CVE-2026-57097 Microsoft XML Security Feature Bypass Vulnerability
Untrusted search path in Microsoft XML allows an unauthorized attacker to bypass a security feature with a physical attack.
EPSS 0.01 CVE-2026-57097 Microsoft US
Výsledky hledání
41
CVE-2026-56193 Microsoft Office Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
EPSS 0.00 CVE-2026-56193 Microsoft US
CVE-2026-56164 Microsoft SharePoint Server Elevation of Privilege Vulnerability
Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
KEV ✓ EPSS 0.27 CVE-2026-56164 Microsoft US
CVE-2026-55948 Microsoft Excel Remote Code Execution Vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-55948 Microsoft US
CVE-2026-55899 Microsoft Excel Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-55899 Microsoft US
CVE-2026-54988 Microsoft Excel Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
EPSS 0.00 CVE-2026-54988 Microsoft US
CVE-2026-50678 Microsoft Excel Information Disclosure Vulnerability
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
EPSS 0.00 CVE-2026-50678 Microsoft US
CVE-2026-50675 Microsoft Excel Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-50675 Microsoft US
CVE-2026-54108 Microsoft SharePoint Server Spoofing Vulnerability
External control of file name or path in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-54108 Microsoft US
CVE-2026-55002 Microsoft SQL Server Elevation of Privilege Vulnerability
External control of file name or path in SQL Server allows an authorized attacker to elevate privileges locally.
EPSS 0.01 CVE-2026-55002 Microsoft US
CVE-2026-54118 Microsoft SQL Server Remote Code Execution Vulnerability
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-54118 Microsoft US
CVE-2026-54117 Microsoft SQL Server Remote Code Execution Vulnerability
Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-54117 Microsoft US
CVE-2026-55012 Microsoft Defender Remote Code Execution Vulnerability
Integer overflow or wraparound in Microsoft Defender allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-55012 Microsoft US
CVE-2026-55011 Microsoft Defender Remote Code Execution Vulnerability
Integer underflow (wrap or wraparound) in Microsoft Defender allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-55011 Microsoft US
CVE-2026-55009 Microsoft Exchange Server Elevation of Privilege Vulnerability
Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
EPSS 0.03 CVE-2026-55009 Microsoft US
CVE-2026-55006 Microsoft Exchange Server Elevation of Privilege Vulnerability
Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-55006 Microsoft US
CVE-2026-55005 Microsoft Exchange Server Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-55005 Microsoft US
CVE-2026-54992 Microsoft Message Queuing Queue Manager Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-54992 Microsoft US
CVE-2026-55004 Windows Print Configuration Elevation of Privilege Vulnerability
Double free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-55004 Microsoft US
CVE-2026-54993 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-54993 Microsoft US
CVE-2026-49784 Microsoft Windows App Store Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-49784 Microsoft US
CVE-2026-49174 DNS Client Tampering Vulnerability
Missing authentication for critical function in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.
EPSS 0.00 CVE-2026-49174 Microsoft US
CVE-2026-49171 Windows Speech Runtime Elevation of Privilege Vulnerability
Use after free in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-49171 Microsoft US
CVE-2026-49166 Windows Print Configuration Elevation of Privilege Vulnerability
Use after free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-49166 Microsoft US
CVE-2026-49165 Microsoft Windows App Store Information Disclosure Vulnerability
Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclose information locally.
EPSS 0.00 CVE-2026-49165 Microsoft US
CVE-2026-42900 Microsoft Windows App Store Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows App Store allows an unauthorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-42900 Microsoft US
CVE-2026-47296 Microsoft SQL Server Elevation of Privilege Vulnerability
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-47296 Microsoft US
CVE-2026-58644 Microsoft SharePoint Remote Code Execution Vulnerability
The Patch for this issue was released but the CVE was inadvertently left out of the Patch Tuesday June 2026 release
KEV ✓ EPSS 0.16 CVE-2026-58644 Microsoft US
CVE-2026-50458 Microsoft Brokering File System Elevation of Privilege Vulnerability
Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-50458 Microsoft US
CVE-2026-50466 Microsoft Brokering File System Elevation of Privilege Vulnerability
Use after free in Windows Brokering File System allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-50466 Microsoft US
CVE-2026-48561 Microsoft Copilot Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-48561 Microsoft US
CVE-2026-50343 Microsoft Install Service Elevation of Privilege Vulnerability
Improper privilege management in Microsoft Install Service allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-50343 Microsoft US
CVE-2026-47301 Configuration Manager Elevation of Privilege Vulnerability
Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-47301 Microsoft US
CVE-2026-55129 Microsoft Office Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-55129 Microsoft US
CVE-2026-55050 Microsoft Word Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
EPSS 0.01 CVE-2026-55050 Microsoft US
CVE-2026-50476 Windows Network Connections Service Elevation of Privilege Vulnerability
Use after free in Microsoft Windows allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-50476 Microsoft US
CVE-2026-50655 Microsoft Windows Media Foundation Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code locally.
