CVE-2026-70105

Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...

CVE-2026-69836

Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network...

CVE-2026-69558

Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network...

CVE-2026-65801

Server-side request forgery ssrf in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-63509

Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over a network...

CVE-2026-72846 Lightdash Scheduled Delivery Webhook URLs Are Not Validated, Allowing Server-Side Request Forgery

Lightdash stores the webhook URL supplied with a scheduled delivery and later posts to it from sendWebhook in packages/backend/src/clients/GoogleChat/GoogleChatClient.ts and in packages/backend/src/clients/MicrosoftTeams/MicrosoftTeamsClient.ts. In affected versions both call fetch on the stored...

CVE-2026-69855

CVE-2026-69855 is a server-side request forgery (SSRF) vulnerability in Microsoft Copilot in Azure that allows an authorized attacker to disclose information over a network. The CVSS v3.1 base score is 7.7 (HIGH) , reflecting a network attack vector, low complexity, low privileges required, no us...

CVE-2026-69855 Microsoft Copilot in Azure Information Disclosure Vulnerability

...

CVE-2026-69855 Microsoft Copilot in Azure Information Disclosure Vulnerability

...

CVE-2026-69558 Microsoft Partner Center Information Disclosure Vulnerability

...

CVE-2026-69558

Microsoft Partner Center has an authorization bypass caused by a user-controlled key, enabling an unauthenticated remote attacker to disclose confidential information (CVSS 8.6, HIGH). The flaw requires no privileges or user interaction. No patch version or in-the-wild exploitation details are pr...

CVE-2026-69558 Microsoft Partner Center Information Disclosure Vulnerability

...

CVE-2026-69400 Azure Logic Apps Elevation of Privilege Vulnerability

...

CVE-2026-68782 Azure SQL Database Elevation of Privilege Vulnerability

...

CVE-2026-66309 Azure SQL Database Elevation of Privilege Vulnerability

...

CVE-2026-63509 Microsoft Fabric Elevation of Privilege Vulnerability

...

CVE-2026-63509

A critical (CVSS 9.9) relative path traversal vulnerability in Microsoft Fabric allows an authenticated, low-privileged attacker over the network to elevate privileges, impacting confidentiality, integrity, and availability. No affected versions, exploit details, or patch information are provided...

CVE-2026-63509 Microsoft Fabric Elevation of Privilege Vulnerability

...

CVE-2026-70105 Microsoft Word Information Disclosure Vulnerability

...

CVE-2026-70105

CVE-2026-70105 is an improper input validation vulnerability in Microsoft Office Word that allows an unauthorized, remote attacker to disclose information over a network . The attack requires user interaction (e.g., opening a crafted document) and no prior privileges. CVSS v3.1 score is 6.5 (Medi...