Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.00 CVE-2026-58285 Microsoft US
Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.00 CVE-2026-58284 Microsoft US
Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
EPSS 0.00 CVE-2026-58278 Microsoft US
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.00 CVE-2026-58276 Microsoft US
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.00 CVE-2026-57986 Microsoft US
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-57981 Microsoft US
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
EPSS 0.00 CVE-2026-57977 Microsoft US
Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-57974 Microsoft US
User interface (ui) misrepresentation of critical information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
EPSS 0.00 CVE-2026-45488 Microsoft US
Relative path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.
EPSS 0.00 CVE-2026-58522 Microsoft US
Time-of-check time-of-use (toctou) race condition in Microsoft Edge for Android allows an unauthorized attacker to execute code over a network.
EPSS 0.00 CVE-2026-58299 Microsoft US
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.00 CVE-2026-58287 Microsoft US
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
EPSS 0.00 CVE-2026-58283 Microsoft US
Improper access control in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
EPSS 0.00 CVE-2026-58282 Microsoft US
Exposure of sensitive information to an unauthorized actor in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-56646 Microsoft US
Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-57993 Microsoft US
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-57992 Microsoft US
Relative path traversal in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-57988 Microsoft US
Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-57987 Microsoft US
Improper input validation in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.00 CVE-2026-57985 Microsoft US
Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.00 CVE-2026-57984 Microsoft US
Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network.
EPSS 0.00 CVE-2026-57983 Microsoft US
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.00 CVE-2026-57975 Microsoft US
Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
EPSS 0.01 CVE-2026-56645 Microsoft US
Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an authorized attacker to disclose information locally.
EPSS 0.00 CVE-2026-55945 Microsoft US
Information published.
EPSS 0.00 CVE-2026-45489 Microsoft US
Incorrect authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-54998 Microsoft US
Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-41106 Microsoft US
Improper access control in Azure Synapse allows an authorized attacker to elevate privileges over a network.
EPSS 0.00 CVE-2026-26145 Microsoft US
Server-side request forgery (ssrf) in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-57100 Microsoft US
Break-glass credential revocation is live on GitHub Enterprise. The Trivy and Microsoft durabletask repeats show why fast, complete revocation was needed.. Category: News
Huntress is seeing an ongoing password spray attack against Microsoft Azure CLI that originates from an IPv6 address range controlled by LSHIY LLC.
Microsoft US
Most Microsoft 365 environments are missing more than half of the recommended security controls, even with tooling in place. Here's why that happens and what Huntress Managed ISPM does about it.
Microsoft US
Cybercriminals are hijacking Microsoft 365 accounts in seconds. Learn the 2026 hacker tactics, including ConsentFix, that bypass security training and exploit normal user behavior.
Microsoft US
Added Edge software to the Security Updates table. Customers that are running supported version of Edge are encouraged to update to the indicated version to be protected from this vulnerability.
EPSS 0.00 CVE-2026-50521 Microsoft US
Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-47645 Microsoft US
Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-48582 Microsoft US
Execution with unnecessary privileges in Azure Synapse allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-48584 Microsoft US
Improper access control in Microsoft Dynamics 365 allows an authorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-47647 Microsoft US
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.
EPSS 0.00 CVE-2026-42895 Microsoft US
Exposure of sensitive information to an unauthorized actor in Cost Management Interactive Experiences allows an unauthorized attacker to disclose information over a network.
EPSS 0.01 CVE-2026-47633 Microsoft US
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an authorized attacker to perform spoofing over a network.
EPSS 0.01 CVE-2026-32208 Microsoft US
Huntress Managed ISPM finds and closes Microsoft 365 identity gaps before attackers do. Learn why visibility isn't enough and what real identity hardening takes.
Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "RoguePlanet ". We are working to provide a high quality security update that addresses this vulnerability. We will provide information in this CVE when the update is available.
EPSS 0.11 CVE-2026-50656 Microsoft US
A phishing kit subverting Microsoft’s legitimate authentication flow lets attackers break into accounts without stealing passwords or creating fake login pages
Microsoft SK
Use after free in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.
EPSS 0.00 CVSS 7.8 CVE-2026-32153 Microsoft US
Updated the build numbers. This is an informational update only.
EPSS 0.01 CVE-2024-38225 Microsoft US
Updated the build numbers. This is an informational update only.
EPSS 0.01 CVE-2024-35248 Microsoft US
Updated the build numbers. This is an informational update only.
EPSS 0.02 CVE-2024-21380 Microsoft US
Updated the build numbers. This is an informational update only.
Updated the build numbers. This is an informational update only.
EPSS 0.01 CVE-2021-40440 Microsoft US
Updated the build numbers. This is an informational update only.
EPSS 0.01 CVE-2021-36946 Microsoft US
Updated the build numbers. This is an informational update only.
EPSS 0.02 CVE-2021-34474 Microsoft US