Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 544

Export CSV
CVE-2026-45480

Azure Active Directory Elevation of Privilege Vulnerability

Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Active Directory
CVE-2022-39344

Azure RTOS USBX vulnerable to buffer overflow

Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. Prior to version 6.1.12, the USB DFU UPLOAD functionality may be utilized to introduce a buffer overflow resulting in overwrite of memory contents. In particular cases this may allow an attacker to bypass security features or execute arbitrary code. The implementation of `ux_device_class_dfu_control_request` function prevents buffer overflow during handling of DFU UPLOAD command when current state is `UX_SYSTEM_DFU_STATE_DFU_IDLE`. This issue has been patched, please upgrade to version 6.1.12. As a workaround, add the `UPLOAD_LENGTH` check in all possible states.

CVSS 3.1 · 9.8 Critical EPSS 2.7% KEV · Not listed
Vendors
Microsoft
Products
Azure Rtos Usbx
CVE-2022-39343

Azure RTOS FileX vulnerable to Buffer Offerflow

Azure RTOS FileX is a FAT-compatible file system that’s fully integrated with Azure RTOS ThreadX. In versions before 6.2.0, the Fault Tolerant feature of Azure RTOS FileX includes integer under and overflows which may be exploited to achieve buffer overflow and modify memory contents. When a valid log file with correct ID and checksum is detected by the `_fx_fault_tolerant_enable` function an attempt to recover the previous failed write operation is taken by call of `_fx_fault_tolerant_apply_logs`. This function iterates through the log entries and performs required recovery operations. When properly crafted a log including entries of type `FX_FAULT_TOLERANT_DIR_LOG_TYPE` may be utilized to introduce unexpected behavior. This issue has been patched in version 6.2.0. A workaround to fix line 218 in fx_fault_tolerant_apply_logs.c is documented in the GHSA.

CVSS 3.1 · 5.6 Medium EPSS 1.1% KEV · Not listed
Vendors
Microsoft
Products
Azure Rtos Filex
CVE-2026-47643

Azure Stack Edge Remote Code Execution Vulnerability

External control of file name or path in Azure Stack Edge allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Stack Edge
CVE-2026-32193

Azure Kubernetes Service (AKS) Remote Code Execution Vulnerability

Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Azure Kubernetes Service allows an authorized attacker to execute code locally.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Kubernetes Service
CVE-2026-41098

Azure Stack Edge Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Azure Stack Edge allows an authorized attacker to perform spoofing over a network.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Stack Edge
CVE-2024-38204

Imagine Cup site Information Disclosure Vulnerability

Improper access control in Imagine Cup allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Functions
CVE-2026-33844

Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability

Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Managed Instance For Apache Cassandra
CVE-2026-26147

Azure Stack HCI Information Disclosure Vulnerability

Improper input validation in Azure Compute Gallery allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Stack Hci
CVE-2026-40411

Azure Virtual Network Gateway Remote Code Execution Vulnerability

Improper input validation in Azure Virtual Network Gateway allows an authorized attacker to execute code over a network.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Virtual Network Gateway
CVE-2026-40412

Azure Orbital Spatio Remote Code Execution Vulnerability

Unrestricted upload of file with dangerous type in Azure Orbital Spatio allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Orbital Spatio
CVE-2026-47280

Azure Resource Manager Elevation of Privilege Vulnerability

Improper authentication in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Resource Manager
CVE-2026-33117

Azure SDK for Java Security Feature Bypass Vulnerability

The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Sdk For Java
CVE-2026-42822

Azure Local Disconnected Operations (ALDO) Elevation of Privilege Vulnerability

Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Local Azure Resource Manager