CVEs published by Microsoft Corporation

CVEs published by Microsoft Corporation (CVE Numbering Authority). 149 tracked.

• CVE-2026-96185 HIGH 7.5 Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a
• CVE-2026-108456 HIGH 7.7 Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges ove
• CVE-2026-105014 CRITICAL 9.1 Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows
• CVE-2026-66321 HIGH 7.4 UPGRADE Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an una
• CVE-2026-65802 HIGH 7.4 UPGRADE External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclos
• CVE-2026-66312 MEDIUM 6.5 UPGRADE Buffer over-read in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a netwo
• CVE-2026-66315 HIGH 7.5 UPGRADE Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a netwo
• CVE-2026-66326 MEDIUM 6.5 UPGRADE Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over
• CVE-2026-66318 HIGH 8.1 UPGRADE Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose informa
• CVE-2026-66310 HIGH 7.7 UPGRADE External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclos
• CVE-2026-66314 MEDIUM 6.5 UPGRADE Time-of-check time-of-use (toctou) race condition in Microsoft Edge (Chromium-based) allows an unauthorized at
• CVE-2026-65804 MEDIUM 6.1 UPGRADE Improper control of generation of code ('code injection') in Microsoft Edge (Chromium-based) allows an unautho
• CVE-2026-66311 MEDIUM 6.2 UPGRADE Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering
• CVE-2026-68813 MEDIUM 5.5 MITIGATE MITIGATE Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
• CVE-2026-66325 MEDIUM 6.1 UPGRADE Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perfo
• CVE-2026-66322 HIGH 7.1 UPGRADE Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing
• CVE-2026-70310 MEDIUM 5.5 MITIGATE MITIGATE Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
• CVE-2026-66313 MEDIUM 6.8 UPGRADE Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tamperin
• CVE-2026-66316 MEDIUM 5.4 UPGRADE Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing
• CVE-2026-66317 MEDIUM 5.4 UPGRADE Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tamperin
• CVE-2026-66803 CRITICAL 10.0 MITIGATE Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.
• CVE-2026-56162 CRITICAL 10.0 MITIGATE Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a net
• CVE-2026-63508 CRITICAL 10.0 MITIGATE Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attack
• CVE-2026-65667 CRITICAL 10.0 MITIGATE Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-50515 CRITICAL 9.9 MITIGATE Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a ne
• CVE-2026-62873 CRITICAL 9.8 MITIGATE Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker
• CVE-2026-59115 CRITICAL 9.9 MITIGATE '.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate priv
• CVE-2026-50481 CRITICAL 9.9 MITIGATE Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to eleva
• CVE-2026-62830 CRITICAL 9.9 MITIGATE Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
• CVE-2026-62836 HIGH 8.7 MITIGATE Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an un
• CVE-2026-70332 CRITICAL 9.6 MITIGATE Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Share
• CVE-2026-49163 HIGH 8.8 MITIGATE Improper limitation of a pathname to a restricted directory ('path traversal') in Application Insights Profile
• CVE-2026-56161 CRITICAL 9.6 MITIGATE Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a netwo
• CVE-2026-62896 CRITICAL 9.6 MITIGATE Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network.
• CVE-2026-68823 CRITICAL 9.1 MITIGATE Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute cod
• CVE-2026-59118 CRITICAL 9.3 MITIGATE Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-65668 HIGH 8.8 MITIGATE Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges ov
• CVE-2026-62918 HIGH 7.5 MITIGATE Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform
• CVE-2026-65680 MEDIUM 6.7 UPGRADE Improper link resolution before file access ('link following') in Microsoft OneDrive allows an authorized atta
• CVE-2026-70339 MEDIUM 5.4 UPGRADE Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an una
• CVE-2026-69673 HIGH 7.8 UPGRADE UPGRADE Improper link resolution before file access ('link following') in Windows Update allows an authorized attacker
• CVE-2026-69718 HIGH 7.8 UPGRADE UPGRADE Improper neutralization of special elements used in a command ('command injection') in Windows Update allows a
• CVE-2026-69733 HIGH 7.8 UPGRADE UPGRADE Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.
• CVE-2026-108132 HIGH 7.0 UPGRADE UPGRADE Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.
• CVE-2026-108135 HIGH 7.0 UPGRADE UPGRADE Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized a
• CVE-2026-110063 CRITICAL 10.0 Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allo
• CVE-2026-83938 CRITICAL 10.0 Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized
• CVE-2026-97785 CRITICAL 10.0 Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-108136 HIGH 7.8 UPGRADE UPGRADE Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges local
• CVE-2026-108396 HIGH 7.0 UPGRADE UPGRADE Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authoriz
• CVE-2026-59124 CRITICAL 9.8 UPGRADE Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized at
• CVE-2026-50516 CRITICAL 9.4 MITIGATE Incorrect authorization in Microsoft Azure Kubernetes Service allows an authorized attacker to elevate privile
• CVE-2026-65815 HIGH 8.8 UPGRADE Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to exe
• CVE-2026-70321 HIGH 8.8 UPGRADE Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code
• CVE-2026-59133 HIGH 8.8 UPGRADE Execution with unnecessary privileges in Microsoft High Performance Computing (HPC) Pack allows an authorized
• CVE-2026-65768 HIGH 8.8 UPGRADE Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Teams for Android
• CVE-2026-65811 HIGH 8.8 UPGRADE Improper input validation in Power BI allows an authorized attacker to execute code over a network.
