Veille CVE

Recherche « Microsoft Graph »

87 CVE

Critique 10 Élevée 54 Moyenne 22 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Microsoft Graph » ✕
  1. CVE-2026-97799 7.8 Élevée

    Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2 · Microsoft Windows 11 version 26H1 · Microsoft Windows 11 Version 26H2

    Improper verification of cryptographic signature in Windows Audio Service allows an authorized attacker to elevate privileges locally.

  2. CVE-2026-96960 7.5 Élevée

    Microsoft .NET Framework 3.5 · Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 · Microsoft .NET Framework 3.5 AND 4.7.2 · Microsoft .NET Framework 3.5 AND 4.8

    Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a network.

  3. CVE-2026-96959 7.5 Élevée

    Microsoft .NET Framework 3.5 · Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 · Microsoft .NET Framework 3.5 AND 4.7.2 · Microsoft .NET Framework 3.5 AND 4.8

    Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.

  4. CVE-2026-96958 7.5 Élevée

    Microsoft .NET Framework 3.5 · Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 · Microsoft .NET Framework 3.5 AND 4.7.2 · Microsoft .NET Framework 3.5 AND 4.8

    Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

  5. CVE-2026-96957 8.8 Élevée

    Microsoft .NET 10.0 runtime · Microsoft .NET 11.0 runtime · Microsoft Visual Studio 2022 version 17.14 · Microsoft Visual Studio 2026 version 18.10

    Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

  6. CVE-2026-96252 9.1 Critique

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows Server 2012 · Microsoft Windows Server 2012 (Server Core installation)

    Improper verification of cryptographic signature in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

  7. CVE-2026-96222 7.4 Élevée

    Microsoft .NET Framework 3.5 · Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 · Microsoft .NET Framework 3.5 AND 4.7.2 · Microsoft .NET Framework 3.5 AND 4.8

    Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.

  8. CVE-2026-96118 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

  9. CVE-2026-88110 7.0 Élevée

    Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2 · Microsoft Windows 11 Version 26H2 · Microsoft Windows Server 2025

    Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

  10. CVE-2026-88073 7.8 Élevée

    Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 Version 23H2 · Microsoft Windows 11 Version 24H2

    Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

  11. CVE-2026-87696 7.5 Élevée

    Microsoft Exchange Server 2016 Cumulative Update 23 · Microsoft Exchange Server 2019 Cumulative Update 14 · Microsoft Exchange Server 2019 Cumulative Update 15 · Microsoft Exchange Server Subscription Edition RTM

    Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

  12. CVE-2026-85881 8.0 Élevée

    Microsoft Office for Android

    Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network.

  13. CVE-2026-85818 9.0 Critique

    Microsoft Windows 11 Version 23H2 · Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2 · Microsoft Windows 11 version 26H1

    Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.

  14. CVE-2026-85338 7.8 Élevée

    Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 Version 23H2

    Out-of-bounds read in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

  15. CVE-2026-84008 7.5 Élevée

    Microsoft .NET Framework 3.5 · Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 · Microsoft .NET Framework 3.5 AND 4.7.2 · Microsoft .NET Framework 3.5 AND 4.8

    Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

  16. CVE-2026-83798 5.5 Moyenne

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Improper verification of cryptographic signature in Windows Update Stack allows an authorized attacker to perform spoofing locally.

  17. CVE-2026-83582 4.7 Moyenne

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Use after free in Windows Graphics Kernel allows an authorized attacker to disclose information locally.

  18. CVE-2026-70162 5.9 Moyenne

    Microsoft Visual Studio 2022 version 17.14 · Microsoft Visual Studio 2026 version 18.10 · Microsoft System.Security.Cryptography.Pkcs

    A denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application. The update addresses the vulnerability by correcting how the .NET web application handles web requests.

  19. CVE-2026-70123 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Numeric truncation error in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

  20. CVE-2026-70071 5.5 Moyenne

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows Server 2012 · Microsoft Windows Server 2012 (Server Core installation)

    Improper verification of cryptographic signature in DNS Server allows an authorized attacker to perform tampering locally.

