Vendor
Microsoft
14,257 known vulnerabilities.
Products
8,209 results · Clear filters · Feed
-
High 8.8
Visual Studio Code Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
-
High 7.8
Windows Mobile Broadband Elevation of Privilege Vulnerability
Incorrect permission assignment for critical resource in Windows Mobile Broadband allows an authorized attacker to elevate privileges locally.
-
High 8.8
Microsoft Office Access Remote Code Execution Vulnerability
Out-of-bounds read in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Access Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Access Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
-
High 7.5
Microsoft Office Access Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Access Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Access Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office SharePoint Elevation of Privilege Vulnerability
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft Office SharePoint Elevation of Privilege Vulnerability
Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
-
High 8.1
Microsoft Office SharePoint Elevation of Privilege Vulnerability
Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft Office Visio Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Visio Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office SharePoint Elevation of Privilege Vulnerability
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft Office Visio Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office SharePoint Elevation of Privilege Vulnerability
Improper access control in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft Office OneNote Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
-
High 8.8
Visual Studio Code Remote Code Execution Vulnerability
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
-
High 7.7
Visual Studio Code Security Feature Bypass Vulnerability
Improper resolution of path equivalence in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
-
High 7.4
Visual Studio Code Security Feature Bypass Vulnerability
Reliance on untrusted inputs in a security decision in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
-
High 7.0
Visual Studio Code Security Feature Bypass Vulnerability
Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
-
High 7.8
Visual Studio Code Security Feature Bypass Vulnerability
Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
-
High 8.8
Visual Studio Code Remote Code Execution Vulnerability
Improper encoding or escaping of output in Visual Studio Code allows an unauthorized attacker to execute code over a network.
-
High 7.0
Windows Installer Elevation of Privilege Vulnerability
Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
-
High 7.8
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.
-
High 8.8
HEVC Video Extensions Remote Code Execution Vulnerability
Integer overflow or wraparound in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network.
-
High 8.1
Microsoft Windows PDF Remote Code Execution Vulnerability
Out-of-bounds write in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network.
-
High 7.5
Dynamics Business Central Information Disclosure Vulnerability
Improper authentication in Dynamics Business Central allows an unauthorized attacker to disclose information over a network.
-
High 8.8
Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
External control of file name or path in Dynamics Business Central allows an authorized attacker to elevate privileges over a network.
-
High 7.0
Windows Security App Elevation of Privilege Vulnerability
Use after free in Windows Security App allows an authorized attacker to elevate privileges locally.
-
High 8.8
Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability
Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Access Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
-
High 8.8
Microsoft Office Access Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
-
High 7.7
Azure Event Grid Spoofing Vulnerability
Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network.
-
High 8.7
Azure API Center Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Azure API Center allows an unauthorized attacker to disclose information over a network.
-
High 8.7
SimpleChat: Stored XSS via group document filename in inline onclick handler
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST /api/group_documents/upload stores an attacker-controlled group document filename that group_workspaces.html lat…
-
High 8.8
SimpleChat: Command injection via authorization-gate ordering flaw (arbitrary process spawn through MCP stdio transport)
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user…
-
High 8.8
Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators
Kiota is an OpenAPI based HTTP Client code generator. From 0.5.0 until 1.35.0, Kiota's Java and PHP documentation-comment sanitizers delete block-comment terminators rather than neutralizing them, allowing overlapping characters to reform a terminator and pla…
-
High 7.5
Microsoft UFO: Arbitrary code execution in `run_shell` via `explorer.exe` argument injection
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the run_shell tool in the CommandLineExecutor component of ufo/client/mcp/local_servers/cli_mcp_server.py validates only the first token of the …
-
High 8.8
Microsoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and launch_app
Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the type_text and launch_app tools in ufo/client/mcp/http_servers/mobile_mcp_server.py pass the authenticated caller-controlled text and packag…