Filtered by vendor Microsoft Subscriptions
Total 29139 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-96219 1 Microsoft 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more 2026-11-04 9.8 Critical
Out-of-bounds write in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to execute code over a network.
CVE-2026-7363 4 Apple, Google, Linux and 1 more 4 Macos, Chrome, Linux Kernel and 1 more 2026-11-04 8.8 High
Use after free in Canvas in Google Chrome on Linux, ChromeOS prior to 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Critical)
CVE-2026-70075 1 Microsoft 20 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 17 more 2026-11-04 4.4 Medium
Time-of-check time-of-use (toctou) race condition in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally.
CVE-2026-58547 1 Microsoft 16 Windows 10 1809, Windows 10 21h2, Windows 10 21h2 and 13 more 2026-11-04 5.5 Medium
Heap-based buffer overflow in Universal Plug and Play (upnp.dll) allows an authorized attacker to elevate privileges locally.
CVE-2026-58279 1 Microsoft 1 Azure Cyclecloud 2026-11-04 6.5 Medium
Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
CVE-2026-56649 1 Microsoft 24 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 21 more 2026-11-04 5.9 Medium
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Network File System allows an unauthorized attacker to execute code over a network.
CVE-2026-56178 1 Microsoft 1 Defender For Endpoint 2026-11-04 5.5 Medium
Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
CVE-2026-55126 1 Microsoft 5 Sharepoint Enterprise Server 2016, Sharepoint Server, Sharepoint Server 2016 and 2 more 2026-11-04 7.3 High
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
CVE-2026-54130 1 Microsoft 1 365 Copilot 2026-11-04 9.8 Critical
Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network.
CVE-2026-50447 1 Microsoft 18 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 15 more 2026-11-04 9.8 Critical
Heap-based buffer overflow in Windows Message Queuing allows an unauthorized attacker to execute code over a network.
CVE-2026-50377 1 Microsoft 16 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 13 more 2026-11-04 5.5 Medium
Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-50354 1 Microsoft 16 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 13 more 2026-11-04 7.1 High
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-42895 1 Microsoft 1 365 Copilot 2026-11-04 6.5 Medium
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.
CVE-2026-40369 1 Microsoft 8 Windows 11 24h2, Windows 11 24h2, Windows 11 25h2 and 5 more 2026-11-04 7.8 High
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-113074 2 Google, Microsoft 2 Chrome, Windows 2026-11-04 8.8 High
Incorrect authorization in Media in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-113011 2 Google, Microsoft 2 Chrome, Windows 2026-11-04 8.8 High
Incorrect authorization in CredentialProvider in Google Chrome on on Windows prior to 156.0.8078.47 allowed a local attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium)
CVE-2026-78892 2 Google, Microsoft 2 Chrome, Windows 2026-11-04 7.1 High
Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a local attacker to bypass system access restrictions via a local program. (Chromium security severity: Medium)
CVE-2025-53774 1 Microsoft 4 365, 365 Copilot, 365 Copilot Business Chat and 1 more 2026-11-04 6.5 Medium
Microsoft 365 Copilot BizChat Information Disclosure Vulnerability
CVE-2025-49707 1 Microsoft 33 Dcadsv5 Series Azure Vm, Dcasv5 Series Azure Vm, Dcedsv5 Series Azure Vm and 30 more 2026-11-04 7.9 High
Improper access control in Azure Virtual Machines allows an authorized attacker to perform spoofing locally.
CVE-2025-47995 1 Microsoft 1 Azure Machine Learning 2026-11-04 6.5 Medium
Weak authentication in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.