Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 544

Export CSV
CVE-2026-56161

Azure Logic Apps Information Disclosure Vulnerability

Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Logic Apps
CVE-2026-50481

Azure Active Directory Elevation of Privilege Vulnerability

Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Active Directory
CVE-2025-66390

Cross‑Tenant Signup Bypass via Host Header Manipulation in Azure API Management

In Microsoft Azure API Management through 2025-10-17, when self-service signup (username/password Basic Authentication) is enabled in Tenant A, an attacker can reuse the registration flow by changing the hostname or tenant identifier to Tenant B, even when Tenant B has signup disabled at the UI level. In other words, disabling signup in the UI does not disable the underlying API endpoint (which still accepts cross-tenant requests based on the Host header). NOTE: The supplier states that they evaluated the report and determined it did not cross a security boundary (i.e., the observed behavior was a configuration/state issue rather than an exploitable product vulnerability affecting tenant isolation). NOTE: The supplier evaluated this report and determined that it did not cross a security boundary (i.e., the observed behavior was a configuration/state issue rather than an exploitable product vulnerability affecting tenant isolation).

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Api Management
CVE-2026-66803

Azure Cosmos DB Remote Code Execution Vulnerability

Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Cosmos Db Cosmos Db
CVE-2026-24304

Azure Resource Manager Elevation of Privilege Vulnerability

Improper access control in Azure Resource Manager allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Resource Manager
CVE-2026-56167

Azure AI Search Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Ai Search Azure Ai Search
CVE-2026-62835

Azure Portal Information Disclosure Vulnerability

Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Portal
CVE-2026-58275

Azure DNS Elevation of Privilege Vulnerability

Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Dns
CVE-2026-62825

Azure Key Vault Elevation of Privilege Vulnerability

Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Key Vault
CVE-2026-56160

Azure Red Hat OpenShift (ARO) Elevation of Privilege Vulnerability

Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Red Hat Openshift
CVE-2026-56163

Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability

Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Kubernetes Service
CVE-2026-50653

Azure Active Directory Denial of Service Vulnerability

Loop with unreachable exit condition ('infinite loop') in Azure Active Directory allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Microsoft
Products
.net .net Framework Azure Active Directory and 12 more
CVE-2026-57969

Azure CycleCloud Elevation of Privilege Vulnerability

Missing authentication for critical function in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Cyclecloud
CVE-2026-26145

Microsoft Azure Synapse Elevation of Privilege Vulnerability

Improper access control in Azure Synapse allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Synapse
CVE-2026-32174

Azure Bot Service Elevation of Privilege Vulnerability

Improper authentication in Azure Bot Service allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Ai Bot Service
CVE-2026-48584

Microsoft Azure Synapse Elevation of Privilege Vulnerability

Execution with unnecessary privileges in Azure Synapse allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Synapse