CVE-2025-59205

Concurrent execution using shared resource with improper synchronization 'race condition' in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally...

CVE-2025-59248

Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network...

CVE-2025-59234

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally...

CVE-2025-59225

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2025-59227

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally...

CVE-2025-59223

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2025-59195

Concurrent execution using shared resource with improper synchronization 'race condition' in Microsoft Graphics Component allows an authorized attacker to deny service locally...

CVE-2025-59232

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally...

CVE-2025-59243

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2025-59261

Time-of-check time-of-use toctou race condition in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally...

CVE-2025-48004

Use after free in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally...

Inadequate Encryption Strength

Overview Affected versions of this package are vulnerable to Inadequate Encryption Strength via the SMTP process. An attacker can intercept sensitive information by performing a man-in-the-middle attack that prevents the use of TLS, causing data to be sent over an unencrypted connection...

Microsoft Security Advisory CVE-2025-55247 | .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2025-55247 | .NET Denial of Service Vulnerability Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET 8.0.xxx, .NET 9.0.xxx and .NET 10.0.xxx. This advisory also provides guidance on what developers c...

dotnet: .NET Security Feature Bypass Vulnerability

A flaw was found in ASP.NET Core’s HTTP request handling that leads to inconsistent interpretation of specially crafted HTTP requests. This mismatch can be abused by an authorized network attacker to smuggle or manipulate request boundaries, allowing bypass of security controls or unintended...

The importance of hardening customer support tools against cyberattacks

The Deputy CISO blog series is whereMicrosoft Deputy Chief Information Security Officers CISOs share their thoughts on what is most important in their respective domains. In this series, you will get practical advice, tactics to start and stop deploying, forward-looking commentary on where the...

CVE-2025-9067

A security issue exists within the x86 Microsoft Installer File MSI, installed with FTLinx. Authenticated attackers with valid Windows user credentials can initiate a repair and hijack the resulting console window. This allows the launching of a command prompt running with SYSTEM-level privileges...

Dismantling a Critical Supply Chain Risk in VSCode Extension Marketplaces

Wiz Research has uncovered 550+ secrets hiding in plain sight. We worked with Microsoft to shut the door...

Fake Google Job Offer Email Scam Targets Workspace and Microsoft 365 Users

Cybersecurity firm Sublime Security details a new credential phishing scam impersonating Google Careers to steal login details from Google Workspace and Microsoft 365 users...

CVE-2025-11177 External Login <= 1.11.2 - Unauthenticated SQL Injection via log

The External Login plugin for WordPress is vulnerable to SQL Injection via the 'log' parameter in all versions up to, and including, 1.11.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2025-11177 External Login <= 1.11.2 - Unauthenticated SQL Injection via log

The External Login plugin for WordPress is vulnerable to SQL Injection via the 'log' parameter in all versions up to, and including, 1.11.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...