2970 matches found
PT-2026-60486
Name of the Vulnerable Software and Affected Versions Microsoft Office 365 Integration plugin versions prior to 4.5.6 Microsoft Office 365 Integration plugin versions prior to 5.0.5 Microsoft Office 365 Integration plugin versions prior to 5.1.1 Description The Microsoft Office 365 Integration...
CVE-2026-58617 M365 Copilot for iOS Elevation of Privilege Vulnerability
...
Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Dynamics NAV allows an unauthorized attacker to execute code over a network...
Forg365 PhaaS Targets Microsoft 365 with Device Code and AitM Session Theft
A new phishing-as-a-service PhaaS operation called Forg365 is using a combination of device code phishing, adversary-in-the-middle AitM tactics, antibot evasion, artificial intelligence AI-assisted lure creation, and post-compromise mailbox operations targeting Microsoft 365 accounts. Distributed...
Misconfigured Server Reveals Three Evilginx Phishing Operations Targeting Microsoft 365
An attacker running a live Microsoft 365 phishing operation left a Python web server listening on a public port with directory listing switched on. The command that did it: python3 -m http.server 8080, was still sitting in the readable .bashhistory. From that one lapse, French security firm Lexfo...
EUVD-2026-42491
Improper neutralization of input during web page generation 'cross-site scripting' in Dynamics 365 Customer Voice allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-47646
Improper neutralization of input during web page generation 'cross-site scripting' in Dynamics 365 Customer Voice allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-47646
CVE-2026-47646 describes an improper neutralization of input during web page generation (XSS) in Dynamics 365 Customer Voice . The vulnerability allows an unauthenticated attacker to perform spoofing of the user interface over a network, as indicated by a high-impact, network-based CVSS score (CR...
CVE-2026-47646 Dynamics 365 Customer Voice Spoofing Vulnerability
...
CVE-2026-47646 Dynamics 365 Customer Voice Spoofing Vulnerability
...
DEBULL Tooling Abuses Microsoft Device-Code Flow to Target M365 Accounts
A Microsoft 365 device code phishing campaign has been observed leveraging collaboration-themed lures to take control of victim accounts between the last week of June 2026 and into early July, per findings from ZeroBEC. "The campaign did not depend on a fake Microsoft password page. It used a...
EUVD-2026-41445
Url redirection to untrusted site 'open redirect' in M365 Copilot allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-41106
Url redirection to untrusted site 'open redirect' in M365 Copilot allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-41106
Url redirection to untrusted site 'open redirect' in M365 Copilot allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-41106
Technical details for CVE-2026-41106 are not publicly available in the provided documents. Monitor for updates from vendors and security feeds.
CVE-2026-41106 Microsoft 365 Copilot Elevation of Privilege Vulnerability
...
Security Bulletin: Unauthenticated Superuser Token Issuance via Auto-Login Endpoint
Summary An unauthenticated endpoint in the login API allowed any network-reachable attacker to obtain a 365-day superuser bearer token without requiring any credentials. The /api/v1/login/autologin endpoint issued tokens when the AUTOLOGIN configuration defaulted to True, enabling complete...
Microsoft 365 Copilot Elevation of Privilege Vulnerability
Url redirection to untrusted site 'open redirect' in M365 Copilot allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-41210
A path traversal vulnerability exists in the Git Service component shared by Altium Enterprise Server and Altium 365. The service accepts a sequence of post-clone file-manipulation operations that use user-supplied paths without validation, allowing an authenticated user with basic git access to...
KLA91128 PE vulnerability in Microsoft Apps
Privilege escalation vulnerability was found in Microsoft Apps. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2026-41106 Exploitation Related products Microsoft-365 CVE list CVE-2026-41106 unknown Solution Install necessary updates from the KB section,...