M365 Copilot Information Disclosure Vulnerability

Improper neutralization of special elements used in a command 'command injection' in M365 Copilot allows an unauthorized attacker to disclose information over a network...

PT-2026-38581

Name of the Vulnerable Software and Affected Versions Microsoft Partner Center affected versions not specified Description An externally controlled reference to a resource in another sphere allows an unauthorized attacker to perform spoofing over a network. Recommendations At the moment, there is...

CVE-2026-6701

The WordPress addfreespace plugin (versions ≤ 0.1.3) is vulnerable to Cross-Site Request Forgery due to missing/incorrect nonce validation, allowing unauthenticated attackers to modify settings and inject stored scripts via a forged request, by convincing an admin to perform an action. Root cause...

EUVD-2026-25308

Uncontrolled search path element in Microsoft Power Apps allows an unauthorized attacker to execute code over a network...

EUVD-2026-25309

Server-side request forgery ssrf in Microsoft Dynamics 365 Online allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-32210

Server-side request forgery ssrf in Microsoft Dynamics 365 Online allows an unauthorized attacker to perform spoofing over a network...

PT-2026-34759

Name of the Vulnerable Software and Affected Versions Microsoft Dynamics 365 Online affected versions not specified Description A server-side request forgery SSRF allows an unauthorized attacker to perform spoofing over a network. SSRF is a flaw where an attacker can force a server-side applicati...

PT-2026-34757

CVE-2026-26150 Server-side request forgery ssrf in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network. https://t.co/iDqEazYdOv...

CVE-2026-4118

The CVE-2026-4118 entry concerns the WordPress Call To Action Plugin (versions update(). This enables unauthenticated attackers to modify configuration fields (e.g., title, content, link URL, image URL, colors) by forging requests, provided a site administrator is induced to perform an action suc...

CVE-2026-40372

Improper verification of cryptographic signature in ASP.NET Core allows an unauthorized attacker to elevate privileges over a network...

CVE-2026-33095

Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally...

CVE-2026-33114

Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally...

CVE-2026-32190

Use after free in Microsoft Office allows an unauthorized attacker to execute code locally...

CVE-2026-32189

Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally...

CVE-2026-32157

Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network...

CVE-2026-26154

Improper input validation in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network...

CVE-2026-26151

Insufficient ui warning of dangerous operations in Windows Remote Desktop allows an unauthorized attacker to perform spoofing over a network...

CVE-2026-23666

A flaw was found in .NET Framework. An unauthorized attacker can exploit a race condition, which is a concurrent execution using shared resources with improper synchronization, to deny service over a network. This vulnerability can lead to a Denial of Service DoS for affected systems. Mitigation...

EUVD-2026-22589

Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network...

EUVD-2026-22609

Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally...