Vulnerabilidades de Microsoft
CVEs publicadas que afetam produtos de Microsoft: 5261 registro(s), com severidade, exploração e correções.
Windows Server 2025 3001Windows Server 2025 (Server Core installation) 2987Windows 11 Version 24H2 2873Windows 11 24h2 2856Windows 11 Version 25H2 2825Windows Server 2022 2820Windows 11 25h2 2808Windows Server 2019 2708Windows Server 2019 (Server Core installation) 2657Windows 10 1809 2624Windows 10 Version 1809 2590Windows 10 Version 21H2 2567Windows 11 version 26H1 2555Windows 10 21h2 2551Windows 10 Version 22H2 2550Windows 10 22h2 2537Windows 11 26h1 2516Windows 11 version 23H2 2383Windows 11 23h2 2364Windows Server 2016 2297Windows Server 2016 (Server Core installation) 2233Windows 10 1607 2214Windows 10 Version 1607 2171Windows Server 2012 1885Windows Server 2012 R2 1807Windows Server 2012 R2 (Server Core installation) 1798Windows Server 2012 (Server Core installation) 1693Windows 11 Version 26H2 1007Windows 11 26h2 980Microsoft 365 Apps for Enterprise 576365 Apps 575Microsoft Office LTSC 2024 554Microsoft Office LTSC 2021 551Windows Server 2022 23h2 544Windows Server 2022, 23H2 Edition (Server Core installation) 543Office 2021 465Office 2024 465Microsoft Office LTSC for Mac 2021 459Microsoft Office LTSC for Mac 2024 459Microsoft Office 2019 386
CVE-2026-32186
Crítica · 9.8
CWE-918 03/04/2026
Microsoft Bing: falha de server-side request forgery com elevação de privilégios
Server-side request forgery (ssrf) no Microsoft Bing permite que um atacante não autorizado eleve privilégios pela rede.
CVE-2026-33107
Crítica · 9.8
CWE-918 02/04/2026
Escalonamento de privilégios por SSRF no Azure Databricks
Server-side request forgery (ssrf) no Azure Databricks permite que um atacante não autorizado eleve privilégios pela rede.
CVE-2026-33105
Crítica · 9.8
CWE-863 02/04/2026
Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-32213
Crítica · 9.8
CWE-863 02/04/2026
Microsoft Azure AI Foundry: escalonamento de privilégios por autorização imprópria
Autorização imprópria no Azure AI Foundry permite que um atacante não autorizado eleve privilégios pela rede.
CVE-2026-32211
Alta · 7.5
CWE-306 02/04/2026
Azure MCP Server Information Disclosure Vulnerability
Missing authentication for critical function in Azure MCP Server allows an unauthorized attacker to disclose information over a network.
CVE-2026-32173
Alta · 7.5
CWE-863 02/04/2026
Azure SRE Agent Information Disclosure Vulnerability
Improper authentication in Azure SRE Agent allows an unauthorized attacker to disclose information over a network.
CVE-2026-26135
Alta · 8.8
CWE-918 02/04/2026
Azure Custom Locations Resource Provider (RP) Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure Custom Locations Resource Provider (RP) allows an authorized attacker to elevate privileges over a network.
CVE-2026-34401
Média · 6.5
CWE-611 31/03/2026
XML Notepad: XML External Entity (XXE) Injection via Unsafe XmlTextReader in XML Diff and Schema Loading
XML Notepad is a Windows program that provides a simple intuitive User Interface for browsing and editing XML documents. Prior to version 2.9.0.21, XML Notepad does not disable DTD processing by default which means external entities are resolved automatically. There is a well known attack related to malicious DTD files where an attacker to craft a malicious XML file that loads a DTD that causes XML Notepad to make outbound HTTP/SMB requests, potentially leaking local file contents or capturing the victim's NTLM credentials. This issue has been patched in version 2.9.0.21.