• CVE-2026-57104 HIGH 8.8 UPGRADE Improper neutralization of input during web page generation ('cross-site scripting') in Azure Storage Explorer
• CVE-2026-62785 HIGH 8.8 UPGRADE UPGRADE Heap-based buffer overflow in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized atta
• CVE-2026-62795 HIGH 8.8 UPGRADE UPGRADE Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to exec
• CVE-2026-69320 HIGH 8.8 UPGRADE Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Co
• CVE-2026-70326 HIGH 8.8 UPGRADE Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate pri
• CVE-2026-70336 HIGH 8.8 UPGRADE Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacke
• CVE-2026-59113 HIGH 8.8 UPGRADE Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
• CVE-2026-65767 HIGH 8.8 UPGRADE Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams for An
• CVE-2026-70340 HIGH 8.1 UPGRADE Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
• CVE-2026-47299 HIGH 7.2 UPGRADE Improper neutralization of special elements used in a command ('command injection') in Azure Monitor Agent all
• CVE-2026-57105 HIGH 8.0 UPGRADE Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Share
• CVE-2026-62869 HIGH 8.8 MITIGATE Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoo
• CVE-2026-69306 HIGH 8.2 UPGRADE Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a securi
• CVE-2026-47285 MEDIUM 6.5 UPGRADE Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allo
• CVE-2026-65769 MEDIUM 6.5 UPGRADE Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allows an unauthorized at
• CVE-2026-66301 MEDIUM 6.5 UPGRADE Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an a
• CVE-2026-54981 HIGH 7.8 MITIGATE Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an un
• CVE-2026-65675 HIGH 7.1 MITIGATE No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a
• CVE-2026-65806 MEDIUM 6.5 UPGRADE Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network
• CVE-2026-70335 HIGH 7.8 UPGRADE Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot a
• CVE-2026-62772 HIGH 7.8 UPGRADE Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized
• CVE-2026-62799 HIGH 7.8 UPGRADE Heap-based buffer overflow in Windows SMB Client allows an authorized attacker to elevate privileges locally.
• CVE-2026-58650 HIGH 7.8 UPGRADE Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypa
• CVE-2026-63522 HIGH 7.8 MITIGATE Incorrect permission assignment for critical resource in Azure SQL Database allows an authorized attacker to e
• CVE-2026-65673 HIGH 7.8 UPGRADE Incorrect authorization in Microsoft Entra Connect Sync allows an authorized attacker to elevate privileges ov
• CVE-2026-69278 HIGH 7.8 UPGRADE Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature loc
• CVE-2026-68821 HIGH 7.3 UPGRADE Improper privilege management in Windows Package Manager allows an authorized attacker to elevate privileges l
• CVE-2026-54123 MEDIUM 5.5 UPGRADE Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an author
• CVE-2026-72971 MEDIUM 5.5 UPGRADE Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver
• CVE-2026-62775 MEDIUM 5.5 UPGRADE Incorrect authorization in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized att
• CVE-2026-83862 HIGH 8.8 UPGRADE UPGRADE Use after free in Windows Network Load Balancing allows an unauthorized attacker to execute code over an adjac
• CVE-2026-68836 HIGH 7.8 UPGRADE UPGRADE Heap-based buffer overflow in Windows kernel32.dll allows an authorized attacker to elevate privileges locally
• CVE-2026-69326 HIGH 8.8 UPGRADE UPGRADE Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.
• CVE-2026-69354 HIGH 7.8 UPGRADE UPGRADE Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges loca
• CVE-2026-69363 HIGH 8.0 UPGRADE UPGRADE Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over
• CVE-2026-69387 HIGH 7.0 UPGRADE UPGRADE Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
• CVE-2026-69452 HIGH 7.1 UPGRADE UPGRADE Use after free in Windows Enterprise App Management allows an authorized attacker to elevate privileges over a
• CVE-2026-69471 HIGH 7.8 UPGRADE UPGRADE Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
• CVE-2026-69506 MEDIUM 4.7 UPGRADE UPGRADE Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information local
• CVE-2026-69521 HIGH 8.8 UPGRADE UPGRADE Integer overflow or wraparound in Windows iSCSI allows an unauthorized attacker to execute code over a network
• CVE-2022-24513 HIGH 7.8 UPGRADE UPGRADE Visual Studio Elevation of Privilege Vulnerability
• CVE-2026-96303 MEDIUM 6.5 UPGRADE Improperly implemented security check for standard in Microsoft PowerShell allows an unauthorized attacker to
• CVE-2026-96251 HIGH 8.8 UPGRADE Reliance on untrusted inputs in a security decision in Microsoft PowerShell allows an unauthorized attacker to
• CVE-2026-96960 HIGH 7.5 UPGRADE DOWNGRADE Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a
• CVE-2026-96959 HIGH 7.5 UPGRADE DOWNGRADE Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service o
• CVE-2026-96958 HIGH 7.5 UPGRADE DOWNGRADE Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
• CVE-2026-96957 HIGH 8.8 UPGRADE UPGRADE Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security
• CVE-2026-96238 MEDIUM 6.5 Origin validation error in .NET allows an unauthorized attacker to bypass a security feature over a network.
