Export limit exceeded: 26457 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (26457 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-83711 | 1 Microsoft | 2 Azure Active Directory B2c, Entra Id | 2026-09-05 | 10 Critical |
| Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-80098 | 1 Microsoft | 1 Copilot Studio | 2026-09-05 | 9.3 Critical |
| Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-70352 | 1 Microsoft | 1 Azure Ai Language Authoring | 2026-09-05 | 10 Critical |
| Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-70178 | 1 Microsoft | 1 Microsoft Fabric | 2026-09-05 | 8.5 High |
| Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-65818 | 1 Microsoft | 1 Power Platform | 2026-09-05 | 8.5 High |
| Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-62916 | 1 Microsoft | 2 Entra Id, Microsoft Entra Id | 2026-09-05 | 9.1 Critical |
| Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-69502 | 1 Microsoft | 1 Azure Sql Database | 2026-09-04 | 10 Critical |
| Server-side request forgery (ssrf) in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network. | ||||
| CVE-2026-63509 | 1 Microsoft | 2 Fabric, Microsoft Fabric | 2026-09-04 | 9.9 Critical |
| Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-69419 | 1 Microsoft | 1 Azure Data Manager For Energy | 2026-09-04 | 8.5 High |
| Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-70105 | 1 Microsoft | 15 365 Apps, Microsoft 365, Microsoft 365 Apps For Enterprise and 12 more | 2026-09-04 | 6.5 Medium |
| Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-62906 | 1 Microsoft | 1 Microsoft Discovery Studio | 2026-09-04 | 7.4 High |
| Improper neutralization of special elements in data query logic in Microsoft Discovery Studio allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-69857 | 1 Microsoft | 1 Cosmos Db | 2026-09-04 | 8.5 High |
| Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network. | ||||
| CVE-2026-69414 | 1 Microsoft | 1 Malware Protection Engine | 2026-09-03 | 7.8 High |
| Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ". | ||||
| CVE-2026-84351 | 2 Google, Microsoft | 2 Chrome, Windows | 2026-09-03 | 8.3 High |
| Buffer overflow in GPU in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-84452 | 1 Microsoft | 1 Winml-cli | 2026-09-03 | N/A |
| Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cli_api.py component exposes WinML CLI commands through a localhost HTTP API without authentication and configures the allow_origins setting as a wildcard in both src/winml/modelkit/serve/cli_api.py and src/winml/modelkit/serve/app.py. A malicious website loaded by a user can send cross-origin requests to /v1/cli/build or /v1/cli/config and set the trust_remote_code parameter to true, which is converted to the --trust-remote-code command-line flag without validation. This reaches AutoConfig.from_pretrained with trust_remote_code=True in src/winml/modelkit/loader/_autoconfig.py and imports Python code from an attacker-controlled model repository, resulting in arbitrary code execution as the server user. This issue is fixed in version 0.4.0. | ||||
| CVE-2026-84329 | 2 Google, Microsoft | 2 Chrome, Windows | 2026-09-03 | 5.3 Medium |
| Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to leak sensitive information via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-84334 | 2 Google, Microsoft | 2 Chrome, Windows | 2026-09-03 | 8.1 High |
| Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.75 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Chromium security severity: Medium) | ||||
| CVE-2026-58641 | 3 Apple, Linux, Microsoft | 5 Macos, Linux Kernel, .net and 2 more | 2026-09-03 | 7.8 High |
| Integer overflow or wraparound in .NET allows an unauthorized attacker to elevate privileges locally. | ||||
| CVE-2026-12878 | 4 Linux, Microsoft, Octopus and 1 more | 4 Linux Kernel, Windows, Codefresh and 1 more | 2026-09-02 | 8.8 High |
| In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions. | ||||
| CVE-2026-61920 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 11 26h1 and 11 more | 2026-09-02 | 6.6 Medium |
| Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an authorized attacker to execute code over a network. | ||||