Microsoft

Page 5 of 100 — Microsoft CVEs from a corpus of 18610, newest first, with CVSS severity and publication dates.

Microsoft CVEs — newest first (page 5 of 100)
CVESeverityScorePublishedSummary
CVE-2026-58651High7.82026-08-11Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVE-2026-58650High7.82026-08-11Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-58641High7.82026-08-11Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally.
CVE-2026-58639Medium6.52026-08-11Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-58612High7.42026-08-11Server-side request forgery (ssrf) in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.
CVE-2026-57105High8.02026-08-11Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp…
CVE-2026-57104High8.82026-08-11Improper neutralization of input during web page generation ('cross-site scripting') in Azure Storage Explorer allows an unauthorized attacker to elevate privi…
CVE-2026-56179High8.32026-08-11Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform spoofing over an adjacent network.
CVE-2026-56174High7.82026-08-11Untrusted search path in Windows Narrator Braille allows an authorized attacker to elevate privileges locally.
CVE-2026-54984High7.82026-08-11Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code locally.
CVE-2026-54981High7.82026-08-11Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an unauthorized attacker to bypass a security feature…
CVE-2026-54123Medium5.52026-08-11Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an authorized attacker to disclose information locally.
CVE-2026-54113High7.52026-08-11Allocation of resources without limits or throttling in Windows Kernel allows an unauthorized attacker to deny service over a network.
CVE-2026-50516Critical9.42026-08-11Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-50472High7.02026-08-11Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally.
CVE-2026-49179High8.82026-08-11Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an unauthorized attacker to execute code…
CVE-2026-47299High7.22026-08-11Improper neutralization of special elements used in a command ('command injection') in Azure Monitor Agent allows an authorized attacker to elevate privileges…
CVE-2026-47285Medium6.52026-08-11Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to disclose informati…
CVE-2026-42976High7.82026-08-11Missing authentication for critical function in Windows RPC API allows an authorized attacker to elevate privileges locally.
CVE-2026-40375Medium6.52026-08-11Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network.
CVE-2026-70332Critical9.62026-08-07Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform…
CVE-2026-68823Critical9.12026-08-07Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network.
CVE-2026-65668High8.82026-08-07Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network.
CVE-2026-65667Critical10.02026-08-07Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-63508Critical10.02026-08-07Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-62918High7.52026-08-07Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-62896Critical9.62026-08-07Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network.
CVE-2026-62873Critical9.82026-08-07Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-62836High8.72026-08-07Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a…
CVE-2026-62830Critical9.92026-08-07Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
CVE-2026-59118Critical9.32026-08-07Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-59115Critical9.92026-08-07'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.
CVE-2026-56162Critical10.02026-08-07Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-56161Critical9.62026-08-07Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network.
CVE-2026-50515Critical9.92026-08-07Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network.
CVE-2026-50481Critical9.92026-08-07Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.
CVE-2026-49163High8.82026-08-07Improper limitation of a pathname to a restricted directory ('path traversal') in Application Insights Profiler allows an authorized attacker to elevate privil…
CVE-2026-19171Critical9.62026-08-06Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTM…
CVE-2026-19163High8.32026-08-06Use after free in Media in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially p…
CVE-2026-19158High7.52026-08-06Use after free in Views in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to…
CVE-2026-19139High7.42026-08-06Race in CredentialProvider in Google Chrome on Windows prior to 151.0.7922.109 allowed a local attacker to perform OS-level privilege escalation via a maliciou…
CVE-2026-66326Medium6.52026-08-04Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-66325Medium6.12026-08-04Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-66322High7.12026-08-04Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-66321High7.42026-08-04Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-66318High8.12026-08-04Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
CVE-2026-66317Medium5.42026-08-04Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network.
CVE-2026-66316Medium5.42026-08-04Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-66315High7.52026-08-04Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
CVE-2026-66314Medium6.52026-08-04Time-of-check time-of-use (toctou) race condition in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
CVE-2026-66313Medium6.82026-08-04Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally.
