Microsoft MSRC (CSAF)

advisoryUS

msrc_csaf

Microsoft Security Response Center machine-readable CSAF 2.0 security advisories (msrc_cve-*) via the directory changes.csv listing; IT-vendor PSIRT enriching NVD CVEs with Microsoft CVSS, severity and remediation. Published TLP:WHITE (unrestricted disclosure).

msrc.microsoft.com/
01

advisories (9,042)

Vendor and ecosystem advisories describing this.

showing 20 of 9,042
02

product assertions (1,300)

Products and version ranges known to be affected.

showing 20 of 1,300
03

CVE links (9,041)

Known CVEs related to this entry.

IDseverity exploitable
CVE-2026-97785UScritical10.0—
Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-96185UShigh7.5—
Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.
CVE-2026-83938UScritical10.0OT elevated—
Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-110063UScritical10.0—
Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-108456UShigh7.7—
Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.
CVE-2026-105014UScritical9.1—
Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.
CVE-2026-80092USmedium5.3—
Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network.
CVE-2026-109461USmedium5.9—
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
CVE-2026-109468UShigh7.5—
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
CVE-2026-108455USmedium6.5—
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
CVE-2026-108454USmedium6.5—
Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
CVE-2026-108453USmedium6.5—
Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network.
CVE-2026-108452UShigh8.8—
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
CVE-2026-108451UShigh8.8—
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108450UShigh8.8—
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108449UShigh8.8—
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108448UShigh7.5—
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVE-2026-108447UShigh8.8—
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108446UShigh8.8—
Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code over a network.
CVE-2026-108445UShigh8.8—
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
showing 20 of 9,041