Microsoft
Page 6 of 100 — Microsoft CVEs from a corpus of 26181, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-54120 | Critical | 9.9 | 2026-07-24 | Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network. |
CVE-2026-50517 | Critical | 9.9 | 2026-07-24 | Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network. |
CVE-2026-49159 | Medium | 6.5 | 2026-07-24 | Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network. |
CVE-2026-35425 | High | 8.0 | 2026-07-24 | Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network. |
CVE-2026-3482 | Medium | 5.3 | 2026-07-22 | IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 could allow an… |
CVE-2026-56623 | High | 7.1 | 2026-07-20 | Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library for client-side and server-side SSH. A git server impl… |
CVE-2026-57980 | Medium | 5.4 | 2026-07-17 | Authentication bypass using an alternate path or channel in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network. |
CVE-2026-56171 | High | 7.1 | 2026-07-17 | Exposure of private personal information to an unauthorized actor in Windows RDP allows an unauthorized attacker to disclose information over a network. |
CVE-2026-13446 | Critical | 9.8 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.1 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authenticatio… |
CVE-2026-13445 | High | 8.1 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.1 can allow an authenticated attacker to exploit the SaveToFile component to read and modify another user's uploaded files… |
CVE-2026-8859 | Critical | 9.9 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow an attacker to write arbitrary files to unintended locations due to improper input validation in the… |
CVE-2026-8635 | Critical | 9.9 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary s… |
CVE-2026-8505 | Critical | 9.8 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 has a vulnerability in Langflow's webhook authentication logic allows unauthenticated users to trigger the execution of a… |
CVE-2026-8481 | Critical | 9.9 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the code validation API endpoint. The POST /api/v1/validate/cod… |
CVE-2026-8476 | Critical | 9.9 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 contain a critical remote code execution vulnerability in the disk-based caching mechanism. The AsyncDiskCache class uses… |
CVE-2026-8056 | High | 8.8 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to override component parameters at runtime via the API. A critical security flaw exists in th… |
CVE-2026-7872 | High | 7.5 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files including the JWT signing key and forge authentication tokens fo… |
CVE-2026-7755 | High | 8.8 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 Langflow could allow remote code execution due to incomplete validation enforcement on MCP server configuration files. |
CVE-2026-7754 | High | 7.7 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 Langflow 1.9.0 could allow server-side request forgery (SSRF) due to insecure default configuration and incomplete enforc… |
CVE-2026-7667 | High | 8.8 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a malicious flow pointing to an attacker-controlled URL that returns a special… |
CVE-2026-48373 | High | 7.8 | 2026-07-17 | Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Expl… |
CVE-2026-14499 | High | 8.8 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.1 Langflow could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to im… |
CVE-2026-13473 | High | 8.1 | 2026-07-17 | IBM Storage Protect Client 8.1.0.0 through 8.1.27.0, 8.1.27.1, and 8.2.0.0 through 8.2.1.0 IBM Storage Protect is vulnerable to a heap-based buffer overflow, c… |
CVE-2026-13448 | High | 8.1 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerability in the public flow build endpoint ( /api/v1/b… |
CVE-2026-9135 | Critical | 9.9 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163d70fc598dc33a32d) contain a code injection vulnerability in… |
CVE-2026-9103 | Critical | 9.8 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 could allow a remote attacker to gain unauthorized access due to improper authentication in the /api/v1/login/auto_login… |
CVE-2026-63093 | High | 8.8 | 2026-07-17 | Cursor for Windows version 3.2.16 contains a binary planting vulnerability that allows remote attackers to achieve arbitrary code execution by placing a malici… |
CVE-2026-62826 | Medium | 4.6 | 2026-07-16 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2026-59117 | High | 7.5 | 2026-07-16 | Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code over a network. |
CVE-2026-58643 | Medium | 6.1 | 2026-07-16 | Improper neutralization of input during web page generation ('cross-site scripting') in Windows Admin Center allows an unauthorized attacker to perform spoofin… |
