Vulnerabilities in Microsoft Dynamics

Microsoft has addressed vulnerabilities in various Dynamics components. A malicious individual could exploit these vulnerabilities to execute attacks that can cause damage, as listed in the following tables: Microsoft Dataverse: | CVE-ID | CVSS | Impact | |--------|------|---------| |...

EUVD-2026-95397

Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network...

CVE-2026-88131

Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network...

CVE-2026-88131

A critical Remote Code Execution (RCE) vulnerability exists in Microsoft Dataverse due to the deserialization of untrusted data . This flaw allows an unauthorized attacker to execute arbitrary code over the network. The vulnerability has a CVSS 3.1 score of 9.8 , indicating high impact on confide...

Microsoft Dataverse Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network...

PT-2026-108300

Name of the Vulnerable Software and Affected Versions Microsoft Dataverse affected versions not specified Description Deserialization of untrusted data allows an unauthorized attacker to execute code over a network. This issue enables remote code execution without requiring authentication or user...

CVE-2026-88131: Deserialization of Untrusted Data

Deserialization of untrusted data in Microsoft Dataverse allows an unauthorized attacker to execute code over a network...

KLA91326 Multiple vulnerability in Microsoft Dynamics

Multiple vulnerability was found in Microsoft Dynamics. Malicious users can exploit this vulnerability to bypass security restrictions, execute arbitrary code. Original advisories CVE-2026-88131 Exploitation Related products Microsoft-Dataverse CVE list CVE-2026-88131 critical KB list Solution...

EUVD-2026-82585

Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-77903

Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-77903

Microsoft Dataverse is affected by an authentication bypass by spoofing vulnerability that allows an unauthorized, remote attacker to elevate privileges over a network. The CVSS 3.1 score is 9.0 (CRITICAL) , with a vector of AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, indicating high attack complexity b...

WordPress Dataverse Integration plugin < 2.91 - Contributor+ Server-Side Template Injection (SSTI) to Information Disclosure vulnerability

Contributor+ Server-Side Template Injection SSTI to Information Disclosure vulnerability discovered by dangnosuy in WordPress Plugin Dataverse Integration versions 2.91...

Microsoft Dataverse Elevation of Privilege Vulnerability

Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network...

PT-2026-95171

Name of the Vulnerable Software and Affected Versions Microsoft Dataverse affected versions not specified Description An authentication bypass via spoofing allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a newer...

CVE-2026-77903: Authentication Bypass by Spoofing

Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-5336 Dataverse Integration < 2.91 - Contributor+ Server-Side Template Injection (SSTI) to Information Disclosure

The DataPress Dataverse Integration WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher...

CVE-2026-5336

The CVE-2026-5336 entry concerns the DataPress (Dataverse Integration) WordPress plugin, affected before version 2.91. The root cause is improper access control around the plugin’s template rendering feature, allowing a user with as low as Contributor privileges to trigger Server-Side Template In...

CVE-2026-5336

The DataPress Dataverse Integration WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher...

CVE-2026-5336 Dataverse Integration < 2.91 - Contributor+ Server-Side Template Injection (SSTI) to Information Disclosure

The DataPress Dataverse Integration WordPress plugin before 2.91 does not properly restrict access to its template rendering feature and exposes the viewing user's data to it, allowing users with a role as low as Contributor to disclose sensitive information, such as the session cookies of higher...

PT-2026-68753

Name of the Vulnerable Software and Affected Versions DataPress Dataverse Integration WordPress plugin versions prior to 2.91 Description Insufficient access restrictions in the template rendering feature allow users with Contributor roles to disclose sensitive information. This issue occurs...