Veille CVE

Recherche « Microsoft Copilot »

47 CVE

Critique 8 Élevée 30 Moyenne 8 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Microsoft Copilot » ✕
  1. CVE-2026-85887 7.7 Élevée

    Microsoft 365 Copilot

    Incorrect permission assignment for critical resource in M365 Copilot allows an authorized attacker to disclose information over a network.

  2. CVE-2026-85885 8.8 Élevée

    Microsoft 365 Copilot

    Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an authorized attacker to elevate privileges over a network.

  3. CVE-2026-78501 8.6 Élevée

    Microsoft 365 Copilot's Business Chat · Microsoft 365 copilot chat

    Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.

  4. CVE-2026-55946 5.9 Moyenne

    Microsoft Copilot

    Ai command injection in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.

  5. CVE-2026-81381 7.5 Élevée

    Microsoft Visual Studio Code

    Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

  6. CVE-2026-81380 5.9 Moyenne

    Microsoft Visual Studio Code

    Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

  7. CVE-2026-80098 10.0 Critique

    Microsoft Copilot Studio

    Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.

  8. CVE-2026-58616 3.0 Faible

    Microsoft Edge (Chromium-based) · Microsoft Edge for Android · Microsoft Edge for iOS · Microsoft Edge for Linux

    Concurrent execution using shared resource with improper synchronization ('race condition') in Copilot Chat (Microsoft Edge) allows an authorized attacker to disclose information over a network.

  9. CVE-2026-69855 6.5 Moyenne

    Microsoft Copilot in Azure · Microsoft azure copilot

    Server-side request forgery (ssrf) in Microsoft Copilot in Azure allows an authorized attacker to disclose information over a network.

  10. CVE-2026-24301 7.5 Élevée

    Microsoft Copilot Web · Microsoft copilot

    Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.

  11. CVE-2026-70335 7.8 Élevée

    Microsoft Visual Studio Code

    Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to elevate privileges locally.

  12. CVE-2026-65675 6.5 Moyenne

    Microsoft Visual Studio Code CoPilot Chat Extension · Microsoft github copilot chat

    No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network.

  13. CVE-2026-59118 9.3 Critique

    Microsoft Copilot Cowork · Microsoft power apps

    Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network.

  14. CVE-2026-50517 9.9 Critique

    Microsoft 365 Copilot

    Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.

  15. CVE-2026-59864 9.3 Critique

    microsoft kiota

    Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, `kiota plugin add` and `kiota plugin generate` (with `-t APIPlugin`) emitted attacker-controlled static_template.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin manifests without path validation, allowing ../, absolute, rooted, UNC, Windows drive, or URI paths in response_semantics.static_template.file to cause path traversal or out-of-package file inclusion when the generated plugin was deployed. This issue is fixed in version 1.29.1 and 1.32.5.

  16. CVE-2026-58617 9.8 Critique

    Microsoft 365 Copilot for iOS · Microsoft 365 copilot

    Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network.

  17. CVE-2026-55145 7.1 Élevée

    Microsoft Copilot

    Improper neutralization of special elements used in a command ('command injection') in Outlook Copilot allows an authorized attacker to perform tampering over a network.

  18. CVE-2026-50510 7.8 Élevée

    Microsoft GitHub Copilot Plugin for JetBrains IDEs · Microsoft github copilot

    Improper restriction of names for files and other resources in Github Copilot allows an unauthorized attacker to execute code locally.

  19. CVE-2026-50387 7.8 Élevée

    Microsoft Office 365 for Mac · Microsoft Office for Android · Microsoft Office LTSC for Mac 2021 · Microsoft Office LTSC for Mac 2024

    Stack-based buffer overflow in Windows GDI allows an authorized attacker to elevate privileges locally.

  20. CVE-2026-48561 9.6 Critique

    Microsoft Edge Copilot for Android · Microsoft Edge Copilot for IOS · Microsoft 365 copilot

    Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to execute code over a network.

