CVE-2026-58296: Exposure of Private Personal Information to an Unauthorized Actor

Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network...

HCL Traveler for Microsoft Outlook < 3.0.15 Sensitive Data Exposure (CVE-2025-59868)

The version of HCL Traveler for Microsoft Outlook installed on the remote Windows host is prior to 3.0.15. It is, therefore, affected by a sensitive data exposure vulnerability which could allow an attacker to exploit application information to then attempt additional attacks and cause unknown...

CVE-2026-54998

Incorrect authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network...

CVE-2026-57100

Server-side request forgery ssrf in Microsoft Entra Provisioning Service SyncFabric allows an authorized attacker to elevate privileges over a network...

CVE-2026-41106

Url redirection to untrusted site 'open redirect' in M365 Copilot allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-54998 Microsoft Exchange Online Elevation of Privilege Vulnerability

...

CVE-2026-54998 Microsoft Exchange Online Elevation of Privilege Vulnerability

...

CVE-2026-54998

CVE-2026-54998 describes an incorrect authorization in Microsoft Exchange Online that enables an authorized attacker to elevate privileges over a network. This vulnerability impacts Exchange Online’s authorization checks, allowing escalation of access from an existing authorized state. The CVSS 3...

CVE-2026-54998

Incorrect authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network...

CVE-2026-41106 Microsoft 365 Copilot Elevation of Privilege Vulnerability

...

CVE-2026-41106

Technical details for CVE-2026-41106 are not publicly available in the provided documents. Monitor for updates from vendors and security feeds.

CVE-2026-41106

Url redirection to untrusted site 'open redirect' in M365 Copilot allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-41106 Microsoft 365 Copilot Elevation of Privilege Vulnerability

...

CVE-2026-57100

Technical details on affected products/versions, root cause, exploit scenarios, or mitigations are not publicly provided in the supplied documents. Monitor official sources for updates.

CVE-2026-57100 Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability

...

CVE-2026-57100 Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability

...

CVE-2026-38972

Notepad3 through 6.25.822.1 contains a DLL search-order hijacking vulnerability in the About-dialog code path in src/Notepad3.c. The application calls LoadLibraryL"MSFTEDIT.DLL" with a bare DLL name, which allows a local attacker to place a malicious MSFTEDIT.DLL in the application directory or...

About Cross Site Scripting - Microsoft Exchange (CVE-2026-42897) vulnerability

About Cross Site Scripting - Microsoft Exchange CVE-2026-42897 vulnerability. The vulnerability was fixed on May 14 outside the regular Microsoft Patch Tuesday cycle. Improper neutralization of input during web page generation CWE-79, XSS in Microsoft Exchange Server allows an unauthorized attack...

Microsoft 365 Copilot Elevation of Privilege Vulnerability

Url redirection to untrusted site 'open redirect' in M365 Copilot allows an unauthorized attacker to elevate privileges over a network...

Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

Improper link resolution before file access 'link following' in Microsoft Edge Chromium-based allows an unauthorized attacker to disclose information over a network...