Microsoft CVEs
14,257 CVEs and advisories name Microsoft as an affected vendor, 292 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-57980Microsoft Edge (Chromium-based) Tampering Vulnerability
- CVE-2026-62826Microsoft SharePoint Server Spoofing Vulnerability
- CVE-2026-58598Windows Backup Service Elevation of Privilege Vulnerability
- CVE-2026-58643Windows Admin Center Spoofing Vulnerability
- CVE-2026-59117Windows Terminal Remote Code Execution Vulnerability
- CVE-2026-55440Microsoft UFO: COMMAND_RESULTS handler creates unowned sessions, allowing authenticated session-squatting denial of service
- CVE-2026-54568Microsoft UFO: Missing Authorization in DEVICE_INFO_REQUEST Allows a DEVICE Client to Read Another Device's system_info
- CVE-2026-57206SimpleChat plugin validation endpoints missing authentication and authorization
- CVE-2026-57205SimpleChat: Authenticated users can access other users' profile metadata through user IDOR endpoints
- CVE-2026-53598Prompty: Arbitrary File Read via ${file:path} Reference Expansion
- CVE-2026-53597Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader
- CVE-2026-54733moodle-local_o365: Authentication bypass via unverified JWT signature in Teams SSO endpoint
- CVE-2026-59867Kiota: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
- CVE-2026-59866Kiota: Arbitrary file write + code-injection via x-ms-kiota-info clientClassName and clientNamespaceName
- CVE-2026-59864Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions
- CVE-2026-59865Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`
- CVE-2026-59863Kiota: Workspace-config poisoning: out-of-repo file write + generation-time SSRF
- CVE-2026-59859Kiota: Code Generation Literal Injection in the PHP Generator
- CVE-2026-59862Kiota: Code Generation Literal Injection in the Python Generator
- CVE-2026-59861Kiota: Code Generation Literal Injection in Kiota Ruby Generator
- CVE-2026-59860Kiota: XML Doc-Comment Newline Breakout Code Injection
- CVE-2026-50659.NET Spoofing Vulnerability
- CVE-2026-50651.NET Denial of Service Vulnerability
- CVE-2026-50650.NET Framework Elevation of Privilege Vulnerability
- CVE-2026-50649.NET Remote Code Execution Vulnerability
- CVE-2026-50648.NET Framework Denial of Service Vulnerability
- CVE-2026-50646.NET Framework Remote Code Execution Vulnerability
- CVE-2026-50528.NET Security Feature Bypass Vulnerability
- CVE-2026-50527.NET Framework Denial of Service Vulnerability
- CVE-2026-50526.NET Tampering Vulnerability