Filtered by vendor Microsoft Subscriptions
Total 24064 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-33111 1 Microsoft 2 Copilot Chat, Copilot Chat Edge 2026-05-14 7.5 High
Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over a network.
CVE-2026-41105 1 Microsoft 1 Azure Monitor Action Group Notification System 2026-05-14 8.1 High
Server-side request forgery (ssrf) in Azure Notification Service allows an authorized attacker to elevate privileges over a network.
CVE-2026-42891 1 Microsoft 2 Edge, Edge Chromium 2026-05-14 6.5 Medium
User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-42838 1 Microsoft 1 Edge Chromium 2026-05-14 5.4 Medium
Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-42833 1 Microsoft 1 Dynamics 365 2026-05-14 9.1 Critical
Execution with unnecessary privileges in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
CVE-2026-42830 1 Microsoft 2 Azure Monitor Agent, Azure Monitor Agent Metrics Extension 2026-05-14 6.5 Medium
Untrusted search path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally.
CVE-2026-42825 1 Microsoft 30 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 27 more 2026-05-14 7 High
Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
CVE-2026-42823 1 Microsoft 1 Azure Logic Apps 2026-05-14 9.9 Critical
Improper access control in Azure Logic Apps allows an authorized attacker to elevate privileges over a network.
CVE-2026-41614 1 Microsoft 2 365 Copilot, 365 Copilot For Desktop 2026-05-14 6.2 Medium
Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally.
CVE-2026-34690 3 Adobe, Apple, Microsoft 3 After Effects, Macos, Windows 2026-05-14 7.8 High
After Effects versions 26.0, 25.6.4 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2026-33110 1 Microsoft 4 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 and 1 more 2026-05-13 8.8 High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-33112 1 Microsoft 4 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 and 1 more 2026-05-13 8.8 High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-35439 1 Microsoft 3 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 2026-05-13 8.8 High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-40365 1 Microsoft 3 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 2026-05-13 8.8 High
Insufficient granularity of access control in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-40368 1 Microsoft 4 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 and 1 more 2026-05-13 8 High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-40357 1 Microsoft 3 Sharepoint Server, Sharepoint Server 2016, Sharepoint Server 2019 2026-05-13 8.8 High
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-42899 3 Apple, Linux, Microsoft 4 Macos, Linux Kernel, .net and 1 more 2026-05-13 7.5 High
Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-3087 2 Microsoft, Python 3 Windows, Cpython, Python 2026-05-13 7.5 High
If `shutil.unpack_archive()` is given a ZIP archive with an absolute Windows path containing a drive (`C:\\...`) then the archive will be extracted outside the target directory which is different than other operating systems. Only Windows is affected by this vulnerability.
CVE-2026-41610 1 Microsoft 1 Visual Studio Code 2026-05-13 6.3 Medium
Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-34636 3 Adobe, Apple, Microsoft 3 Premiere Pro, Macos, Windows 2026-05-13 7.8 High
Premiere Pro versions 26.0.2, 25.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.