Windows Server Update Service - Insecure Deserialization

Windows Server Update Service contains an insecure deserialization vulnerability caused by deserialization of untrusted data. An unauthorized attacker with network access can exploit this to execute arbitrary code remotely, potentially leading to full system compromise. id: CVE-2025-59287 info:...

EUVD-2026-63693

Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network...

EUVD-2026-63628

Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network...

EUVD-2026-63617

Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...

EUVD-2026-63692

Server-side request forgery ssrf in Azure Active Directory allows an authorized attacker to elevate privileges over a network...

EUVD-2026-63627

Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-63690

Improper neutralization of special elements used in an sql command 'sql injection' in Azure SQL Database allows an authorized attacker to elevate privileges over a network...

EUVD-2026-63688

Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-63626

Improper limitation of a pathname to a restricted directory 'path traversal' in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-63622

Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network...

EUVD-2026-63625

Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network...

EUVD-2026-63624

Improper neutralization of special elements used in an sql command 'sql injection' in Azure SQL Database allows an authorized attacker to elevate privileges over a network...

EUVD-2026-63619

Improper neutralization of argument delimiters in a command 'argument injection' in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network...

EUVD-2026-63620

Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over a network...

Microsoft Entra ID Deserialization of Untrusted Data Vulnerability

Microsoft Entra ID formerly known as Azure Active Directory contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network...

CVE-2026-70105

Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...

CVE-2026-69851

Server-side request forgery ssrf in Azure Active Directory allows an authorized attacker to elevate privileges over a network...

CVE-2026-69543

Server-side request forgery ssrf in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network...

CVE-2026-69558

Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network...

CVE-2026-69555

Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network...