145736 matches found
Exploit for Protection Mechanism Failure in Microsoft
No d...
CVE-2026-35435
Improper access control in Azure AI Foundry M365 published agents allows an unauthorized attacker to elevate privileges over a network...
bpf: Properly mark live registers for indirect jumps
...
EUVD-2026-28893
Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. From version 4.0.0 to before version 4.0.5, the workflow executor logs all artifact repository credentials S3 access keys, secret keys, GCS service account keys, Azure account keys, Gi...
CVE-2026-26129
Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an unauthorized attacker to disclose information over a network...
EUVD-2026-28450
Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network...
EUVD-2026-28454
Improper access control in Azure AI Foundry M365 published agents allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-28445
Improper neutralization of special elements in M365 Copilot allows an unauthorized attacker to disclose information over a network...
EUVD-2026-28452
Externally controlled reference to a resource in another sphere in Microsoft Partner Center allows an unauthorized attacker to perform spoofing over a network...
EUVD-2026-28449
Improper neutralization of special elements used in a command 'command injection' in Copilot Chat Microsoft Edge allows an unauthorized attacker to disclose information over a network...
CVE-2026-35435
Improper access control in Azure AI Foundry M365 published agents allows an unauthorized attacker to elevate privileges over a network...
CVE-2026-33111
Improper neutralization of special elements used in a command 'command injection' in Copilot Chat Microsoft Edge allows an unauthorized attacker to disclose information over a network...
CVE-2026-33823
Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network...
CVE-2026-26129
Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an unauthorized attacker to disclose information over a network...
CVE-2026-26164
Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an unauthorized attacker to disclose information over a network...
GHSA-XHRW-5QXX-JPWR Microsoft APM CLI's plugin.json component paths escape plugin root and copy arbitrary host files during install
Summary Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, and hooks are attacker-controlled, but the implementation does not enforce that those paths remain inside the plugin directory. A...
CVE-2026-34327
Externally controlled reference to a resource in another sphere in Microsoft Partner Center allows an unauthorized attacker to perform spoofing over a network...
CVE-2026-34327 Microsoft Partner Center Spoofing Vulnerability
...
