Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 17

Export CSV
CVE-2026-55946

Microsoft Copilot Information Disclosure Vulnerability

Ai command injection in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Copilot
CVE-2026-24301

Microsoft Copilot Information Disclosure Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 8.8 High EPSS 1.1% KEV · Not listed
Vendors
Microsoft
Products
Copilot Copilot Web
CVE-2026-80098

Copilot Studio Elevation of Privilege Vulnerability

Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Copilot Studio
CVE-2026-55145

Outlook Copilot Tampering Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Outlook Copilot allows an authorized attacker to perform tampering over a network.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Copilot
CVE-2026-42824

M365 Copilot Information Disclosure Vulnerability

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS 7.6% KEV · Not listed
Vendors
Microsoft
Products
365 Copilot Copilot
CVE-2025-66389

GitHub Copilot 1.372.0 Filesystem Access Outside Workspace via File-Handler URI

GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter to fetch_webpage. Therefore, exfiltration could occur if there is indirect prompt injection.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Microsoft
Products
Copilot Github Copilot
CVE-2024-43610

Copilot Studio Information Disclosure Vulnerability

Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector

CVSS 3.1 · 7.4 High EPSS 1.0% KEV · Not listed
Vendors
Microsoft
Products
Copilot Studio
CVE-2026-47644

Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability

Improper neutralization of special elements in output used by a downstream component ('injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Copilot Chat Copilot Chat Edge
CVE-2026-45497

Microsoft M365 Copilot Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an authorized attacker to execute code over a network.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
365 Copilot Copilot
CVE-2026-33111

Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed
Vendors
Microsoft
Products
Copilot Chat Copilot Chat Edge
CVE-2026-21520

Copilot Studio Information Disclosure Vulnerability

Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Microsoft
Products
Copilot Studio
CVE-2026-26136

Microsoft Copilot Information Disclosure Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Microsoft
Products
Copilot
CVE-2025-53773

GitHub Copilot and Visual Studio Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS 3.5% KEV · Not listed
Vendors
Github Microsoft
Products
Copilot Visual Studio Visual Studio 2022
CVE-2025-62453

GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability

Improper validation of generative ai output in GitHub Copilot and Visual Studio Code allows an authorized attacker to bypass a security feature locally.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Github Microsoft
Products
Copilot Visual Studio Code
CVE-2024-38206

Microsoft Copilot Studio Information Disclosure Vulnerability

An authenticated attacker can bypass Server-Side Request Forgery (SSRF) protection in Microsoft Copilot Studio to leak sensitive information over a network.

CVSS 3.1 · 8.5 High EPSS 12.3% KEV · Not listed
Vendors
Microsoft
Products
Copilot Studio
CVE-2024-49038

Microsoft Copilot Studio Elevation Of Privilege Vulnerability

Improper neutralization of input during web page generation ('Cross-site Scripting') in Copilot Studio by an unauthorized attacker leads to elevation of privilege over a network.

CVSS 3.1 · 9.3 Critical EPSS 1.0% KEV · Not listed
Vendors
Microsoft
Products
Copilot Studio