | Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-28373 | Critical | 9.6 | 2026-04-03 | The Stackfield Desktop App before 1.10.2 for macOS and Windows contains a path traversal vulnerability in certain decryption functionality when processing the… |
CVE-2025-7024 | High | 7.3 | 2026-04-03 | Incorrect Default Permissions vulnerability in AIRBUS PSS TETRA Connectivity Server on Windows Server OS allows Privilege Abuse. An attacker may execute arbi… |
CVE-2026-33107 | Critical | 10.0 | 2026-04-03 | Server-side request forgery (ssrf) in Azure Databricks allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-33105 | Critical | 10.0 | 2026-04-03 | Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-32213 | Critical | 10.0 | 2026-04-03 | Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-32211 | Critical | 9.1 | 2026-04-03 | Missing authentication for critical function in Azure MCP Server allows an unauthorized attacker to disclose information over a network. |
CVE-2026-32173 | High | 8.6 | 2026-04-03 | Improper authentication in Azure SRE Agent allows an unauthorized attacker to disclose information over a network. |
CVE-2026-26135 | Critical | 9.6 | 2026-04-03 | Server-side request forgery (ssrf) in Azure Custom Locations Resource Provider (RP) allows an authorized attacker to elevate privileges over a network. |
CVE-2026-1243 | Medium | 5.4 | 2026-04-02 | IBM Content Navigator 3.0.15, 3.1.0, and 3.2.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaSc… |
CVE-2025-13916 | Medium | 5.9 | 2026-04-01 | IBM Aspera Shares 1.9.9 through 1.11.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information |
CVE-2026-5292 | High | 8.8 | 2026-04-01 | Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML p… |
CVE-2026-5291 | Medium | 6.5 | 2026-04-01 | Inappropriate implementation in WebGL in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to obtain potentially sensitive information from proce… |
CVE-2026-5290 | Critical | 9.6 | 2026-04-01 | Use after free in Compositing in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perfor… |
CVE-2026-5289 | Critical | 9.6 | 2026-04-01 | Use after free in Navigation in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2026-5288 | Critical | 9.6 | 2026-04-01 | Use after free in WebView in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-5287 | High | 8.8 | 2026-04-01 | Use after free in PDF in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Ch… |
CVE-2026-5286 | High | 8.8 | 2026-04-01 | Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security… |
CVE-2026-5285 | High | 8.8 | 2026-04-01 | Use after free in WebGL in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-5284 | High | 7.5 | 2026-04-01 | Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code vi… |
CVE-2026-5283 | Medium | 6.5 | 2026-04-01 | Inappropriate implementation in ANGLE in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Ch… |
CVE-2026-5282 | High | 8.1 | 2026-04-01 | Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML p… |
CVE-2026-5281 | High | 8.8 | 2026-04-01 | Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code vi… |
CVE-2026-5280 | High | 8.8 | 2026-04-01 | Use after free in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML pa… |
CVE-2026-5279 | High | 8.8 | 2026-04-01 | Object corruption in V8 in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page… |
CVE-2026-5278 | High | 8.8 | 2026-04-01 | Use after free in Web MIDI in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Ch… |
CVE-2026-5277 | High | 7.5 | 2026-04-01 | Integer overflow in ANGLE in Google Chrome on Windows prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to perform an… |
CVE-2026-5276 | Medium | 6.5 | 2026-04-01 | Insufficient policy enforcement in WebUSB in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to obtain potentially sensitive information from p… |
CVE-2026-5275 | High | 8.8 | 2026-04-01 | Heap buffer overflow in ANGLE in Google Chrome on Mac prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chr… |
CVE-2026-5274 | High | 8.8 | 2026-04-01 | Integer overflow in Codecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromiu… |
CVE-2026-5273 | Medium | 6.3 | 2026-04-01 | Use after free in CSS in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (C… |
CVE-2026-5272 | High | 8.8 | 2026-04-01 | Heap buffer overflow in GPU in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium sec… |
CVE-2026-3780 | High | 7.3 | 2026-04-01 | The application's installer runs with elevated privileges but resolves system executables and DLLs using untrusted search paths that can include user-writable… |
CVE-2026-3779 | High | 7.8 | 2026-04-01 | The application's list box calculate array logic keeps stale references to page or form objects after they are deleted or re-created, which allows crafted docu… |
CVE-2026-3778 | Medium | 6.2 | 2026-04-01 | The application does not detect or guard against cyclic PDF object references while handling JavaScript in PDF. When pages and annotations are crafted that ref… |
CVE-2026-3777 | Medium | 5.5 | 2026-04-01 | The application does not properly validate the lifetime and validity of internal view cache pointers after JavaScript changes the document zoom and page state… |
CVE-2026-3776 | Medium | 5.5 | 2026-04-01 | The application does not validate the presence of required appearance (AP) data before accessing stamp annotation resources. When a PDF contains a stamp annota… |
CVE-2026-3775 | High | 7.8 | 2026-04-01 | The application's update service, when checking for updates, loads certain system libraries from a search path that includes directories writable by low‑privil… |
CVE-2026-3774 | Medium | 4.7 | 2026-04-01 | The application allows PDF JavaScript and document/print actions (such as WillPrint/DidPrint) to update form fields, annotations, or optional content groups (O… |
CVE-2025-13855 | High | 7.6 | 2026-04-01 | IBM Storage Protect Server 8.2.0 IBM Storage Protect Plus Server is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements… |
CVE-2026-34401 | Medium | 6.5 | 2026-03-31 | XML Notepad is a Windows program that provides a simple intuitive User Interface for browsing and editing XML documents. Prior to version 2.9.0.21, XML Notepad… |