  21. CVE-2026-70055 5.5 Moyenne

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Exposure of sensitive system information to an unauthorized control sphere in Windows Cryptographic Services allows an authorized attacker to disclose information locally.

  22. CVE-2026-70014 7.5 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Use after free in Windows Cryptographic Services allows an authorized attacker to execute code over a network.

  23. CVE-2026-69919 5.5 Moyenne

    Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2 · Microsoft Windows 11 version 26H1 · Microsoft Windows 11 Version 26H2

    Out-of-bounds read in Windows Cryptographic Services allows an authorized attacker to disclose information locally.

  24. CVE-2026-69650 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2

    Improper verification of cryptographic signature in Windows Key Distribution Center allows an authorized attacker to elevate privileges locally.

  25. CVE-2026-69326 8.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.

  26. CVE-2026-59116 6.8 Moyenne

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Use of a broken or risky cryptographic algorithm in Windows Remote Desktop allows an unauthorized attacker to bypass a security feature over a network.

  27. CVE-2026-105731 5.5 Moyenne

    Microsoft Office for Android

    Use of uninitialized resource in Microsoft Graphics Component allows an authorized attacker to disclose information locally.

  28. CVE-2026-102866 8.1 Élevée

    Microsoft SharePoint Server Subscription Edition · Microsoft sharepoint server

    Improper verification of cryptographic signature in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.

  29. CVE-2026-102209 7.0 Élevée

    Microsoft Windows 11 version 26H1 · Microsoft windows 11 26h1

    Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

  30. CVE-2026-102194 7.0 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

  31. CVE-2026-100215 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.

  32. CVE-2026-104040 6.1 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 8

    A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol (OData) queries. A low-privileged local user can exploit this flaw by submitting a crafted search request, altering query filters to broaden user or group searches. This can lead to information disclosure by retrieving unintended directory objects, as well as a Denial of Service (DoS) through excessive processing and cache population.

  33. CVE-2026-105763 9.6 Critique

    twentyhq twenty

    Twenty is an open-source CRM (customer relationship management) platform. From 1.20.10 until 2.7.0, the /metadata GraphQL connectedAccounts query returned connectionParameters from ConnectedAccountDTO for every connected account in a workspace, including plaintext IMAP, SMTP, and CalDAV passwords, because the field was not hidden and the lookup did not enforce the calling user's identity or account visibility. A normal workspace member could obtain other members' external-service credentials and use them to access mail or calendars and potentially reset third-party accounts. Google and Microsoft OAuth-only workspaces were not affected. This issue is fixed in version 2.7.0.

  34. CVE-2026-63208 5.1 Moyenne

    zammad

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when a Microsoft Graph request fails, Zammad logs the error including the authentication token used to access the mailbox. The system attempts to hide this token in the log, but the masking is incomplete: for the token format Microsoft uses (JWT), only the first part is hidden, while the remaining parts remain readable in plain text. A Zammad admin with Microsoft Graph channel access can view these logs and see the partial token, which may reveal sensitive claims such as the account scope, tenant, or timing, and could assist in reconstructing the full token while it is still valid. This issue is fixed in version 7.1.2.

  35. CVE-2026-63205 5.1 Moyenne

    zammad

    Zammad is a web based open source helpdesk/customer support system. Prior to 7.1.2, when creating or updating an email signature, Zammad processes inline images referenced in the signature body. If a signature body contains an HTML img tag pointing to any existing attachment, the system copies that attachment into a new signature-owned record, without checking whether the user has permission to access the original attachment. The newly created copy is then downloadable by the same channel-admin user, because attachment access is determined by the copy's owner (the signature), not the original object (e.g., a ticket or knowledge-base article). This allows a user with any of the admin.channel_email, admin.channel_google, admin.channel_microsoft365, or admin.channel_microsoft_graph permissions to read attachments they would otherwise be denied access to, such as ticket attachments belonging to groups they are not a member of. This issue is fixed in version 7.1.2.