EPSS 0.00 CVE-2026-50655 Microsoft US
CVE-2026-49162 Microsoft Brokering File System Elevation of Privilege Vulnerability
Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVE-2026-49162 Microsoft US
OAuth Client ID Spoofing Lets Attackers Validate Stolen Microsoft Entra Credentials
Microsoft US
METTLER TOLEDO: Microsoft cumulative patches until March for FreshWay B/D
[VDE-2026-066] This update deploys cumulative Microsoft Windows security patches through March 2026 for LTSB 2016, LTSC 2019, and LTSC 2021.
EPSS 0.01 CVE-2026-23673 CVE-2026-25171 CVE-2026-25172 CVE-2026-25174 CVE-2026-25175 CVE-2026-25179 CVE-2026-25181 CVE-2026-25185 CVE-2026-26111 CVE-2026-26128 METTLER TOLEDO Microsoft DE
Forgotten UEFI shims undermining Secure Boot
ESET researchers discovered 11 vulnerable UEFI shim bootloaders signed by Microsoft that allow attackers to bypass UEFI Secure Boot by exploiting decade-old vulnerabilities
Microsoft SK
1
CVE-2026-58281 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Deserialization of untrusted data in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-58281 Microsoft US
1
SPOJENO PŘES CVE CVE-2026-47291: Remote Code Execution in the Windows HTTP.sys
In this excerpt of a TrendAI Research Services vulnerability report, Yazhi Wang and Jonathan Lein of the TrendAI Research team detail a recently patched remote code execution bug in the Windows HTTP protocol stack. Successful exploitation of this vulnerability can result in a denial-of-service condition, or, in the worst case, code execution with kernel privileges. The following is a portion of their write-up covering CVE-2026-47291, with a few minimal modifications. A remote code execution…
EPSS 0.23 CVE-2026-47291 Microsoft US
1
Conditional Access Misconfigurations Exposed 55 Orgs with MFA On
Two Microsoft 365 attacks got through Conditional Access policies that seemed fully configured. Learn what went wrong and how Huntress Managed ISPM catches these gaps first.
Microsoft US
1
CVE-2026-58525 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
EPSS 0.00 CVE-2026-58525 Microsoft US
1
The ‘Ghost’ in the Database: Recovering Active ADFS Signing Keys via Machine DPAPI
Written by: Shebin Mathew Introduction The "Golden SAML" technique, first described by CyberArk researchers in 2017, and further detailed by Mandiant researchers in 2021, remains one of the most effective methods for threat actors to forge identity assertions in the Microsoft ecosystem. By obtaining the private key of an ADFS token-signing certificate, an attacker can authenticate as any user to any SAML-federated application, bypassing multifactor authentication (MFA), conditional access, and…
14
CVE-2026-58523 Microsoft Edge for Android Security Feature Bypass Vulnerability
Improper access control in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network.
EPSS 0.01 CVE-2026-58523 Microsoft US
CVE-2026-58291 Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Operation on a resource after expiration or release in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-58291 Microsoft US
CVE-2026-58597 Microsoft Edge (Chromium-based) Spoofing Vulnerability
Insufficient ui warning of dangerous operations in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-58597 Microsoft US
CVE-2026-58524 Microsoft Edge (Chromium-based) Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
EPSS 0.00 CVE-2026-58524 Microsoft US
CVE-2026-58300 Microsoft Edge for Android Information Disclosure Vulnerability
Absolute path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.
EPSS 0.00 CVE-2026-58300 Microsoft US
CVE-2026-58298 Microsoft Edge (Chromium-based) Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
EPSS 0.00 CVE-2026-58298 Microsoft US
CVE-2026-58297 Microsoft Edge for Android Information Disclosure Vulnerability
Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-58297 Microsoft US
CVE-2026-58296 Microsoft Edge for Android Information Disclosure Vulnerability
Exposure of private personal information to an unauthorized actor in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-58296 Microsoft US
CVE-2026-58295 Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
EPSS 0.01 CVE-2026-58295 Microsoft US
CVE-2026-58294 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-58294 Microsoft US
CVE-2026-58293 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-58293 Microsoft US
CVE-2026-58292 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.00 CVE-2026-58292 Microsoft US
CVE-2026-58290 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.00 CVE-2026-58290 Microsoft US
CVE-2026-58289 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.02 CVE-2026-58289 Microsoft US