Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 544

Export CSV
CVE-2026-119990

Azure OpenAI Elevation of Privilege Vulnerability

Missing authentication for critical function in Azure OpenAI allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Open-ai
CVE-2026-120783

Azure DevOps Server Elevation of Privilege Vulnerability

Weak authentication in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Devops Server 2025
CVE-2026-121668

Azure Confidential Clean Rooms Tampering Vulnerability

Missing authorization in Azure Confidential Clean Rooms allows an authorized attacker to perform tampering over a network.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Confidential Clean Room
CVE-2026-114160

Azure Managed Grafana Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Azure Managed Grafana allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Managed Grafana
CVE-2026-85923

Azure DevOps Server Elevation of Privilege Vulnerability

Authorization bypass through user-controlled key in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Devops Server
CVE-2026-114162

Microsoft Graph Elevation of Privilege Vulnerability

Incorrect authorization in Microsoft Graph allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Privileged Management
CVE-2026-119989

Azure Pipelines Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Web Apps
CVE-2026-118288

Microsoft Azure File Sync Elevation of Privilege Vulnerability

Incorrect permission assignment for critical resource in Azure File Sync allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure File Sync Azure File Sync V22
CVE-2026-112745

Azure DevOps Server Information Disclosure Vulnerability

Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Devops Azure Devops Server
CVE-2026-114161

Azure CycleCloud Elevation of Privilege Vulnerability

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure CycleCloud allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Cyclecloud
CVE-2026-109462

Azure Firmware Security Feature Bypass Vulnerability

Improper check for certificate revocation in Azure Firmware allows an authorized attacker to bypass a security feature locally.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Virtual Machines
CVE-2026-108470

Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability

Insufficiently protected credentials in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Msal-node
CVE-2026-105734

Azure Local Elevation of Privilege Vulnerability

Incorrect permission assignment for critical resource in Azure Local allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Local
CVE-2026-109457

Azure CLI Remote Code Execution Vulnerability

Improper neutralization of special elements used in an os command ('os command injection') in Azure CLI allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Machine Learning
CVE-2026-118742

Azure Front Door Elevation of Privilege Vulnerability

Incorrect permission assignment for critical resource in Azure Front Door (AFD) allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Front Door
CVE-2026-113823

Azure CycleCloud Information Disclosure Vulnerability

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure CycleCloud allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed
Vendors
Microsoft
Products
Azure Cyclecloud
CVE-2026-113822

Azure CycleCloud Elevation of Privilege Vulnerability

Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Cyclecloud
CVE-2026-102224

Azure CycleCloud Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Cyclecloud
CVE-2026-58279

Azure CycleCloud Elevation of Privilege Vulnerability

Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Cyclecloud