Vendor
Microsoft
14,257 known vulnerabilities.
Products
508 results · Clear filters · Feed
-
Critical 9.1
Azure SQL Database Elevation of Privilege Vulnerability
Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network.
-
Critical 10.0
Azure Arc Elevation of Privilege Vulnerability
Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.9
Microsoft Fabric Elevation of Privilege Vulnerability
Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.
-
Critical 10.0
Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability
Improper neutralization of argument delimiters in a command ('argument injection') in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network.
-
Critical 10.0
Microsoft Entra ID Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.
-
Critical 9.9
Microsoft Entra ID Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.
-
Critical 9.9
Azure SQL Database Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network.
-
Critical 10.0
Microsoft Exchange Online Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.3
Azure Data Factory Elevation of Privilege Vulnerability
Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network.
-
Critical 10.0
Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer
Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 0.1.5 and 2.0.0-beta.5, the TypeScript Nunjucks renderer evaluated untrusted .prompty template bodies with unrestricted JavaScript member access. An attacker-controlled template could trav…
-
Critical 9.4CVE-2026-73296 Public exploit
Microsoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosure
Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mobile_action_server in ufo/client/mcp/http_servers/mobile_mcp_server.py exposed Streamable HTTP MCP s…
-
Critical 9.4
Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
Incorrect authorization in Microsoft Azure Kubernetes Service allows an authorized attacker to elevate privileges over a network.
-
Critical 9.3
Microsoft Office SharePoint Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
-
Critical 9.8
Windows iSCSI Target Service Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Windows Deployment Services TFTP Server Remote Code Execution Vulnerability
Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
-
Critical 9.8CVE-2026-62878 Public exploit
Windows DNS Server Remote Code Execution Vulnerability
Stack-based buffer overflow in Windows DNS allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Microsoft QUIC Remote Code Execution Vulnerability
Use after free in Microsoft QUIC allows an unauthorized attacker to execute code over a network.
-
Critical 9.8
Microsoft High Performance Computing (HPC) Pack Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network.
-
Critical 9.6
Microsoft Office SharePoint Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
-
Critical 9.8
Microsoft 365 Admin Center Elevation of Privilege Vulnerability
Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network.
-
Critical 10.0
Microsoft Planetary Computer Pro Elevation of Privilege Vulnerability
Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.9
Azure Service Bus Remote Code Execution Vulnerability
Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network.
-
Critical 10.0
Azure SQL Database Elevation of Privilege Vulnerability
Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.9
Azure SRE Agent Elevation of Privilege Vulnerability
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
-
Critical 10.0
Microsoft Teams Elevation of Privilege Vulnerability
Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.6
Azure Logic Apps Information Disclosure Vulnerability
Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network.
-
Critical 9.1
Azure Confidential Ledger Remote Code Execution Vulnerability
Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network.
-
Critical 9.9
Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability
'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.
-
Critical 9.9
Azure Active Directory Elevation of Privilege Vulnerability
Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.
-
Critical 9.3
Copilot Cowork Elevation of Privilege Vulnerability
Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.6
Microsoft Teams Elevation of Privilege Vulnerability
Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network.
-
Critical 10.0
Azure Cosmos DB Remote Code Execution Vulnerability
Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.
-
Critical 9.3
Azure Portal Information Disclosure Vulnerability
Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network.
-
Critical 10.0
Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.
-
Critical 10.0
Azure App Service on Azure Stack Hub Elevation of Privilege Vulnerability
Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.
-
Critical 10.0
Data Quality Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Data Quality allows an unauthorized attacker to elevate privileges over a network.
-
Critical 10.0
Azure DNS Elevation of Privilege Vulnerability
Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.
-
Critical 10.0
Azure Key Vault Elevation of Privilege Vulnerability
Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network.
-
Critical 10.0
Microsoft Exchange Online Tampering Vulnerability
Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.
-
Critical 9.9
Microsoft M365 Copilot Remote Code Execution Vulnerability
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.