CVE-2026-48579: Improper Authorization

Improper authorization in Microsoft Exchange Online allows an unauthorized attacker to disclose information over a network...

PT-2026-46402

Name of the Vulnerable Software and Affected Versions Microsoft 365 Copilot versions prior to June 2026 Description Improper neutralization of special elements used in a command allows an authorized attacker to execute code over a network. This issue, known as command injection, occurs when an...

CVE-2026-47644: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Improper neutralization of special elements in output used by a downstream component 'injection' in Copilot Chat Microsoft Edge allows an unauthorized attacker to disclose information over a network...

Microsoft Exchange Online 授权问题漏洞

Microsoft Exchange Online is an enterprise-level cloud email and calendar service open source by Microsoft. There is an authorization issue vulnerability in Microsoft Exchange Online; this vulnerability stems from improper authorization, which may allow unauthorized attackers to disclose...

(Pwn2Own) Microsoft Edge Origin Validation Error Security Bypass Vulnerability

This vulnerability allows remote attackers to access restricted functionality on affected installations of Microsoft Edge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Microsoft Azure Horizondb 授权问题漏洞

Microsoft Azure HorizonDB is a cloud-native PostgreSQL database service provided by Microsoft Corporation. There is a security vulnerability in Microsoft Azure HorizonDB, which stems from bypassing authentication through deception. This could allow unauthorized attackers to escalate their...

KLA91083 OSI vulnerability in Microsoft Browser

An information disclosure vulnerability was found in Microsoft Browser. Malicious users can exploit this vulnerability to obtain sensitive information, bypass security restrictions. Original advisories CVE-2026-47644 Exploitation Related products Microsoft-Edge CVE list CVE-2026-47644 critical...

Microsoft Graph 日志信息泄露漏洞

Microsoft Graph is a unified API platform of the American company Microsoft. There is an information leakage vulnerability in Microsoft Graph; this vulnerability stems from the exposure of sensitive information to unauthorized actors, which may allow authorized attackers to disclose information...

KLA91080 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to gain privileges, obtain sensitive information. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Azure HorizonDB can be exploited remotely to gain...

KLA91082 OSI vulnerability in Microsoft Server Software

An information disclosure vulnerability was found in Microsoft Server Software. Malicious users can exploit this vulnerability to obtain sensitive information, bypass security restrictions. Original advisories CVE-2026-48579 Exploitation CVE list CVE-2026-48579 critical KB list Solution Install...

Security Bulletin: IBM Sterling Connect:Direct for Microsoft Windows is vulnerable to issues in Jetty

Summary There are vulnerabilities in Jetty used by IBM Sterling Connect:Direct for Microsoft Windows. IBM Sterling Connect:Direct for Microsoft Windows has addressed the applicable CVEs CVE-2025-11143, CVE-2026-2332. Vulnerability Details CVEID:CVE-2025-11143 DESCRIPTION: The Jetty URI parser has...

Microsoft 365 Android Apps Let Any App Steal Account Tokens via Leftover Debug Flag

A development flag left switched on in production builds of several Microsoft 365 Android apps disabled the check that limits account-token sharing to trusted Microsoft apps. Any other app on the same phone could ask for the signed-in user's token and get it, then read email, open files, browse t...

smb: client: reject userspace cifs.spnego descriptions

...

CVE-2026-47294

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

The vulnerability of Microsoft 365 Copilot’s intelligent virtual assistant, related to the lack of measures for cleaning incoming data, allows a perpetrator to disclose protected information.

The vulnerability of Microsoft 365 Copilot’s intelligent virtual assistant is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability could allow a malicious actor to disclose protected information remotely...

The vulnerability of the cloud-based platform for managing and protecting Microsoft Entra ID (formerly Azure Active Directory) relates to deficiencies in the data source verification mechanism, allowing attackers to escalate their privileges.

The vulnerability of the cloud-based platform for managing and protecting Microsoft Entra ID formerly Azure Active Directory is related to deficiencies in the data source verification mechanism. Exploiting this vulnerability could allow a malicious actor to increase their privileges remotely...

The vulnerability of Microsoft Power Pages, a software for creating web pages, lies in the lack of measures to clean input data, allowing attackers to execute arbitrary code.

The vulnerability of Microsoft Power Pages software for creating web pages is related to the lack of measures to sanitize input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the Microsoft Authenticator multi-factor authentication application, related to the disclosure of information, allows a perpetrator to gain unauthorized access to the protected information.

The vulnerability of the Microsoft Authenticator multi-factor authentication application is related to the disclosure of information. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

PT-2026-58331

Name of the Vulnerable Software and Affected Versions Microsoft Install Service affected versions not specified Description Improper privilege management in the Microsoft Install Service allows an authorized attacker to elevate privileges locally, potentially granting full system control. The iss...

The vulnerability of Azure cloud services for managing geospatial data by Microsoft Planetary Computer Pro, related to deserialization mechanism flaws, allows attackers to disclose protected information.

The vulnerability of Azure cloud services for managing geospatial data with the Microsoft Planetary Computer Pro is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability could allow a malicious actor to disclose protected information...