Vendor
Microsoft
14,257 known vulnerabilities.
Products
14,257 results · Feed
-
High 8.8
Azure Privileged Identity Management (PIM) Elevation of Privilege Vulnerability
Authorization bypass through user-controlled key in Azure Privileged Identity Management (PIM) allows an authorized attacker to elevate privileges over a network.
-
Critical 9.9
Azure Virtual Network Gateway Remote Code Execution Vulnerability
Improper input validation in Azure Virtual Network Gateway allows an authorized attacker to execute code over a network.
-
Critical 10.0
Microsoft Power Pages Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Microsoft Power Pages allows an unauthorized attacker to execute code over a network.
-
Critical 10.0
Azure Orbital Spatio Remote Code Execution Vulnerability
Unrestricted upload of file with dangerous type in Azure Orbital Spatio allows an unauthorized attacker to execute code over a network.
-
High 8.1CVE-2026-45584 Public exploit
Microsoft Defender Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network.
-
High 7.8
Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability
Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
-
High 7.8
Microsoft Defender Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.
KEV May 20, 2026 -
Medium 4.0
Microsoft Defender Denial of Service Vulnerability
Microsoft Defender Denial of Service Vulnerability
KEV May 20, 2026 -
Medium 6.8CVE-2026-45585 Public exploit
Windows BitLocker Security Feature Bypass Vulnerability
Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey". The proof of concept for this vulnerability has been made public violating coordinated vulnerability best practices. We are issuing this CV…
-
Critical 10.0
Azure Local Disconnected Operations (ALDO) Elevation of Privilege Vulnerability
Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
-
Medium 5.4
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Microsoft Edge (Chromium-based) Spoofing Vulnerability
-
Medium 5.4
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
-
Medium 5.5
Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`
Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.13.0, Microsoft APM contains a Windows-specific archive extraction boundary failure in the legacy-bundle probe used by apm install <bundle> on supported Python 3.10…
-
High 7.4
Microsoft APM: Symlinks under `.apm/prompts/` and `.apm/agents/` are dereferenced during `apm install`, copying host-local file contents into the project tree
Microsoft APM is an open-source, community-driven dependency manager for AI agents. From 0.5.4 to 0.12.4, two primitive integrators in apm-cli enumerate package files with bare Path.glob() / Path.rglob() calls and read each match with Path.read_text(), transp…
-
High 7.1
Microsoft APM: plugin.json component paths escape plugin root and copy arbitrary host files during install
Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, …
-
Critical 9.6
Microsoft Authenticator Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose information over a network.
-
High 8.1
Microsoft Exchange Server Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
KEV May 15, 2026 -
High 7.0
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only the Authorization …
-
High 7.7
Microsoft Dynamics 365 Customer Insights Elevation of Privilege Vulnerability
Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a network.
-
High 7.4
Microsoft Outlook for iOS Tampering Vulnerability
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to perform tampering over a network.
-
Medium 4.3
Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
-
Medium 5.4
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.1
Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
-
High 7.7
Microsoft Office Spoofing Vulnerability
Improper access control in Microsoft Office allows an unauthorized attacker to perform spoofing locally.
-
Medium 6.5
Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability
Untrusted search path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.
-
Critical 9.9
Azure Logic Apps Elevation of Privilege Vulnerability
Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.
-
Critical 9.1
Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability
Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges over a network.
-
High 8.8
Visual Studio Code Elevation of Privilege Vulnerability
Session fixation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
-
High 7.8
Azure Connected Machine Agent Elevation of Privilege Vulnerability
Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally.
-
Medium 6.7
Secure Boot Security Feature Bypass Vulnerability
Reliance on a component that is not updateable in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.
-
High 8.8
Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability
Improper access control in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft Office Click-To-Run Elevation of Privilege Vulnerability
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
-
High 8.8
Microsoft Office Click-To-Run Elevation of Privilege Vulnerability
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
-
High 7.8
Microsoft Office Click-To-Run Elevation of Privilege Vulnerability
Use after free in Microsoft Office allows an authorized attacker to elevate privileges locally.
-
High 7.4
Windows TCP/IP Denial of Service Vulnerability
Windows TCP/IP Denial of Service Vulnerability
-
High 8.8
Windows Graphics Component Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to execute code locally.
-
High 7.1
Windows TCP/IP Denial of Service Vulnerability
Windows TCP/IP Denial of Service Vulnerability
-
Critical 9.3
Windows Hyper-V Elevation of Privilege Vulnerability
Use after free in Windows Hyper-V allows an unauthorized attacker to elevate privileges locally.
-
High 7.8
Windows Remote Desktop Services Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.