Vendor
Microsoft
14,257 known vulnerabilities.
Products
508 results · Clear filters · Feed
-
Critical 10.0CVE-2025-54914 Public exploit
Azure Networking Elevation of Privilege Vulnerability
Azure Networking Elevation of Privilege Vulnerability
-
Critical 9.0
Azure Bot Service Elevation of Privilege Vulnerability
Azure Bot Service Elevation of Privilege Vulnerability
-
Critical 9.1
Microsoft PC Manager Elevation of Privilege Vulnerability
Improper authorization in Microsoft PC Manager allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.8
Azure Databricks Elevation of Privilege Vulnerability
Improper access control in Azure Databricks allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.8CVE-2025-53766 EPSS 12%
GDI+ Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network.
-
Critical 9.1
Remote Desktop Spoofing Vulnerability
Missing authorization in Remote Desktop Server allows an unauthorized attacker to perform spoofing over a network.
-
Critical 9.8
Windows Graphics Component Remote Code Execution Vulnerability
Untrusted pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.
-
Critical 10.0
Azure OpenAI Elevation of Privilege Vulnerability
Azure OpenAI Elevation of Privilege Vulnerability
-
Critical 9.1
Azure Portal Elevation of Privilege Vulnerability
Azure Portal Elevation of Privilege Vulnerability
-
Critical 9.8
Microsoft SharePoint Server Remote Code Execution Vulnerability
Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing and fully testing a c…
KEV Jul 20, 2025 -
Critical 9.0
Azure DevOps Server Elevation of Privilege Vulnerability
Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.9
Azure Machine Learning Elevation of Privilege Vulnerability
Missing authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.
-
Critical 9.9
Azure Machine Learning Elevation of Privilege Vulnerability
Improper authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.
-
Critical 9.8
SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows SPNEGO Extended Negotiation allows an unauthorized attacker to execute code over a network.
-
Critical 9.3CVE-2025-32711 Public exploit
M365 Copilot Information Disclosure Vulnerability
Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
-
Critical 9.8
Power Automate Elevation of Privilege Vulnerability
Exposure of sensitive information to an unauthorized actor in Power Automate allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.8
Document Intelligence Studio On-Prem Elevation of Privilege Vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Azure allows an unauthorized attacker to elevate privileges over a network.
-
Critical 10.0
Azure DevOps Elevation of Privilege Vulnerability
Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.1
Microsoft Power Apps Information Disclosure Vulnerability
Server-Side Request Forgery (SSRF) in Microsoft Power Apps allows an unauthorized attacker to disclose information over a network
-
Critical 9.9
Azure Automation Elevation of Privilege Vulnerability
Improper authorization in Azure Automation allows an authorized attacker to elevate privileges over a network.
-
Critical 9.9CVE-2025-29972 Public exploit
Azure Storage Resource Provider Spoofing Vulnerability
Server-side request forgery (ssrf) in Azure Storage Resource Provider allows an authorized attacker to perform spoofing over a network.
-
Critical 9.8
Azure AI Bot Elevation of Privilege Vulnerability
Improper authorization in Azure Bot Framework SDK allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.9
Azure ML Compute Elevation of Privilege Vulnerability
Improper authorization in Azure allows an authorized attacker to elevate privileges over a network.
-
Critical 9.3
Microsoft Partner Center Elevation of Privilege Vulnerability
Improper authorization in Microsoft Partner Center allows an authorized attacker to elevate privileges over a network.
-
Critical 9.0
Microsoft High Performance Compute (HPC) Pack Remote Code Execution Vulnerability
Microsoft High Performance Compute (HPC) Pack Remote Code Execution Vulnerability
-
Critical 9.9
Azure AI Face Service Elevation of Privilege Vulnerability
Authentication bypass by spoofing in Azure AI Face Service allows an authorized attacker to elevate privileges over a network.
-
Critical 9.8
Windows NTLM V1 Elevation of Privilege Vulnerability
Windows NTLM V1 Elevation of Privilege Vulnerability
-
Critical 9.8
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
-
Critical 9.8
Windows OLE Remote Code Execution Vulnerability
Windows OLE Remote Code Execution Vulnerability
-
Critical 9.3
Microsoft Update Catalog Elevation of Privilege Vulnerability
Deserialization of untrusted data in Microsoft Update Catalog allows an unauthorized attacker to elevate privileges on the website’s webserver.
-
Critical 9.8
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
-
Critical 9.3
Microsoft Copilot Studio Elevation Of Privilege Vulnerability
Improper neutralization of input during web page generation ('Cross-site Scripting') in Copilot Studio by an unauthorized attacker leads to elevation of privilege over a network.
-
Critical 9.8
Windows KDC Proxy Remote Code Execution Vulnerability
Windows KDC Proxy Remote Code Execution Vulnerability
-
Critical 9.8
.NET and Visual Studio Remote Code Execution Vulnerability
.NET and Visual Studio Remote Code Execution Vulnerability
-
Critical 9.9
Azure CycleCloud Remote Code Execution Vulnerability
Azure CycleCloud Remote Code Execution Vulnerability
-
Critical 9.8
Microsoft Configuration Manager Remote Code Execution Vulnerability
Microsoft Configuration Manager Remote Code Execution Vulnerability
KEV Feb 12, 2026 -
Critical 9.0CVE-2024-38124 Public exploit
Windows Netlogon Elevation of Privilege Vulnerability
Windows Netlogon Elevation of Privilege Vulnerability
-
Critical 9.8
GroupMe Elevation of Privilege Vulnerability
An improper access control vulnerability in GroupMe allows an a unauthenticated attacker to elevate privileges over a network.
-
Critical 9.8CVE-2024-43491 EPSS 13%
Microsoft Windows Update Remote Code Execution Vulnerability
Microsoft is aware of a vulnerability in Servicing Stack that has rolled back the fixes for some vulnerabilities affecting Optional Components on Windows 10, version 1507 (initial version released July 2015). This means that an attacker could exploit these pr…
-
Critical 9.0
Azure Stack Hub Elevation of Privilege Vulnerability
Azure Stack Hub Elevation of Privilege Vulnerability