  36. CVE-2026-58201 8.7 Élevée

    merill lokka

    Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the management.azure.com base URL. A specially crafted path can alter URL authority parsing and cause an Azure Resource Manager bearer token to be sent to an unintended host. This issue is fixed in version 2.1.2.

  37. CVE-2026-10556 5.3 Moyenne

    Mattermost · Mattermost mattermost server

    Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate null entries in Microsoft Graph webhook notification payloads, which allows an unauthenticated attacker to crash the Microsoft Calendar plugin process and deny calendar integration service to all users on the instance via a crafted {{POST}} request to the public webhook endpoint.. Mattermost Advisory ID: MMSA-2026-00693

  38. CVE-2026-69646 8.3 Élevée

    Microsoft Skype for Business Server 2015 CU13 · Microsoft Skype for Business Server 2019 CU8 · Microsoft Skype for Business Server Subscription Edition CU1 · Microsoft skype for business server

    Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network.

  39. CVE-2026-84000 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to execute code locally.

  40. CVE-2026-83990 7.8 Élevée

    Microsoft Windows 11 Version 23H2 · Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2 · Microsoft Windows 11 version 26H1

    Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

  41. CVE-2026-81955 8.8 Élevée

    Microsoft 365 Apps for Enterprise · Microsoft Office 2016 · Microsoft Office 2019 · Microsoft Office 365 for Mac

    Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.

  42. CVE-2026-78439 8.8 Élevée

    Microsoft Office 365 for Mac · Microsoft Office for Android · Microsoft Office LTSC for Mac 2021 · Microsoft Office LTSC for Mac 2024

    Stack-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.

  43. CVE-2026-77493 9.8 Critique

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Double free in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.

  44. CVE-2026-73018 8.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.

  45. CVE-2026-73017 7.5 Élevée

    Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 Version 23H2

    Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to execute code locally.

  46. CVE-2026-73016 8.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.

  47. CVE-2026-73006 8.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Stack-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.

  48. CVE-2026-72986 8.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.

  49. CVE-2026-72923 7.5 Élevée

    microsoft OpenAPI.NET

    The OpenAPI.NET SDK contains a useful object model for OpenAPI documents in .NET along with common serializers to extract raw OpenAPI JSON and YAML documents from the model. In Microsoft.OpenApi.Readers versions before 1.6.30 and Microsoft.OpenApi.YamlReader from 2.0.0-preview.11 through 2.11.0 and 3.0.0 through 3.9.0, parsing a YAML OpenAPI document with nested anchors and aliases can consume uncontrolled memory. SharpYaml represents aliases as shared nodes in a small directed acyclic graph, but conversion to independent OpenAPI or System.Text.Json.Nodes.JsonNode trees duplicates every aliased path; without a node-count or nesting-depth limit, N nested anchors referenced k times can require k^N materialized nodes and terminate the process through an out-of-memory condition. The fixed readers bound materialization to 5,000,000 nodes and a nesting depth of 64 by default and report an OpenApiDiagnostic error when a limit is exceeded. This vulnerability is fixed in Microsoft.OpenApi.Readers 1.6.30 and Microsoft.OpenApi.YamlReader 2.12.0 and 3.10.0.

  50. CVE-2026-69576 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Use after free in Graphic Fonts allows an authorized attacker to elevate privileges locally.

  51. CVE-2026-69467 7.8 Élevée

    Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 Version 23H2 · Microsoft Windows 11 Version 24H2

    Stack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

  52. CVE-2026-69382 5.9 Moyenne

    Microsoft Exchange Server 2016 Cumulative Update 23 · Microsoft Exchange Server 2019 Cumulative Update 14 · Microsoft Exchange Server 2019 Cumulative Update 15 · Microsoft Exchange Server Subscription Edition RTM

    Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.

  53. CVE-2026-57098 7.5 Élevée

    Microsoft Remote Desktop client for Windows Desktop · Microsoft remote desktop client

    Improper verification of cryptographic signature in Windows RDP Client allows an unauthorized attacker to disclose information over a network.