CVE-2026-66312Medium6.52026-08-04Buffer over-read in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a network.
CVE-2026-66311Medium6.22026-08-04Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally.
CVE-2026-66310High7.72026-08-04External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.
CVE-2026-65804Medium6.12026-08-04Improper control of generation of code ('code injection') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-65802High7.42026-08-04External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network.
CVE-2026-62870High8.82026-08-04Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-48399High7.52026-08-03Adobe Campaign Classic (ACC) is affected by a Violation of Secure Design Principles vulnerability that could result in a Security feature bypass. An attacker c…
CVE-2026-48333Critical9.82026-08-03Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could exploit this…
CVE-2026-48331Critical10.02026-08-03Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this…
CVE-2026-48330Critical10.02026-08-03Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could re…
CVE-2026-48326Critical9.92026-08-03Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could re…
CVE-2026-48323Critical10.02026-08-03Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitra…
CVE-2026-48317Critical9.62026-08-03Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that could…
CVE-2026-34641High7.82026-07-31Premiere Pro is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation…
CVE-2026-66803Critical10.02026-07-30Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.
CVE-2026-11980High7.32026-07-30IBM Aspera Desktop App 1.0.5 through 1.0.19 can allow arbitrary code execution by loading DLL files at start-up.
CVE-2026-48449Critical10.02026-07-30Adobe Campaign Classic (ACC) is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the curren…
CVE-2026-48448High8.62026-07-30Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could le…
CVE-2026-18018Medium4.02026-07-30Inappropriate implementation in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform UI spoofing via a malicious file…
CVE-2026-17992Medium6.52026-07-30Uninitialized Use in Skia in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process…
CVE-2026-17932Medium5.52026-07-30Use after free in DataTransfer in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitive information from pro…
CVE-2026-17908Medium5.82026-07-30Insufficient validation of untrusted input in Printing in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the ren…
CVE-2026-17900Medium4.32026-07-30Inappropriate implementation in Enterprise in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a malicio…
CVE-2026-17863High7.82026-07-30Inappropriate implementation in Browser in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via a malic…
CVE-2026-17862High7.82026-07-30Use after free in Tracing in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a malicious…
CVE-2026-17858Medium4.32026-07-30Uninitialized Use in WebNN in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chr…
CVE-2026-17846Medium6.52026-07-30Inappropriate implementation in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to…
CVE-2026-17811High7.12026-07-30Use after free in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML…
CVE-2026-17790Medium4.32026-07-30Uninitialized Use in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from proces…
CVE-2026-17723High8.32026-07-30Use after free in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially pe…
CVE-2026-17707Medium6.52026-07-30Uninitialized Use in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to obtain pote…
CVE-2026-17706Medium4.32026-07-30Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the render…
CVE-2026-17692Critical9.62026-07-30Use after free in DataTransfer in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potenti…
CVE-2026-17691Critical9.62026-07-30Out of bounds write in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted…
CVE-2026-14973Critical9.32026-07-28IBM Aspera Desktop App 1.0.5 through 1.0.19 IBM Aspera for desktop can allow files to be written outside of the user's selected download destination.
CVE-2026-62828Medium5.42026-07-28Improper input validation in Microsoft Edge for Android allows an unauthorized attacker to perform tampering over a network.
CVE-2026-57990High7.42026-07-26Files or directories accessible to external parties in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
CVE-2026-57989High7.42026-07-26Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
CVE-2026-57978Medium5.42026-07-26Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-62835Critical9.32026-07-24Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network.
CVE-2026-58630Critical10.02026-07-24Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-57106Critical10.02026-07-24Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-56163Critical10.02026-07-24Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-62825Critical10.02026-07-24Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-58275Critical10.02026-07-24Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-56191Critical10.02026-07-24Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.
CVE-2026-56167High8.52026-07-24Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a network.
CVE-2026-56165Critical9.82026-07-24Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network.
CVE-2026-56160Critical9.12026-07-24Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network.