| CVE-2025-62821 | NGHIÊM TRỌNG9.1 | Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry_GetDataSize can return success while leaving the reported data size as 0. This causes a caller to make a 1-byte allocation. Later, CopyPixels computes copy_size = stride * abs(roi_height) but does not check the source buffer l | 19/06/2026 |
| CVE-2026-50512 | CAO7.8 | Missing authentication for critical function in Microsoft PC Manager allows an authorized attacker to elevate privileges locally. | 09/06/2026 |
| CVE-2026-50511 | CAO7.8 | Improper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally. | 09/06/2026 |
| CVE-2026-49161 | CAO7.8 | Improper access control in Microsoft PC Manager allows an authorized attacker to bypass a security feature locally. | 09/06/2026 |
| CVE-2026-48569 | TRUNG BÌNH5.5 | Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | 09/06/2026 |
| CVE-2026-48562 | TRUNG BÌNH4.6 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 09/06/2026 |
| CVE-2026-48560 | TRUNG BÌNH5.4 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 09/06/2026 |
| CVE-2026-47643 | NGHIÊM TRỌNG9.8 | External control of file name or path in Azure Stack Edge allows an unauthorized attacker to execute code over a network. | 09/06/2026 |
| CVE-2026-47641 | TRUNG BÌNH5.4 | Improper input validation in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 09/06/2026 |
| CVE-2026-47640 | TRUNG BÌNH5.4 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 09/06/2026 |
| CVE-2026-47639 | TRUNG BÌNH5.4 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | 09/06/2026 |
| CVE-2026-47638 | TRUNG BÌNH5.4 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 09/06/2026 |
| CVE-2026-47637 | TRUNG BÌNH5.4 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 09/06/2026 |
| CVE-2026-47636 | TRUNG BÌNH5.4 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | 09/06/2026 |
| CVE-2026-47634 | TRUNG BÌNH5.4 | Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network. | 09/06/2026 |
| CVE-2026-47631 | TRUNG BÌNH5.4 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. | 09/06/2026 |
| CVE-2026-47298 | CAO8.0 | Improper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 09/06/2026 |
| CVE-2026-47293 | CAO7.0 | Use after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally. | 09/06/2026 |
| CVE-2026-47292 | CAO7.8 | Inclusion of functionality from untrusted control sphere in Visual Studio Code allows an unauthorized attacker to elevate privileges locally. | 09/06/2026 |
| CVE-2026-47289 | CAO8.8 | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 09/06/2026 |