Security Risk Category
Microsoft Security Risks
Published vulnerability pages connected to Microsoft. Each page keeps one canonical URL and focused remediation guidance.
212 published Microsoft risks
Microsoft risks
Showing 1–36 of 212 published risks.
CVE-2026-65695 Office-Word-MCP-Server vulnerability
Office-Word-MCP-Server through 1.1.11 contains a path traversal vulnerability in its document tools that allows attackers who can influence the filename argument to read arbitrary .docx files or create and overwrite .docx files outside the intended working directory. Attackers can supply absolute paths or ../ traversal sequences directly to document open and save operations, bypassing the check_file_writeable and ensure_docx_extension helpers which perform no base-directory confinement or realpath validation.
Updated Jul 24, 2026
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 43.2 - Cross-Site Request Forgery to Privilege Escalation via Plugin Settings Update
The WPO365 | Login plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 43.2. This is due to the Ajax_Service::verify_ajax_request() helper gating its wp_verify_nonce() call behind the boolean option 'enable_nonce_check', which is absent from the default 'wpo365_options' array and therefore evaluates to false via get_global_boolean_var(); as a result, the wp_ajax_wpo365_update_settings handler (Ajax_Service::update_settings) accepts POSTs from cross-origin pages and forwards the attacker-supplied 'settings' payload (base64/JSON) to Options_Service::update_options(), which merges every key/value into wpo365_options without a key allowlist. This makes it possible for unauthenticated attackers to overwrite arbitrary plugin options — including enabling the SCIM REST endpoint (enable_scim), planting an attacker-known scim_secret_token, and setting new_usr_default_role to 'administrator' — via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Updated Jul 24, 2026
CVE-2026-49159 Microsoft Graph vulnerability
Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network.
Updated Jul 24, 2026
CVE-2026-50517 Microsoft 365 Copilot vulnerability
Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.
Updated Jul 24, 2026
CVE-2026-54120 Surface Management Services vulnerability
Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network.
Updated Jul 24, 2026
CVE-2026-56165 Microsoft Account vulnerability
Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network.
Updated Jul 24, 2026
CVE-2026-56191 Microsoft Exchange Online vulnerability
Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.
Updated Jul 24, 2026
CVE-2026-46415 caddy-defender vulnerability
The Caddy Defender plugin is a middleware for Caddy that allows users to block or manipulate requests based on the client's IP address. Prior to version 0.10.1, Caddy Defender used `r.RemoteAddr` when evaluating whether a request should be blocked. `RemoteAddr` is the address of the immediate peer connected to Caddy. In deployments where Caddy is behind a trusted proxy, CDN, or load balancer, the immediate peer is usually the proxy, not the original client. Caddy resolves the original client address into its `client_ip` request variable after applying the configured `trusted_proxies` policy, but Defender did not use that value. As a result, clients from blocked IP ranges could bypass Defender when accessing Caddy through a trusted proxy whose own IP address was not blocked. This affects deployments that use Defender behind trusted proxies and expect it to enforce blocking based on the real client IP. The issue is fixed in version 0.10.1 by making Defender prefer Caddys resolved `client_ip` request variable when it is available. Defender falls back to `RemoteAddr` only when Caddy has not provided a resolved client IP. There is no complete workaround in affected Defender versions for deployments that rely on Caddy's trusted proxy client IP resolution. Until upgrading, affected users should enforce equivalent IP blocking at the trusted proxy, CDN, load balancer, firewall, or other edge layer before traffic reaches Caddy. Deployments where Caddy receives traffic directly from clients, without an intermediate trusted proxy, are not affected by this bypass.