  54. CVE-2026-80098 10.0 Critique

    Microsoft Copilot Studio

    Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.

  55. CVE-2026-62834 9.8 Critique

    Microsoft Azure Data Factory

    Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network.

  56. CVE-2026-62774 7.0 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

  57. CVE-2026-62757 5.9 Moyenne

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Improper verification of cryptographic signature in Windows Schannel allows an unauthorized attacker to bypass a security feature over a network.

  58. CVE-2026-62702 8.6 Élevée

    Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 Version 23H2 · Microsoft Windows 11 Version 24H2

    Null pointer dereference in Windows Graphics Kernel allows an unauthorized attacker to deny service over a network.

  59. CVE-2026-61346 7.0 Élevée

    Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 Version 23H2

    Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

  60. CVE-2026-62918 7.5 Élevée

    Microsoft Teams

    Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network.

  61. CVE-2026-62873 9.8 Critique

    Microsoft 365 Admin Center · Microsoft windows admin center

    Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network.

  62. CVE-2026-49159 6.5 Moyenne

    Microsoft Graph

    Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network.

  63. CVE-2026-47304 9.8 Critique

    Microsoft .NET 10.0 · Microsoft .NET 8.0 · Microsoft .NET 9.0 · Microsoft .NET Framework 3.5

    Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

  64. CVE-2026-58638 5.5 Moyenne

    Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 Version 24H2

    Missing cryptographic step in Windows Boot Loader allows an authorized attacker to bypass a security feature locally.

  65. CVE-2026-50681 5.5 Moyenne

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Exposure of sensitive information to an unauthorized actor in Windows Cryptographic Services allows an authorized attacker to disclose information locally.

  66. CVE-2026-50493 7.8 Élevée

    Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 Version 24H2

    Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.

  67. CVE-2026-50483 5.5 Moyenne

    Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2 · Microsoft Windows 11 version 26H1 · Microsoft Windows Server 2025

    Exposure of sensitive information to an unauthorized actor in Microsoft Graphics Component allows an authorized attacker to disclose information locally.

  68. CVE-2026-50352 5.5 Moyenne

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Exposure of sensitive information to an unauthorized actor in Windows Cryptographic Services allows an authorized attacker to disclose information locally.

  69. CVE-2026-50302 6.5 Moyenne

    Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2

    Improper certificate validation in Windows Cryptographic Services allows an unauthorized attacker to bypass a security feature over a network.

  70. CVE-2026-58609 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.

  71. CVE-2026-55144 7.1 Élevée

    Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2 · Microsoft Windows 11 version 26H1 · Microsoft Windows Server 2022

    Missing cryptographic step in Windows CryptoAPI allows an authorized attacker to perform tampering locally.

  72. CVE-2026-50303 5.5 Moyenne

    Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2 · Microsoft Windows 11 Version 24H2

    Use of a cryptographic primitive with a risky implementation in Windows Key Guard allows an authorized attacker to bypass a security feature locally.

  73. CVE-2026-50296 7.0 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Use after free in Graphics Kernel allows an authorized attacker to elevate privileges locally.

  74. CVE-2026-44806 7.5 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Missing release of memory after effective lifetime in Windows Cryptographic Services allows an unauthorized attacker to deny service over a network.

  75. CVE-2026-54893 2.1 Faible

    swoosh

    URL path injection in the Microsoft Graph adapter of Swoosh. Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address into the URL path (/users/{from}/sendMail) without percent-encoding or validation. In applications that derive the from address from untrusted or user-influenced input (for example a relay, a contact form, or a "send as" feature), an attacker can place URL-special characters such as /, ?, or # in the local part of the address to escape the intended path segment and rewrite the path and query string of the request. Because the same authenticated POST is sent with the application's Microsoft Graph bearer token, the attacker can redirect it to other Graph endpoints within the token's scopes and control the request's query string. Applications that always use a fixed, trusted from address are not affected. This issue affects swoosh: from 1.12.0 before 1.26.3.

