Filtered by vendor Microsoft
Subscriptions
Total
27538 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-91734 | 2 Google, Microsoft | 2 Chrome, Windows | 2026-09-18 | 7.4 High |
| Incorrect authorization in Core in Google Chrome on on Windows prior to 153.0.8010.47 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: High) | ||||
| CVE-2026-69587 | 1 Microsoft | 11 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 8 more | 2026-09-18 | 7.5 High |
| Null pointer dereference in Windows IKE Extension allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-69588 | 1 Microsoft | 11 Windows 11 23h2, Windows 11 23h2, Windows 11 24h2 and 8 more | 2026-09-18 | 7.5 High |
| Missing release of memory after effective lifetime in Windows TCP/IP allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-69865 | 1 Microsoft | 1 Azure Container Registry | 2026-09-18 | 10 Critical |
| Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-83944 | 1 Microsoft | 1 Azure Logic Apps | 2026-09-18 | 10 Critical |
| Improper access control in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-69843 | 1 Microsoft | 2 Fabric, Microsoft Fabric | 2026-09-18 | 10 Critical |
| Authentication bypass by spoofing in Microsoft Fabric allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-85887 | 1 Microsoft | 1 365 Copilot | 2026-09-17 | 7.7 High |
| Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-83946 | 1 Microsoft | 1 Azure Portal | 2026-09-17 | 8.2 High |
| Improper neutralization of input during web page generation ('cross-site scripting') in Azure Portal allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-85878 | 1 Microsoft | 1 Azure Horizondb | 2026-09-17 | 9.9 Critical |
| Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-62874 | 1 Microsoft | 1 Azure Billing | 2026-09-17 | 10 Critical |
| Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-85917 | 1 Microsoft | 1 Azure Ai Foundry | 2026-09-17 | 7.5 High |
| Server-side request forgery (ssrf) in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-85889 | 1 Microsoft | 1 Azure Ai Foundry | 2026-09-17 | 10 Critical |
| Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-70200 | 1 Microsoft | 1 Azure Logic Apps | 2026-09-17 | 10 Critical |
| Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-87701 | 1 Microsoft | 1 Cosmos Db | 2026-09-17 | 9.6 Critical |
| Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Cosmos DB allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-78501 | 1 Microsoft | 1 365 Copilot Business Chat | 2026-09-17 | 7.4 High |
| Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-85885 | 1 Microsoft | 1 365 Copilot | 2026-09-17 | 9.9 Critical |
| Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-68791 | 1 Microsoft | 1 Azure Machine Learning | 2026-09-17 | 8.6 High |
| Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-69399 | 1 Microsoft | 1 Azure Arc | 2026-09-17 | 10 Critical |
| Azure Arc Elevation of Privilege Vulnerability | ||||
| CVE-2026-77903 | 1 Microsoft | 1 Dataverse | 2026-09-17 | 9 Critical |
| Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-70009 | 1 Microsoft | 1 Azure Arc | 2026-09-17 | 9.3 Critical |
| Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a network. | ||||