Vendor
Microsoft
14,257 known vulnerabilities.
Products
508 results · Clear filters · Feed
-
Critical 9.1
Azure MCP Server Information Disclosure Vulnerability
Missing authentication for critical function in Azure MCP Server allows an unauthorized attacker to disclose information over a network.
-
Critical 10.0
Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.6
Azure Custom Locations Resource Provider (RP) Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure Custom Locations Resource Provider (RP) allows an authorized attacker to elevate privileges over a network.
-
Critical 10.0
Azure Databricks Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure Databricks allows an unauthorized attacker to elevate privileges over a network.
-
Critical 10.0
Azure AI Foundry Elevation of Privilege Vulnerability
Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.8CVE-2026-32194 Public exploit
Microsoft Bing Images Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Microsoft Bing Images allows an unauthorized attacker to execute code over a network.
-
Critical 9.9
Microsoft Exchange Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Microsoft Exchange allows an authorized attacker to elevate privileges over a network.
-
Critical 9.8
Microsoft Bing Images Remote Code Execution Vulnerability
Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Bing Images allows an unauthorized attacker to execute code over a network.
-
Critical 10.0
Azure Cloud Shell Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure Cloud Shell allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.8
Microsoft Devices Pricing Program Remote Code Execution Vulnerability
Microsoft Devices Pricing Program Remote Code Execution Vulnerability
-
Critical 10.0CVE-2026-26030 Public exploit
Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution
Semantic Kernel, Microsoft's semantic kernel Python SDK, has a remote code execution vulnerability in versions prior to 1.39.4, specifically within the `InMemoryVectorStore` filter functionality. The problem has been fixed in version `python-1.39.4`. Users sh…
-
Critical 9.8CVE-2026-21531 Public exploit
Azure SDK for Python Remote Code Execution Vulnerability
Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network.
-
Critical 10.0
Semantic Kernel has an Arbitrary File Write via AI Agent Function Calling in .NET SDK
Semantic Kernel is an SDK used to build, orchestrate, and deploy AI agents and multi-agent systems. Prior to 1.71.0, an Arbitrary File Write vulnerability has been identified in Microsoft's Semantic Kernel .NET SDK, specifically within the SessionsPythonPlugi…
-
Critical 9.8
Azure Front Door Elevation of Privilege Vulnerability
Azure Front Door Elevation of Privilege Vulnerability
-
Critical 9.9
Azure Resource Manager Elevation of Privilege Vulnerability
Improper access control in Azure Resource Manager allows an authorized attacker to elevate privileges over a network.
-
Critical 9.3
Microsoft Account Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Account allows an unauthorized attacker to perform spoofing over a network.
-
Critical 9.3
Azure Entra ID Elevation of Privilege Vulnerability
Azure Entra ID Elevation of Privilege Vulnerability
-
Critical 9.3
M365 Copilot Information Disclosure Vulnerability
Improper validation of specified type of input in M365 Copilot allows an unauthorized attacker to disclose information over a network.
-
Critical 9.8CVE-2026-24306 Public exploit
Azure Front Door Elevation of Privilege Vulnerability
Improper access control in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.8
Microsoft SharePoint Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
KEV Mar 18, 2026 -
Critical 10.0
Azure Container Apps Remote Code Execution Vulnerability
Improper control of generation of code ('code injection') in Azure Container Apps allows an unauthorized attacker to execute code over a network.
-
Critical 10.0
Microsoft Partner Center Elevation of Privilege Vulnerability
Improper authorization in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.9
Custom Question Answering Elevation of Privilege Vulnerability
Custom Question Answering Elevation of Privilege Vulnerability
-
Critical 9.8
Azure Application Gateway Elevation of Privilege Vulnerability
Stack-based buffer overflow in Azure Application Gateway allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.4
Azure Application Gateway Elevation of Privilege Vulnerability
Out-of-bounds read in Application Gateway allows an unauthorized attacker to elevate privileges over a network.
-
Critical 10.0
Azure Bastion Elevation of Privilege Vulnerability
Azure Bastion Elevation of Privilege Vulnerability
-
Critical 9.8
Microsoft SharePoint Online Elevation of Privilege Vulnerability
Microsoft SharePoint Online Elevation of Privilege Vulnerability
-
Critical 9.8
GDI+ Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
-
Critical 10.0
Azure Compute Resource Provider Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure Compute Gallery allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.8
Windows Server Update Service (WSUS) Remote Code Execution Vulnerability
Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
KEV Oct 24, 2025 -
Critical 9.9
Microsoft Graphics Component Elevation of Privilege Vulnerability
Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network.
-
Critical 9.9
ASP.NET Security Feature Bypass Vulnerability
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.
-
Critical 9.3
Copilot Information Disclosure Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose information over a network.
-
Critical 9.3
Copilot Information Disclosure Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to perform information disclosure locally.
-
Critical 9.3
Azure Monitor Log Analytics Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Monitor allows an unauthorized attacker to perform spoofing over a network.
-
Critical 9.3
M365 Copilot Information Disclosure Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose information over a network.
-
Critical 9.8
Azure Entra ID Elevation of Privilege Vulnerability
Azure Entra ID Elevation of Privilege Vulnerability
-
Critical 9.6
Azure Entra ID Elevation of Privilege Vulnerability
Azure Entra ID Elevation of Privilege Vulnerability
-
Critical 9.8
Microsoft High Performance Compute (HPC) Pack Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC) allows an unauthorized attacker to execute code over a network.
-
Critical 10.0
Azure Entra ID Elevation of Privilege Vulnerability
Azure Entra ID Elevation of Privilege Vulnerability