CVE-2026-34054
Alta · 7.8
CWE-427 31/03/2026
openssl on Windows built with openssldir set from the build machine (Uncontrolled Search Path Element)
vcpkg is a free and open-source C/C++ package manager. Prior to version 3.6.1#3, vcpkg's Windows builds of OpenSSL set openssldir to a path on the build machine, making that path be attackable later on customer machines. This issue has been patched in version 3.6.1#3.
CVE-2026-32194
Crítica · 9.8
CWE-77 19/03/2026
Injeção de comando no Microsoft Bing Images (CVE-2026-32194)
Neutralização imprópria de elementos especiais usados em um comando ('injeção de comando') no Microsoft Bing Images permite que um atacante não autorizado execute código pela rede.
CVE-2026-32191
Crítica · 9.8
CWE-78 19/03/2026
Injeção de Comando de SO no Microsoft Bing Images
Neutralização imprópria de elementos especiais usados em um comando do sistema operacional ('injeção de comando do sistema operacional') no Microsoft Bing Images permite que um atacante não autorizado execute código pela rede.
CVE-2026-32169
Crítica · 9.8
CWE-918 19/03/2026
Elevação de privilégio por SSRF no Azure Cloud Shell da Microsoft
Server-side request forgery (SSRF) no Azure Cloud Shell permite que um atacante não autorizado eleve privilégios pela rede.
CVE-2026-26139
Alta · 8.6
CWE-918 19/03/2026
Microsoft Purview Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-26138
Crítica · 10.0
CWE-918 19/03/2026
Vulnerabilidade de SSRF com Elevação de Privilégio no Microsoft Purview
Server-side request forgery (ssrf) no Microsoft Purview permite que um atacante não autorizado eleve privilégios pela rede.
CVE-2026-26137
Crítica · 9.9
CWE-918 19/03/2026
Falsificação de Requisição do Lado do Servidor (SSRF) no Microsoft Exchange
Server-side request forgery (ssrf) no Microsoft Exchange permite que um atacante autorizado eleve privilégios pela rede.
CVE-2026-26136
Alta · 7.5
CWE-77 19/03/2026
Microsoft Copilot Information Disclosure Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.
CVE-2026-26120
Alta · 7.5
CWE-918 19/03/2026
Microsoft Bing Tampering Vulnerability
Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to perform tampering over a network.
CVE-2026-24299
Média · 5.3
CWE-77 19/03/2026
M365 Copilot Information Disclosure Vulnerability
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.
CVE-2026-23659
Alta · 7.5
CWE-200 19/03/2026
Azure Data Factory Information Disclosure Vulnerability
Exposure of sensitive information to an unauthorized actor in Azure Data Factory allows an unauthorized attacker to disclose information over a network.
CVE-2026-23658
Crítica · 9.8
CWE-522 19/03/2026
Azure DevOps: msazure Elevation of Privilege Vulnerability
Insufficiently protected credentials in Azure DevOps allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-25667
Alta · 7.5
CWE-400 19/03/2026
Uncontrolled Resource Consumption em Microsoft .net
ASP.NET Core Kestrel in Microsoft .NET 8.0 before 8.0.22 and .NET 9.0 before 9.0.11 allows a remote attacker to cause excessive CPU consumption by sending a crafted QUIC packet, because of an incorrect exit condition for HTTP/3 Encoder/Decoder stream processing.
CVE-2026-26133
Alta · 7.1
CWE-77 16/03/2026
M365 Copilot Information Disclosure Vulnerability
AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
CVE-2026-0385
Média · 5.0
CWE-451 16/03/2026
Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability
CVE-2026-26123
Média · 5.5
CWE-939 10/03/2026
Microsoft Authenticator Information Disclosure Vulnerability
Cwe is not in rca categories in Microsoft Authenticator allows an unauthorized attacker to disclose information locally.
CVE-2026-26148
Alta · 8.1
CWE-454 10/03/2026
Microsoft Azure AD SSH Login extension for Linux Elevation of Privilege Vulnerability
External initialization of trusted variables or data stores in Azure Entra ID allows an unauthorized attacker to elevate privileges locally.