Azure Billing Elevation of Privilege Vulnerability

Insufficient verification of data authenticity in Azure Billing allows an unauthorized attacker to elevate privileges over a network...

Microsoft Dataverse Elevation of Privilege Vulnerability

Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network...

Microsoft Copilot Information Disclosure Vulnerability

Ai command injection in Microsoft Copilot allows an unauthorized attacker to disclose information over a network...

Microsoft 365 Copilot Business Chat Information Disclosure Vulnerability

Improper neutralization of special elements used in a command 'command injection' in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network...

Azure AI Foundry Elevation of Privilege Vulnerability

Missing authentication for critical function in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network...

Azure Machine Learning Information Disclosure Vulnerability

Incorrect authorization in Azure Machine Learning allows an unauthorized attacker to disclose information over a network...

Microsoft Container Registry Elevation of Privilege Vulnerability

Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network...

Microsoft 365 Copilot Elevation of Privilege Vulnerability

Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an authorized attacker to elevate privileges over a network...

Microsoft Open Management Infrastructure - Remote Code Execution

Microsoft Open Management Infrastructure is susceptible to remote code execution OMIGOD. id: CVE-2021-38647 info: name: Microsoft Open Management Infrastructure - Remote Code Execution author: daffainfo,xstp severity: critical description: Microsoft Open Management Infrastructure is susceptible t...

PT-2026-95171

Name of the Vulnerable Software and Affected Versions Microsoft Dataverse affected versions not specified Description An authentication bypass via spoofing allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a newer...

KLA91294 PE vulnerability in Microsoft Dynamics

Privilege escalation vulnerability was found in Microsoft Dynamics. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2026-77903 Exploitation CVE list CVE-2026-77903 unknown Solution Install necessary updates from the KB section, that are listed in your...

PT-2026-95168

Name of the Vulnerable Software and Affected Versions Microsoft Container Registry affected versions not specified Description An authorization bypass exists due to a user-controlled key, which allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment,...

PT-2026-95165

Name of the Vulnerable Software and Affected Versions Microsoft Copilot affected versions not specified Description Improper neutralization of special elements used in a command, known as command injection, allows an unauthorized attacker to disclose information over a network. Command injection ...

CVE-2026-77903: Authentication Bypass by Spoofing

Authentication bypass by spoofing in Microsoft Dataverse allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-69865: Authorization Bypass Through User-Controlled Key

Authorization bypass through user-controlled key in Microsoft Container Registry allows an unauthorized attacker to elevate privileges over a network...

Microsoft WebP Image Extension < 1.2.31.0 RCE (CVE-2026-70351) (September 2026)

The version of the Microsoft WebP Image Extension app installed on the remote Windows host is prior to 1.2.31.0. It is, therefore, affected by a remote code execution vulnerability: - Integer overflow or wraparound in Microsoft WebP Image Extension allows an unauthorized attacker to execute code...

CVE-2026-78501: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network...

CVE-2026-55946: Improper Neutralization of Special Elements used in a Command

Ai command injection in Microsoft Copilot allows an unauthorized attacker to disclose information over a network...

PT-2026-95181

Name of the Vulnerable Software and Affected Versions Microsoft Fabric affected versions not specified Description An authentication bypass by spoofing exists in Microsoft Fabric. This issue allows an unauthenticated remote attacker to provide crafted identity assertions that are accepted as...

PT-2026-95172

Name of the Vulnerable Software and Affected Versions Microsoft 365 Copilot affected versions not specified Description Microsoft 365 Copilot's Business Chat contains a command injection flaw, which occurs when special elements used in a command are not properly neutralized. This allows an...