CVE-2026-58598 | High | 7.0 | 2026-07-16 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Backup Engine allows an authorized attacker to elevate p… |
CVE-2026-59867 | High | 7.1 | 2026-07-16 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota resolved OpenAPI $ref values by fetching remote http(s) URLs and reading local abs… |
CVE-2026-59866 | | 2026-07-16 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without ide… | |
CVE-2026-59865 | | 2026-07-16 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.<language>.dependencyInstallComma… | |
CVE-2026-59864 | | 2026-07-16 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, `kiota plugin add` and `kiota plugin generate` (with `-t APIPlugin`) emitted attacker-co… | |
CVE-2026-57206 | High | 8.6 | 2026-07-16 | SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.206, several plugin va… |
CVE-2026-57205 | Medium | 4.3 | 2026-07-16 | SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated… |
CVE-2026-55440 | Medium | 6.5 | 2026-07-16 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.7, the COMMAND_RESULTS handler in ufo/server/ws/handl… |
CVE-2026-54733 | | 2026-07-16 | The Microsoft 365 and Microsoft Entra ID Plugins for Moodle provide Office 365 and Azure Active Directory integration for Moodle. Prior to 4.5.6, 5.0.5, and 5… | |
CVE-2026-54568 | Medium | 4.3 | 2026-07-16 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a client connected to the UFO WebSocket se… |
CVE-2026-53598 | High | 7.5 | 2026-07-16 | Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders expanded ${file:...} references in .prompty frontmatter wi… |
CVE-2026-53597 | | 2026-07-16 | Prompty is a markdown file format (.prompty) for LLM prompts. From 2.0.0-alpha.1 until 2.0.0-beta.3, the @prompty/core TypeScript loader in runtime/typescript/… | |
CVE-2026-59863 | | 2026-07-16 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota honored a poisoned .kiota/workspace.json workspace configuration without validatin… | |
CVE-2026-59862 | High | 7.5 | 2026-07-16 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.0, Kiota's Python generator let attacker-controlled enum value descriptions from x-ms-enum… |
CVE-2026-59861 | High | 7.5 | 2026-07-16 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.0, Kiota's Ruby generator embedded OpenAPI default fields, property names, and other schema… |
CVE-2026-59860 | | 2026-07-16 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.3, Kiota is affected by a code-generation injection vulnerability in the C# XML documentati… | |
CVE-2026-59859 | | 2026-07-16 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.4, Kiota's PHP generator embedded OpenAPI description, default fields, property names, and… | |
CVE-2026-40952 | High | 7.8 | 2026-07-15 | CVE-2026-40952 is a privilege misconfiguration in the Secure Access installer for the Windows client and server prior to version 14.55. Attackers with local ac… |
CVE-2026-48357 | Medium | 6.2 | 2026-07-14 | CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could e… |
CVE-2026-48354 | Medium | 6.2 | 2026-07-14 | CAI Content Credentials is affected by an Integer Overflow or Wraparound vulnerability that could result in an application denial-of-service. An attacker could… |
CVE-2026-48353 | Medium | 5.5 | 2026-07-14 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could lead to arbitrary file system read. An attacker could exploit this… |
CVE-2026-48352 | High | 7.5 | 2026-07-14 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could expl… |
CVE-2026-48351 | High | 7.5 | 2026-07-14 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could expl… |
CVE-2026-48337 | High | 7.8 | 2026-07-14 | Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation… |
CVE-2026-48336 | High | 7.8 | 2026-07-14 | Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation… |
CVE-2026-48335 | High | 7.8 | 2026-07-14 | Illustrator is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation… |
CVE-2026-48334 | Critical | 9.3 | 2026-07-14 | Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user, potenti… |
CVE-2026-48312 | Medium | 6.8 | 2026-07-14 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage th… |
CVE-2026-48302 | Medium | 6.2 | 2026-07-14 | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker could expl… |
CVE-2026-48298 | Medium | 6.2 | 2026-07-14 | CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attack… |
CVE-2026-48296 | Medium | 6.2 | 2026-07-14 | CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-of-service. An attack… |
CVE-2026-48295 | High | 7.5 | 2026-07-14 | CAI Content Credentials is affected by an Insufficiently Protected Credentials vulnerability that could result in disclosure of sensitive information. An attac… |
CVE-2026-48290 | High | 8.2 | 2026-07-14 | CAI Content Credentials is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code execution in the context of the c… |