  76. CVE-2026-44810 7.8 Élevée

    Microsoft Windows 11 Version 23H2 · Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2 · Microsoft Windows 11 version 26H1

    Improper authentication in Windows Cryptographic Services allows an unauthorized attacker to elevate privileges locally.

  77. CVE-2026-42986 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

  78. CVE-2026-47655 6.5 Moyenne

    Microsoft Graph

    Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network.

  79. CVE-2026-40377 7.8 Élevée

    Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

    Heap-based buffer overflow in Windows Cryptographic Services allows an authorized attacker to elevate privileges locally.

  80. CVE-2026-33117 9.1 Critique

    Microsoft Azure SDK for Java

    The Java Key Vault Keys library in the Azure SDK for Java contains an issue in the local cryptographic verification path where authentication tag comparison was implemented incorrectly. In affected applications that use the vulnerable local cryptography path, specially crafted encrypted input may bypass integrity verification checks. Operations delegated to the Key Vault service are not affected. The issue is addressed in version 4.10.6.

  81. CVE-2026-41574 9.8 Critique

    nhost · Nhost nhost\/auth

    Nhost is an open source Firebase alternative with GraphQL. Prior to version 0.49.1, Nhost automatically links an incoming OAuth identity to an existing Nhost account when the email addresses match. This is only safe when the email has been verified by the OAuth provider. Nhost's controller trusts a profile.EmailVerified boolean that is set by each provider adapter. The vulnerability is that several provider adapters do not correctly populate this field they either silently drop a verified field the provider API actually returns (Discord), or they fall back to accepting unconfirmed emails and marking them as verified (Bitbucket). Two Microsoft providers (AzureAD, EntraID) derive the email from non-ownership-proving fields like the user principal name, then mark it verified. The result is that an attacker can present an email they don't own to Nhost, have the OAuth identity merged into the victim's account, and receive a full authenticated session. This issue has been patched in version 0.49.1.

  82. CVE-2023-21823 7.8 Élevée Exploitée

    Microsoft Office for Android · Microsoft Office for iOS · Microsoft Office for Universal · Microsoft Windows 10 Version 1507

    Windows Graphics Component Remote Code Execution Vulnerability

  83. CVE-2018-8405 7.8 Élevée Exploitée Rançongiciel

    Microsoft Windows Server 2012 R2 · Microsoft Windows RT 8.1 · Microsoft Windows Server 2016 · Microsoft Windows 8.1

    An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8400, CVE-2018-8401, CVE-2018-8406.

  84. CVE-2017-0005 7.8 Élevée Exploitée

    Microsoft Corporation Windows GDI · Microsoft windows 10 1507 · Microsoft windows 10 1511 · Microsoft windows 10 1607

    The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application, aka "Windows GDI Elevation of Privilege Vulnerability." This vulnerability is different from those described in CVE-2017-0001, CVE-2017-0025, and CVE-2017-0047.

  85. CVE-2017-0001 7.8 Élevée Exploitée

    Microsoft Corporation Windows GDI · Microsoft windows 10 1507 · Microsoft windows 10 1511 · Microsoft windows 10 1607

    The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privileges via a crafted application, aka "Windows GDI Elevation of Privilege Vulnerability." This vulnerability is different from those described in CVE-2017-0005, CVE-2017-0025, and CVE-2017-0047.

  86. CVE-2016-3393 7.8 Élevée Exploitée

    Microsoft windows 10 1507 · Microsoft windows 10 1511 · Microsoft windows 10 1607 · Microsoft windows 7

    Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows remote attackers to execute arbitrary code via a crafted web site, aka "Windows Graphics Component RCE Vulnerability."

  87. CVE-2013-3906 7.8 Élevée Exploitée

    Microsoft excel viewer · Microsoft lync · Microsoft office · Microsoft office compatibility pack

    GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010, 2010 Attendee, 2013, and Basic 2013 allows remote attackers to execute arbitrary code via a crafted TIFF image, as demonstrated by an image in a Word document, and exploited in the wild in October and November 2013.