Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 66

Export CSV
CVE-2026-54130

M365 Copilot Information Disclosure Vulnerability

Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed
Vendors
Microsoft
Products
365 Copilot
CVE-2026-42895

Microsoft Copilot Tampering Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Copilot
CVE-2025-32711

M365 Copilot Information Disclosure Vulnerability

Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 9.3 Critical EPSS 7.2% KEV · Not listed
Vendors
Microsoft
Products
365 Copilot
CVE-2026-85881

Microsoft Office Graphics Elevation of Privilege Vulnerability

Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Copilot Office
CVE-2026-78501

Microsoft 365 Copilot Business Chat Information Disclosure Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Copilot Business Chat 365 Copilot Chat
CVE-2026-85887

M365 Copilot Information Disclosure Vulnerability

Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Copilot
CVE-2026-85885

Microsoft 365 Copilot Elevation of Privilege Vulnerability

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Copilot
CVE-2026-48561

Microsoft Edge Copilot Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 9.6 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Copilot 365 Copilot Android 365 Copilot Ios and 1 more
CVE-2026-50517

Microsoft M365 Copilot Remote Code Execution Vulnerability

Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.

CVSS 3.1 · 9.9 Critical EPSS 1.7% KEV · Not listed
Vendors
Microsoft
Products
365 Copilot
CVE-2026-50387

Windows GDI Elevation of Privilege Vulnerability

Stack-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Copilot Microsoft 365 Office and 23 more
CVE-2026-42824

M365 Copilot Information Disclosure Vulnerability

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS 7.6% KEV · Not listed
Vendors
Microsoft
Products
365 Copilot Copilot
CVE-2026-45463

Microsoft Office Remote Code Execution Vulnerability

Integer underflow (wrap or wraparound) in Microsoft Office allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps 365 Copilot Microsoft 365 and 8 more
CVE-2026-45460

Microsoft Office Information Disclosure Vulnerability

Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Apps 365 Copilot Microsoft 365 and 7 more
CVE-2026-41106

Microsoft 365 Copilot Elevation of Privilege Vulnerability

Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Copilot
CVE-2026-47645

Microsoft 365 Copilot's Business Chat Elevation of Privilege Vulnerability

Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Copilot