Microsoft

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Biometric Service allows an unauthorized attacker to bypass a security feature with a physical attack.

Improper authentication in Windows Active Directory allows an unauthorized attacker to perform spoofing locally.

Buffer over-read in Windows Kernel Memory allows an authorized attacker to disclose information locally.

Divide by zero in Microsoft Graphics Component allows an unauthorized attacker to deny service locally.

Null pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to deny service locally.

Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an unauthorized attacker to disclose information locally.

Out-of-bounds read in Capability Access Management Service (camsvc) allows an unauthorized attacker to disclose information locally.

Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows an unauthorized attacker to disclose information locally.

Insertion of sensitive information into log file in Windows Kernel allows an unauthorized attacker to disclose information locally.

Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via a victim’s web browser and send unauthorized requests to a locally running MCP server, resulting…

Insertion of sensitive information into log file in Active Directory Federation Services allows an unauthorized attacker to disclose information locally.

Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

Missing Ability to Patch ROM Code in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

Cleartext storage of sensitive information in Windows Kernel allows an unauthorized attacker to bypass a security feature locally.

Incomplete comparison with missing factors in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

Exposure of sensitive information to an unauthorized actor in Windows Imaging Component allows an unauthorized attacker to disclose information locally.

Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network.

Uncontrolled resource consumption in Windows Deployment Services allows an unauthorized attacker to deny service locally.

Improper input validation in Windows Hyper-V allows an unauthorized attacker to deny service locally.

External control of file name or path in Azure Portal Windows Admin Center allows an unauthorized attacker to disclose information locally.

Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability

Windows Recovery Environment Agent Elevation of Privilege Vulnerability

Windows Package Library Manager Information Disclosure Vulnerability

Microsoft Edge for Android Spoofing Vulnerability

Microsoft Edge (Chromium-based) Spoofing Vulnerability

Microsoft Intune for Android Mobile Application Management Tampering Vulnerability

Windows Hyper-V Denial of Service Vulnerability

Azure Arc-enabled Kubernetes Extension Cluster-Scope Elevation of Privilege Vulnerability

BitLocker Security Feature Bypass Vulnerability

The Microsoft Clarity plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.3. This is due to missing nonce validation on the edit_clarity_project_id() function. This makes it possible for unauthenticated attackers to change…

Windows Server Key Distribution Service Security Feature Bypass

ASP.NET Core Security Feature Bypass Vulnerability

Microsoft SharePoint Server Remote Code Execution Vulnerability

Visual Studio Denial of Service Vulnerability

Microsoft Dynamics 365 Sales Spoofing Vulnerability

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

Microsoft Edge (Chromium-based) Spoofing Vulnerability

ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability

Microsoft DirectMusic Information Disclosure Vulnerability

Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

Microsoft Defender Security Feature Bypass Vulnerability

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

Microsoft Dynamics 365 Customer Voice Cross-Site Scripting Vulnerability

Windows Boot Manager Security Feature Bypass Vulnerability