148362 matches found
CVE-2026-35435
Improper access control in Azure AI Foundry M365 published agents allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-33823
Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network...
CVE-2026-26129
Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an unauthorized attacker to disclose information over a network...
CVE-2026-26164
Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an unauthorized attacker to disclose information over a network...
GHSA-XHRW-5QXX-JPWR Microsoft APM CLI's plugin.json component paths escape plugin root and copy arbitrary host files during install
Summary Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A...
CVE-2026-34327
Externally controlled reference to a resource in another sphere in Microsoft Partner Center allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-34327
Technical details about CVE-2026-34327 are not publicly available in the provided documents. Monitor for updates.
CVE-2026-34327 Microsoft Partner Center Spoofing Vulnerability
...
CVE-2026-34327 Microsoft Partner Center Spoofing Vulnerability
...
CVE-2026-33823 Microsoft Team Events Portal Information Disclosure Vulnerability
...
CVE-2026-33823
Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network...
CVE-2026-33823
Technical details (affected product/component, root cause, exploit specifics, and remediation) are not publicly available in the provided documents. Monitor for updates from the listed sources (NVD, CVE List, MSRC, Attackerkb).
CVE-2026-33823 Microsoft Team Events Portal Information Disclosure Vulnerability
...
CVE-2026-33111 Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability
...
CVE-2026-33111
CVE-2026-33111 affects Copilot Chat in Microsoft Edge. The issue is an improper neutralization of special elements used in a command (command injection) that could allow an unauthorized attacker to disclose information over a network. According to the documented metrics, this is a Network attack ...
CVE-2026-33111 Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability
...
CVE-2026-33111
Improper neutralization of special elements used in a command 'command injection' in Copilot Chat Microsoft Edge allows an unauthorized attacker to disclose information over a network...
CVE-2026-26129
CVE-2026-26129 affects M365 Copilot. Root cause: improper neutralization of special elements enabling unauthorized information disclosure over a network. CVSS v3.1 base score 7.5 (NETWORK, HIGH confidentiality impact). No explicit exploit status or remediation details provided in the supplied doc...