Microsoft CVEs
14,257 CVEs and advisories name Microsoft as an affected vendor, 292 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-102231Visual Studio Code Security Feature Bypass Vulnerability
- CVE-2026-102229Visual Studio Code Information Disclosure Vulnerability
- CVE-2026-102227Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
- CVE-2026-108468Windows Installer Elevation of Privilege Vulnerability
- CVE-2026-108457Microsoft Windows PDF Remote Code Execution Vulnerability
- CVE-2026-108400HEVC Video Extensions Remote Code Execution Vulnerability
- CVE-2026-105728Dynamics Business Central Information Disclosure Vulnerability
- CVE-2026-105727Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
- CVE-2026-105725Windows Security App Elevation of Privilege Vulnerability
- CVE-2026-103572Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability
- CVE-2026-102850Microsoft Office Access Remote Code Execution Vulnerability
- CVE-2026-102849Microsoft Office Access Remote Code Execution Vulnerability
- CVE-2026-96207Microsoft Partner Center Elevation of Privilege Vulnerability
- CVE-2026-94510Microsoft Bookings Elevation of Privilege Vulnerability
- CVE-2026-88131Microsoft Dataverse Remote Code Execution Vulnerability
- CVE-2026-83947Azure Event Grid Spoofing Vulnerability
- CVE-2026-83943Azure API Center Information Disclosure Vulnerability
- CVE-2026-77900Azure App Service Remote Code Execution Vulnerability
- CVE-2026-69435Azure SRE Agent Elevation of Privilege Vulnerability
- CVE-2026-105798SimpleChat: Stored XSS via group document filename in inline onclick handler
- CVE-2026-105797SimpleChat: Command injection via authorization-gate ordering flaw (arbitrary process spawn through MCP stdio transport)
- CVE-2026-105796Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators
- CVE-2026-105795Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests
- CVE-2026-105794MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
- CVE-2026-105793Microsoft UFO: Authenticated Android shell command injection in Mobile MCP `press_key`
- CVE-2026-105792Microsoft UFO: Authenticated task-result request can deadlock UFO server session manager
- CVE-2026-105791Microsoft UFO: Arbitrary code execution in `run_shell` via `explorer.exe` argument injection
- CVE-2026-105790Microsoft UFO: Authenticated Galaxy device registration can bypass WebSocket SSRF IP pinning via redirects
- CVE-2026-105789Microsoft UFO: Arbitrary file write in the Linux MCP `execute_command` tool
- CVE-2026-105788Microsoft UFO: Authenticated Android shell command injection in Mobile MCP type_text and launch_app