CVE-2026-16530

A flaw was found in the PCP Performance Co-Pilot pmproxy service. A remote attacker can exploit a vulnerability in the pmLogLoadInDom function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the pmproxy service crashing, causing a Denial of Service...

EUVD-2026-44935

Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai- extensions...

CVE-2026-50517

Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network...

CVE-2026-50517

Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network...

EUVD-2026-48457

Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network...

CVE-2026-50517 Microsoft M365 Copilot Remote Code Execution Vulnerability

...

CVE-2026-50517 Microsoft M365 Copilot Remote Code Execution Vulnerability

...

CVE-2026-50517

CVE-2026-50517 describes a deserialization vulnerability in Microsoft 365 Copilot (M365 Copilot) that enables an authorized attacker to execute code over the network. The issue is triggered by deserializing untrusted data, with a critical CVSS v3.1 score (9.9, CRITICAL) and a network attack vecto...

PT-2026-64203

Name of the Vulnerable Software and Affected Versions Microsoft M365 Copilot affected versions not specified Description Deserialization of untrusted data allows an authorized attacker to execute code over a network. Deserialization is the process of converting a data stream back into an object,...

Microsoft M365 Copilot Remote Code Execution Vulnerability

Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network...

CVE-2026-13009 AI Copilot <= 1.5.4 - Authenticated (Subscriber+) SQL Injection via 'order[0][dir]' Parameter

The AI Copilot – Content Generator plugin for WordPress is vulnerable to generic SQL Injection via 'order0dir' Parameter in all versions up to, and including, 1.5.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

CVE-2026-9810

The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitra...

CVE-2026-9810

The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitra...

CVE-2026-9810

The CVE-2026-9810 entry concerns the AI Copilot WordPress plugin prior to version 1.5.4. The root cause is that the plugin does not bind OAuth access tokens to a WordPress user, allowing any valid token to be treated as an administrator session. Consequently, unauthenticated attackers completing ...

EUVD-2026-45150

The AI Copilot WordPress plugin before 1.5.4 does not bind OAuth access tokens to a WordPress user, and accepts any valid token as an administrator session, allowing unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitra...

CVE-2026-59864

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, kiota plugin add and kiota plugin generate with -t APIPlugin emitted attacker-controlled statictemplate.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin manifests...

CVE-2026-59864 Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, kiota plugin add and kiota plugin generate with -t APIPlugin emitted attacker-controlled statictemplate.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin manifests...

CVE-2026-59864

Kiota (OpenAPI-based HTTP client code generator) prior to v1.32.5 allowed path traversal/out-of-package file inclusion in generated Microsoft 365 Copilot and Teams plugin manifests through attacker-controlled static_template.file values derived from x-ai-adaptive-card and x-ai-capabilities during...

CVE-2026-59864 Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, kiota plugin add and kiota plugin generate with -t APIPlugin emitted attacker-controlled statictemplate.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin manifests...

PT-2026-60489

Name of the Vulnerable Software and Affected Versions Kiota versions prior to 1.32.5 Description Kiota is an OpenAPI based HTTP Client code generator. The kiota plugin add and kiota plugin generate using the -t APIPlugin flag functions fail to validate paths in static template.file values sourced...