| CVE-2025-47989 | CAO7.0 | Improper access control in Azure Connected Machine Agent allows an authorized attacker to elevate privileges locally. | 14/10/2025 |
| CVE-2025-25004 | CAO7.3 | Improper access control in Microsoft PowerShell allows an authorized attacker to elevate privileges locally. | 14/10/2025 |
| CVE-2025-59251 | CAO7.6 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 24/09/2025 |
| CVE-2025-55322 | CAO7.3 | Binding to an unrestricted ip address in GitHub allows an unauthorized attacker to execute code over a network. | 24/09/2025 |
| CVE-2025-49728 | TRUNG BÌNH4.0 | Cleartext storage of sensitive information in Microsoft PC Manager allows an unauthorized attacker to bypass a security feature locally. | 16/09/2025 |
| CVE-2025-47967 | TRUNG BÌNH4.7 | Insufficient ui warning of dangerous operations in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network. | 16/09/2025 |
| CVE-2025-55319 | NGHIÊM TRỌNG9.8 | Ai command injection in Agentic AI and Visual Studio Code allows an unauthorized attacker to execute code over a network. | 12/09/2025 |
| CVE-2025-55317 | CAO7.8 | Improper link resolution before file access ('link following') in Microsoft AutoUpdate (MAU) allows an authorized attacker to elevate privileges locally. | 09/09/2025 |
| CVE-2025-55316 | CAO7.8 | External control of file name or path in Azure Arc allows an authorized attacker to elevate privileges locally. | 09/09/2025 |
| CVE-2025-55245 | CAO7.8 | Improper link resolution before file access ('link following') in Xbox allows an authorized attacker to elevate privileges locally. | 09/09/2025 |
| CVE-2025-55243 | CAO7.5 | Exposure of sensitive information to an unauthorized actor in Microsoft Office Plus allows an unauthorized attacker to perform spoofing over a network. | 09/09/2025 |
| CVE-2025-55232 | NGHIÊM TRỌNG9.8 | Deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC) allows an unauthorized attacker to execute code over a network. | 09/09/2025 |
| CVE-2025-55227 | CAO8.8 | Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an authorized attacker to elevate privileges over a network. | 09/09/2025 |
| CVE-2025-54910 | CAO8.4 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. | 09/09/2025 |
| CVE-2025-54908 | CAO7.8 | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. | 09/09/2025 |
| CVE-2025-54907 | CAO7.8 | Heap-based buffer overflow in Microsoft Office Visio allows an unauthorized attacker to execute code locally. | 09/09/2025 |
| CVE-2025-54906 | CAO7.8 | Free of memory not on the heap in Microsoft Office allows an unauthorized attacker to execute code locally. | 09/09/2025 |
| CVE-2025-54905 | CAO7.1 | Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | 09/09/2025 |
| CVE-2025-54904 | CAO7.8 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 09/09/2025 |
| CVE-2025-54903 | CAO7.8 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 09/09/2025 |