Filtered by vendor Microsoft Subscriptions
Total 22224 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-59286 1 Microsoft 3 365, 365 Copilot, 365 Copilot Chat 2025-10-16 6.5 Medium
Copilot Spoofing Vulnerability
CVE-2025-55321 1 Microsoft 1 Azure Monitor 2025-10-16 8.7 High
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Monitor allows an authorized attacker to perform spoofing over a network.
CVE-2025-59272 1 Microsoft 3 365, 365 Copilot, 365 Copilot Chat 2025-10-16 6.5 Medium
Copilot Spoofing Vulnerability
CVE-2025-59252 1 Microsoft 2 365, 365 Copilot 2025-10-16 6.5 Medium
M365 Copilot Spoofing Vulnerability
CVE-2025-59247 1 Microsoft 2 Azure, Azure Playfab 2025-10-16 8.8 High
Azure PlayFab Elevation of Privilege Vulnerability
CVE-2025-59246 1 Microsoft 1 Entra Id 2025-10-16 9.8 Critical
Azure Entra ID Elevation of Privilege Vulnerability
CVE-2025-59218 1 Microsoft 1 Entra Id 2025-10-16 9.6 Critical
Azure Entra ID Elevation of Privilege Vulnerability
CVE-2025-59230 1 Microsoft 16 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 13 more 2025-10-16 7.8 High
Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
CVE-2025-24990 1 Microsoft 16 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 13 more 2025-10-15 7.8 High
Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcement of the upcoming removal of ltmdm64.sys driver. The driver has been removed in the October cumulative update. Fax modem hardware dependent on this specific driver will no longer work on Windows. Microsoft recommends removing any existing dependencies on this hardware.
CVE-2025-36630 2 Microsoft, Tenable 2 Windows, Nessus 2025-10-15 8.4 High
In Tenable Nessus versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrite arbitrary local system files with log content at SYSTEM privilege.
CVE-2025-11719 2 Microsoft, Mozilla 3 Windows, Firefox, Thunderbird 2025-10-15 9.8 Critical
Starting in Firefox 143, the use of the native messaging API by web extensions on Windows could lead to crashes caused by use-after-free memory corruption. This vulnerability affects Firefox < 144 and Thunderbird < 144.
CVE-2025-20286 4 Amazon, Cisco, Microsoft and 1 more 4 Amazon Web Services, Identity Services Engine, Azure and 1 more 2025-10-15 9.9 Critical
A vulnerability in Amazon Web Services (AWS), Microsoft Azure, and Oracle Cloud Infrastructure (OCI) cloud deployments of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to access sensitive data, execute limited administrative operations, modify system configurations, or disrupt services within the impacted systems. This vulnerability exists because credentials are improperly generated when Cisco ISE is being deployed on cloud platforms, resulting in different Cisco ISE deployments sharing the same credentials. These credentials are shared across multiple Cisco ISE deployments as long as the software release and cloud platform are the same. An attacker could exploit this vulnerability by extracting the user credentials from Cisco ISE that is deployed in the cloud and then using them to access Cisco ISE that is deployed in other cloud environments through unsecured ports. A successful exploit could allow the attacker to access sensitive data, execute limited administrative operations, modify system configurations, or disrupt services within the impacted systems. Note: If the Primary Administration node is deployed in the cloud, then Cisco ISE is affected by this vulnerability. If the Primary Administration node is on-premises, then it is not affected.
CVE-2025-53132 1 Microsoft 19 Windows, Windows 10 1507, Windows 10 1607 and 16 more 2025-10-15 7.8 High
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
CVE-2025-47827 2 Igel, Microsoft 16 Igel Os, Windows 10 1507, Windows 10 1607 and 13 more 2025-10-15 4.6 Medium
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.
CVE-2024-30098 1 Microsoft 13 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 10 more 2025-10-15 7.5 High
Windows Cryptographic Services Security Feature Bypass Vulnerability
CVE-2024-30105 2 Microsoft, Redhat 3 .net, Visual Studio 2022, Enterprise Linux 2025-10-15 7.5 High
.NET and Visual Studio Denial of Service Vulnerability
CVE-2024-38095 2 Microsoft, Redhat 3 .net, Visual Studio 2022, Enterprise Linux 2025-10-15 7.5 High
.NET and Visual Studio Denial of Service Vulnerability
CVE-2024-38156 1 Microsoft 1 Edge 2025-10-15 6.1 Medium
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2024-38103 1 Microsoft 1 Edge 2025-10-15 5.9 Medium
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
CVE-2024-38164 1 Microsoft 1 Groupme 2025-10-15 9.6 Critical
An improper access control vulnerability in GroupMe allows an a unauthenticated attacker to elevate privileges over a network by convincing a user to click on a malicious link.