CVE-2026-48287 | High | 7.4 | 2026-07-14 | CAI Content Credentials is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user… |
CVE-2026-48275 | High | 8.6 | 2026-07-14 | Illustrator is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitatio… |
CVE-2026-48344 | High | 7.8 | 2026-07-14 | Creative Cloud Desktop is affected by a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability that could result in arbitrary code execution in the co… |
CVE-2026-48343 | High | 7.8 | 2026-07-14 | Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th… |
CVE-2026-48342 | High | 7.8 | 2026-07-14 | Bridge is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploit… |
CVE-2026-48341 | High | 7.8 | 2026-07-14 | Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th… |
CVE-2026-48340 | High | 7.8 | 2026-07-14 | Bridge is affected by an Untrusted Pointer Dereference vulnerability that could result in arbitrary code execution in the context of the current user. Exploita… |
CVE-2026-48339 | High | 7.8 | 2026-07-14 | Bridge is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation… |
CVE-2026-48311 | High | 7.8 | 2026-07-14 | Bridge is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of th… |
CVE-2026-48272 | High | 7.8 | 2026-07-14 | Creative Cloud Desktop is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the cur… |
CVE-2026-15773 | Critical | 9.6 | 2026-07-14 | Use after free in Core in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML… |
CVE-2026-15771 | Medium | 5.3 | 2026-07-14 | Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker who had compromised the rende… |
CVE-2026-15767 | High | 8.8 | 2026-07-14 | Heap buffer overflow in libyuv in Google Chrome on Windows prior to 150.0.7871.125 allowed a remote attacker to execute arbitrary code inside a sandbox via a c… |
CVE-2026-50659 | Medium | 6.5 | 2026-07-14 | Improper encoding or escaping of output in .NET allows an authorized attacker to perform spoofing over a network. |
CVE-2026-50651 | High | 7.5 | 2026-07-14 | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. |
CVE-2026-50650 | High | 7.8 | 2026-07-14 | Improper control of generation of code ('code injection') in .NET Framework allows an unauthorized attacker to elevate privileges locally. |
CVE-2026-50649 | High | 7.8 | 2026-07-14 | Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code locally. |
CVE-2026-50648 | High | 7.5 | 2026-07-14 | Allocation of resources without limits or throttling in .NET Framework allows an unauthorized attacker to deny service over a network. |
CVE-2026-50646 | High | 7.8 | 2026-07-14 | Protection mechanism failure in .NET Framework allows an unauthorized attacker to execute code locally. |
CVE-2026-50528 | High | 8.2 | 2026-07-14 | Incorrect authorization in .NET allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-50527 | High | 7.5 | 2026-07-14 | Stack-based buffer overflow in .NET Framework allows an unauthorized attacker to deny service over a network. |
CVE-2026-50526 | High | 7.0 | 2026-07-14 | Improper link resolution before file access ('link following') in .NET allows an authorized attacker to perform tampering locally. |
CVE-2026-50525 | High | 7.5 | 2026-07-14 | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. |
CVE-2026-50524 | High | 7.5 | 2026-07-14 | Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network. |
CVE-2026-48350 | High | 8.6 | 2026-07-14 | Animate is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code exec… |
CVE-2026-48349 | High | 8.1 | 2026-07-14 | Animate is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depen… |
CVE-2026-48348 | High | 7.7 | 2026-07-14 | Animate is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. Exploit depen… |
CVE-2026-48347 | High | 7.7 | 2026-07-14 | Animate is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitra… |
CVE-2026-48346 | High | 7.9 | 2026-07-14 | Animate is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of… |
CVE-2026-48345 | High | 8.2 | 2026-07-14 | Animate is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitra… |
CVE-2026-47305 | High | 7.8 | 2026-07-14 | Protection mechanism failure in Visual Studio allows an unauthorized attacker to execute code locally. |
CVE-2026-47304 | High | 8.1 | 2026-07-14 | Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2026-47303 | High | 8.8 | 2026-07-14 | Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network. |
CVE-2026-47302 | High | 7.5 | 2026-07-14 | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. |
CVE-2026-47301 | High | 8.8 | 2026-07-14 | Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network. |
CVE-2026-47300 | High | 8.8 | 2026-07-14 | Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network. |
CVE-2026-58638 | Medium | 6.0 | 2026-07-14 | Missing cryptographic step in Windows Boot Loader allows an authorized attacker to bypass a security feature locally. |