• CVE-2026-96237 HIGH 7.5 Inclusion of functionality from untrusted control sphere in .NET allows an unauthorized attacker to execute co
• CVE-2026-96235 HIGH 8.8 Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
• CVE-2026-96234 MEDIUM 5.3 Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
• CVE-2026-96233 HIGH 7.5 Out-of-bounds write in ASP.NET Core allows an unauthorized attacker to deny service over a network.
• CVE-2026-96232 HIGH 7.5 Out-of-bounds read in .NET allows an unauthorized attacker to disclose information over a network.
• CVE-2026-96231 HIGH 7.8 Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevat
• CVE-2026-96230 HIGH 8.8 Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an
• CVE-2026-96229 MEDIUM 6.5 Permissive list of allowed inputs in .NET allows an unauthorized attacker to disclose information over a netwo
• CVE-2026-96225 HIGH 7.8 Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevat
• CVE-2026-96224 HIGH 8.8 Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
• CVE-2026-96222 HIGH 7.4 UPGRADE UPGRADE Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacke
• CVE-2026-87697 HIGH 8.8 Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
• CVE-2026-85790 MEDIUM 5.9 UPGRADE UPGRADE Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
• CVE-2026-85363 HIGH 8.8 Integer overflow or wraparound in .NET Framework allows an unauthorized attacker to elevate privileges over a
• CVE-2026-84008 HIGH 7.5 Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
• CVE-2026-83681 MEDIUM 5.5 Weak authentication in Microsoft PowerToys allows an authorized attacker to perform tampering locally.
• CVE-2026-83520 HIGH 8.8 Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.
• CVE-2026-70197 HIGH 8.1 Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.
• CVE-2026-70194 MEDIUM 6.5 Improper certificate validation in .NET Framework allows an unauthorized attacker to bypass a security feature
• CVE-2026-70190 HIGH 7.3 Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevat
• CVE-2026-70179 HIGH 7.5 Authentication bypass by spoofing in ASP.NET Core allows an authorized attacker to elevate privileges over a n
• CVE-2026-70174 HIGH 8.8 Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code ove
• CVE-2026-70165 MEDIUM 6.7 Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevat
• CVE-2026-70162 MEDIUM 5.9 A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web r
• CVE-2026-70161 HIGH 7.3 Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized at
• CVE-2026-70159 HIGH 7.5 Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny s
• CVE-2026-70035 HIGH 8.8 Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a net
• CVE-2026-70007 HIGH 8.8 Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.
• CVE-2026-69651 HIGH 7.5 Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
• CVE-2026-66822 MEDIUM 5.9 Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose informat
• CVE-2026-58280 HIGH 7.5 Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.
• CVE-2026-109468 HIGH 7.5 Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny s
• CVE-2026-105016 CRITICAL 9.8 Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
• CVE-2026-102870 HIGH 8.8 Improper control of generation of code ('code injection') in ASP.NET Core allows an unauthorized attacker to e
• CVE-2026-24301 HIGH 8.8 MITIGATE Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allow
• CVE-2026-96912 HIGH 7.8 UPGRADE UPGRADE Use after free in Windows Client License Service allows an authorized attacker to elevate privileges locally.
• CVE-2026-96911 HIGH 7.8 UPGRADE UPGRADE Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an
• CVE-2026-96914 HIGH 8.8 UPGRADE UPGRADE Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized att
• CVE-2026-96913 HIGH 8.8 UPGRADE UPGRADE Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
• CVE-2026-96951 HIGH 8.8 EXPLOITED MITIGATE UPGRADE Microsoft Windows Command Injection Vulnerability
• CVE-2026-65660 HIGH 8.8 EXPLOITED UPGRADE Microsoft SharePoint Code Injection Vulnerability
• CVE-2026-85880 HIGH 7.8 EXPLOITED UPGRADE UPGRADE Microsoft Windows Heap-Based Buffer Overflow Vulnerability
• CVE-2026-81963 HIGH 7.8 EXPLOITED UPGRADE UPGRADE Microsoft Windows Link Following Vulnerability
• CVE-2019-1068 HIGH 8.8 EXPLOITED DOWNGRADE UPGRADE Microsoft SQL Server Remote Code Execution Vulnerability

← Back to latest CVEs