Export limit exceeded: 25592 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (25592 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-42980 | 1 Microsoft | 26 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 23 more | 2026-07-29 | 7.8 High |
| Integer underflow (wrap or wraparound) in Windows NT OS Kernel allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-49165 | 1 Microsoft | 11 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 8 more | 2026-07-29 | 7.1 High |
| Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-59859 | 1 Microsoft | 1 Kiota | 2026-07-29 | N/A |
| Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.4, Kiota's PHP generator embedded OpenAPI description, default fields, property names, and other schema-derived strings into PHP double-quoted literals through SanitizeDoubleQuote() in Writers/StringExtensions.cs without escaping $, allowing attacker-controlled ${...}, $var, or {$obj->prop} interpolation constructs to inject arbitrary PHP code into generated model and request-builder classes. This issue is fixed in version 1.32.4. | ||||
| CVE-2026-58629 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-07-29 | 7 High |
| Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-50426 | 1 Microsoft | 8 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 5 more | 2026-07-29 | 6.8 Medium |
| Relative path traversal in DNS Server allows an authorized attacker to execute code over an adjacent network. | ||||
| CVE-2026-59865 | 1 Microsoft | 1 Kiota | 2026-07-29 | N/A |
| Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, `kiota info` read x-ms-kiota-info.languagesInformation.<language>.dependencyInstallCommand plus dependency name and version values from an OpenAPI description and presented the spec-supplied command as Kiota's recommended install command, allowing an attacker-controlled or compromised description to cause command injection when the suggested command was run manually or through the Kiota VS Code extension's kiota info --json dependency-install flow. This issue is fixed in version 1.32.5. | ||||
| CVE-2026-59866 | 1 Microsoft | 1 Kiota | 2026-07-29 | N/A |
| Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.32.5, Kiota emitted x-ms-kiota-info clientClassName and clientNamespaceName values without identifier or path sanitization as both generated client class or namespace names and generated output path components when `kiota generate` ran without -c/--class-name, allowing an attacker-controlled or compromised OpenAPI description to write generated source outside the -o output directory and inject arbitrary text into generated class or namespace declarations. This issue is fixed in version 1.32.5 by GenerationConfiguration.SanitizeClientClassName and SanitizeClientNamespaceName. | ||||
| CVE-2026-35425 | 1 Microsoft | 1 Azure Api Management | 2026-07-29 | 8 High |
| Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network. | ||||
| CVE-2025-6338 | 2 Microsoft, Qt | 2 Windows, Qt | 2026-07-29 | N/A |
| There is an incomplete cleanup vulnerability in Qt Network's Schannel support on Windows which can lead to a Denial of Service over a long period. This issue affects Qt from 5.15.0 through 6.8.3, from 6.9.0 before 6.9.2. | ||||
| CVE-2026-56171 | 1 Microsoft | 3 Remote Desktop Client, Remote Desktop Web Client, Windows Admin Center | 2026-07-28 | 7.1 High |
| Exposure of private personal information to an unauthorized actor in Windows RDP allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-62828 | 1 Microsoft | 2 Edge, Edge For Android | 2026-07-28 | 5.4 Medium |
| Improper input validation in Microsoft Edge for Android allows an unauthorized attacker to perform tampering over a network. | ||||
| CVE-2024-58288 | 3 Avg, Genexus, Microsoft | 3 Protection, Protection Server, Windows | 2026-07-28 | N/A |
| Genexus Protection Server 9.7.2.10 contains an unquoted service path vulnerability in the protsrvservice Windows service configuration. Attackers can exploit the unquoted binary path to execute arbitrary code with elevated LocalSystem privileges by placing malicious executables in specific file system locations. | ||||
| CVE-2026-56167 | 1 Microsoft | 2 Azure Ai Search, Azure Ai Search | 2026-07-27 | 8.5 High |
| Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a network. | ||||
| CVE-2026-57978 | 1 Microsoft | 1 Edge Chromium | 2026-07-27 | 5.4 Medium |
| Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | ||||
| CVE-2026-57989 | 1 Microsoft | 1 Edge Chromium | 2026-07-27 | 7.4 High |
| Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-57990 | 1 Microsoft | 1 Edge Chromium | 2026-07-27 | 7.4 High |
| Files or directories accessible to external parties in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-48561 | 1 Microsoft | 3 365 Copilot Android, 365 Copilot Ios, Edge Copilot | 2026-07-26 | 9.6 Critical |
| Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-62835 | 1 Microsoft | 1 Azure Portal | 2026-07-25 | 9.3 Critical |
| Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-56191 | 1 Microsoft | 1 Exchange Online | 2026-07-24 | 10 Critical |
| Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network. | ||||
| CVE-2026-49159 | 1 Microsoft | 1 Graph | 2026-07-24 | 6.5 Medium |
| Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network. | ||||