Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 46

Export CSV
CVE-2026-120783

Azure DevOps Server Elevation of Privilege Vulnerability

Weak authentication in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Devops Server 2025
CVE-2026-85923

Azure DevOps Server Elevation of Privilege Vulnerability

Authorization bypass through user-controlled key in Azure DevOps Server allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Devops Server
CVE-2026-112745

Azure DevOps Server Information Disclosure Vulnerability

Server-side request forgery (ssrf) in Azure DevOps Server allows an authorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Devops Azure Devops Server
CVE-2025-29813

Azure DevOps Elevation of Privilege Vulnerability

Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 10 Critical EPSS 1.6% KEV · Not listed
Vendors
Microsoft
Products
Azure Devops Azure Devops Server
CVE-2025-47158

Azure DevOps Server Elevation of Privilege Vulnerability

Authentication bypass by assumed-immutable data in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Azure Devops Azure Devops Server
CVE-2019-0996

Azure DevOps Server Spoofing Vulnerability

A spoofing vulnerability exists in Azure DevOps Server when it improperly handles requests to authorize applications, resulting in a cross-site request forgery. An attacker who successfully exploited this vulnerability could bypass OAuth protections and register an application on behalf of the targeted user. To exploit this vulnerability, an attacker would need to create a page specifically designed to cause a cross-site request. The attacker would then need to convince a targeted user to click a link to the malicious page. The update addresses the vulnerability by modifying how Azure DevOps Server protects application registration requests.

CVSS 3.0 · 6.5 Medium EPSS 1.6% KEV · Not listed
Vendors
Microsoft
Products
Azure Devops Server