Filtered by vendor Microsoft
Subscriptions
Total
27504 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-80090 | 1 Microsoft | 10 365 Apps, Microsoft 365, Office 2019 and 7 more | 2026-09-08 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-83949 | 1 Microsoft | 6 365 Apps, Office 2019, Office 2021 and 3 more | 2026-09-08 | 5.5 Medium |
| Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-83951 | 1 Microsoft | 6 365 Apps, Office 2019, Office 2021 and 3 more | 2026-09-08 | 5.5 Medium |
| Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-78506 | 1 Microsoft | 10 365 Apps, Microsoft 365, Office 2019 and 7 more | 2026-09-08 | 5.5 Medium |
| Improper null termination in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | ||||
| CVE-2026-78502 | 1 Microsoft | 10 365 Apps, Microsoft 365, Office 2019 and 7 more | 2026-09-08 | 6.5 Medium |
| Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-77901 | 1 Microsoft | 10 365 Apps, Microsoft 365, Office 2019 and 7 more | 2026-09-08 | 8.8 High |
| Null pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-72976 | 1 Microsoft | 10 365 Apps, Microsoft 365, Office 2019 and 7 more | 2026-09-08 | 5 Medium |
| Out-of-bounds read in Microsoft Office Word allows an authorized attacker to disclose information locally. | ||||
| CVE-2026-72923 | 1 Microsoft | 2 Openapi.readers, Openapi.yamlreader | 2026-09-08 | 7.5 High |
| In Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 until 2.12.0 and from 3.0.0 until 3.10.0, and in Microsoft.OpenApi.Readers prior to 1.6.30, a small YAML OpenAPI document containing nested anchors and aliases can cause uncontrolled resource consumption when parsed through the public YAML reader APIs. YAML is parsed through SharpYaml, which represents aliases as shared nodes in a directed acyclic graph, so the parsed YAML graph stays small, but converting that graph to System.Text.Json.Nodes.JsonNode requires every alias to be materialized as an independent node because a JsonNode cannot be attached to multiple parents. Without a bound on that conversion work, a document with N nested anchors each referenced k times can require k^N materialized JSON nodes, leading to excessive memory allocation and process termination through out-of-memory conditions, a billion laughs style denial of service. The patched versions bound the YAML-to-JSON conversion by node count and nesting depth and report an OpenApiDiagnostic error instead of expanding without limit. This vulnerability is fixed in Microsoft.OpenApi.YamlReader 2.12.0 and 3.10.0, and Microsoft.OpenApi.Readers 1.6.30. | ||||
| CVE-2026-66816 | 1 Microsoft | 6 Microsoft Sql Server 2022 (cu 26), Microsoft Sql Server 2022 (gdr), Microsoft Sql Server 2025 (cu8) and 3 more | 2026-09-08 | 6.5 Medium |
| Insufficient logging in SQL Server allows an authorized attacker to bypass a security feature over a network. | ||||
| CVE-2026-67369 | 1 Microsoft | 3 Microsoft Sql Server 2025 (cu8), Microsoft Sql Server 2025 For X64-based Systems (gdr), Sql Server 2025 | 2026-09-08 | 6.5 Medium |
| Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-69764 | 1 Microsoft | 7 365 Apps, Office 2016, Office 2019 and 4 more | 2026-09-08 | 8.8 High |
| Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-69719 | 1 Microsoft | 10 365 Apps, Microsoft 365, Office 2019 and 7 more | 2026-09-08 | 6.5 Medium |
| Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-77907 | 1 Microsoft | 1 Visual Studio 2026 | 2026-09-08 | 8.8 High |
| Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-77889 | 1 Microsoft | 8 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 5 more | 2026-09-08 | 7.5 High |
| Access of resource using incompatible type ('type confusion') in Windows DHCP Server allows an unauthorized attacker to deny service over a network. | ||||
| CVE-2026-69904 | 1 Microsoft | 1 Sharepoint Server | 2026-09-08 | 3.5 Low |
| Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-69758 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-09-08 | 7.8 High |
| Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-69562 | 1 Microsoft | 2 Sql Server 2017, Sql Server 2019 | 2026-09-08 | 6.5 Medium |
| Out-of-bounds read in SQL Server allows an unauthorized attacker to disclose information over a network. | ||||
| CVE-2026-69559 | 1 Microsoft | 1 Teams | 2026-09-08 | 5.8 Medium |
| Origin validation error in Microsoft Teams for Android allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-69522 | 1 Microsoft | 4 .net, .net Framework, Visual Studio 2022 and 1 more | 2026-09-08 | 8.8 High |
| Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-69501 | 1 Microsoft | 8 Windows 10 21h2, Windows 10 22h2, Windows 11 23h2 and 5 more | 2026-09-08 | 7 High |
| Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. | ||||