Updated Jul 21, 2026
CVE-2026-46671 onenote.rs vulnerability
Rust OneNote File Parser is a parser for Microsoft OneNote files implemented in Rust. Prior to version 1.1.1, a maliciously crafted `.onetoc2` table-of-contents file can cause `Parser::parse_notebook` to open arbitrary files on the host filesystem outside the notebook's directory. The parser reads entry names listed inside the `.onetoc2` and joins them against the notebook's base directory without validating that they are relative paths confined to that directory. The parser will bail out when the target file fails to parse as a OneNote section, so direct content exfiltration through the parser's return value is not practical, though file-existence probing and denial-of-service via large or special files remain possible. Anyone using `onenote_parser` to parse .onetoc2 files received from untrusted sources is affected. Users who only ever parse their own notebooks are not at meaningful risk. The issue is fixed in onenote_parser 1.1.1. The fix rejects absolute paths, parent-directory components, and other invalid path characters in entry names, and additionally canonicalises the resolved path to confirm it stays inside the notebook's base directory. For users who cannot upgrade to 1.1.1, only call `Parser::parse_notebook` on `.onetoc2` files from trusted sources. Alternatively, use `Parser::parse_section` / `Parser::parse_section_buffer` on individual .one files, which do not perform the directory walk.
Updated Jul 21, 2026
CVE-2026-57083 windows 10 1607 vulnerability
Use of uninitialized resource in Microsoft Windows Codecs Library allows an unauthorized attacker to disclose information locally.
Updated Jul 19, 2026
CVE-2026-57087 windows 10 1607 vulnerability
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
Updated Jul 19, 2026
CVE-2026-57090 windows 10 1607 vulnerability
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
Updated Jul 19, 2026
CVE-2026-57094 windows 10 1607 vulnerability
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
Updated Jul 19, 2026
CVE-2026-45496 visual studio code vulnerability
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
Updated Jul 17, 2026
CVE-2026-47282 visual studio code vulnerability
Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
Updated Jul 17, 2026
CVE-2026-48561 365 copilot vulnerability
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to execute code over a network.
Updated Jul 17, 2026
CVE-2026-49162 windows 11 24h2 vulnerability
Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
Updated Jul 17, 2026
CVE-2026-49165 windows 10 1607 vulnerability
Use of uninitialized resource in Microsoft Windows App Store allows an authorized attacker to disclose information locally.
Updated Jul 17, 2026
CVE-2026-49166 windows 11 24h2 vulnerability
Use after free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally.
Updated Jul 17, 2026
CVE-2026-49171 windows 10 1607 vulnerability
Use after free in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.
Updated Jul 17, 2026
CVE-2026-49807 windows 10 1809 vulnerability
Exposure of sensitive information to an unauthorized actor in Windows DirectX allows an unauthorized attacker to disclose information locally.
Updated Jul 17, 2026
CVE-2026-50295 windows 11 24h2 vulnerability
Improper privilege management in Microsoft Windows DNS allows an authorized attacker to bypass a security feature locally.
Updated Jul 17, 2026
CVE-2026-50356 windows 10 1607 vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows App Store allows an authorized attacker to elevate privileges locally.
Updated Jul 17, 2026
CVE-2026-50520 visual studio code vulnerability
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.
Updated Jul 17, 2026
CVE-2026-54988 365 apps vulnerability
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Updated Jul 17, 2026
CVE-2026-55899 365 apps vulnerability
Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Updated Jul 17, 2026
CVE-2026-55948 365 apps vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Updated Jul 17, 2026
CVE-2026-56193 365 apps vulnerability
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
Updated Jul 17, 2026
CVE-2026-58618 365 apps vulnerability
Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Updated Jul 17, 2026
CVE-2026-47290 365 apps vulnerability
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Updated Jul 17, 2026
CVE-2026-47642 365 apps vulnerability
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Updated Jul 17, 2026
CVE-2026-50301 365 apps vulnerability
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Updated Jul 17, 2026
CVE-2026-50305 windows 11 24h2 vulnerability
Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
Updated Jul 17, 2026
CVE-2026-50314 365 apps vulnerability
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Updated Jul 17, 2026
CVE-2026-50467 365 apps vulnerability
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Updated Jul 17, 2026
CVE-2026-50665 365 apps vulnerability
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
Updated Jul 17, 2026