  21. CVE-2026-47282 6.5 Moyenne

    Microsoft Visual Studio Code

    Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

  22. CVE-2026-41106 9.3 Critique

    Microsoft 365 Copilot

    Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.

  23. CVE-2025-66389 7.5 Élevée

    Microsoft github copilot

    GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter to fetch_webpage. Therefore, exfiltration could occur if there is indirect prompt injection.

  24. CVE-2026-50519 7.5 Élevée

    Microsoft GitHub Copilot Chat

    Initialization of a resource with an insecure default in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.

  25. CVE-2026-47645 8.8 Élevée

    Microsoft 365 Copilot

    Url redirection to untrusted site ('open redirect') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to elevate privileges over a network.

  26. CVE-2026-42895 7.5 Élevée

    Microsoft 365 Copilot

    Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.

  27. CVE-2026-54130 7.5 Élevée

    Microsoft 365 Copilot

    Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network.

  28. CVE-2026-45482 8.4 Élevée

    Microsoft Visual Studio Code CoPilot Chat Extension · Microsoft visual studio code

    Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

  29. CVE-2026-45474 8.4 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

  30. CVE-2026-45472 8.4 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

  31. CVE-2026-45463 8.4 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Integer underflow (wrap or wraparound) in Microsoft Office allows an unauthorized attacker to execute code locally.

  32. CVE-2026-45461 8.4 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.

  33. CVE-2026-45460 4.7 Moyenne

    Microsoft 365 Apps for Enterprise · Microsoft Office 2019 · Microsoft Office 365 for Mac · Microsoft Office for Android

    Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose information locally.

  34. CVE-2026-47644 7.5 Élevée

    Microsoft Copilot Chat (Microsoft Edge) · Microsoft copilot chat

    Improper neutralization of special elements in output used by a downstream component ('injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over a network.

  35. CVE-2026-45497 8.8 Élevée

    Microsoft 365 Copilot · Microsoft copilot

    Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an authorized attacker to execute code over a network.

  36. CVE-2026-42824 7.5 Élevée

    Microsoft 365 Copilot · Microsoft copilot

    Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.

  37. CVE-2026-42827 7.5 Élevée

    Microsoft 365 Copilot

    Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.

  38. CVE-2026-41090 9.3 Critique

    Microsoft 365 Copilot for iOS · Microsoft 365 copilot

    Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.

  39. CVE-2026-42893 7.5 Élevée

    Microsoft Outlook for iOS · Microsoft outlook

    Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to perform tampering over a network.

  40. CVE-2026-42831 7.8 Élevée

    Microsoft Office for Android · Microsoft Office LTSC for Mac 2021 · Microsoft Office LTSC for Mac 2024 · Microsoft 365 copilot

    Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

  41. CVE-2026-41614 6.2 Moyenne

    Microsoft M365 Copilot for Desktop · Microsoft 365 copilot

    Improper access control in M365 Copilot for Desktop allows an unauthorized attacker to perform spoofing locally.

  42. CVE-2026-41109 8.8 Élevée

    Microsoft Visual Studio Code

    Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.

  43. CVE-2026-41100 4.4 Moyenne

    Microsoft 365 Copilot for Android · Microsoft Excel for Android · Microsoft Loop for Android · Microsoft OneNote for Android

    Improper access control in M365 Copilot allows an authorized attacker to perform spoofing locally.

  44. CVE-2026-40363 8.4 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office for Android

    Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

  45. CVE-2026-33111 7.5 Élevée

    Microsoft Copilot Chat (Microsoft Edge) · Microsoft copilot chat

    Improper neutralization of special elements used in a command ('command injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over a network.

  46. CVE-2026-26164 7.5 Élevée

    Microsoft 365 Copilot's Business Chat · Microsoft 365 copilot chat

    Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.

  47. CVE-2026-26129 7.5 Élevée

    Microsoft 365 Copilot's Business Chat · Microsoft 365 copilot chat

    Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.