Browse CVE records published in June 2026, with severity, affected products, CWE, KEV, and source-backed vulnerability context.
Showing 50 of 6776 matching CVEs · Page 10 of 136.
Out-of-bounds read in Windows Application Identity (AppID) Subsystem allows an authorized attacker to disclose information locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Exposure of sensitive information to an unauthorized actor in Windows Application Identity (AppID) Subsystem allows an authorized attacker to disclose information locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Use after free in Windows SDK allows an authorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Integer overflow or wraparound in Windows Internet (wininet.dll) allows an authorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Uncontrolled resource consumption in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Published Jun 9, 2026 · Updated Sep 24, 2026
Improper link resolution before file access ('link following') in Windows Collaborative Translation Framework allows an authorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Improper limitation of a pathname to a restricted directory ('path traversal') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Use after free in Linux MANA Driver allows an authorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Published Jun 9, 2026 · Updated Sep 24, 2026
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Published Jun 9, 2026 · Updated Sep 24, 2026
Integer underflow (wrap or wraparound) in Microsoft Office allows an unauthorized attacker to execute code locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Published Jun 9, 2026 · Updated Sep 24, 2026
Protection mechanism failure in Microsoft Office Excel allows an unauthorized attacker to bypass a security feature locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
Published Jun 9, 2026 · Updated Sep 24, 2026
Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.
Published Jun 9, 2026 · Updated Sep 24, 2026
Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.
Published Jun 9, 2026 · Updated Sep 24, 2026
Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.
Published Jun 9, 2026 · Updated Sep 24, 2026
Improper access control in Windows Administrator Protection allows an authorized attacker to bypass a security feature locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Buffer over-read in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Improper handling of insufficient permissions or privileges in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to elevate privileges over a network.
Published Jun 9, 2026 · Updated Sep 24, 2026
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Published Jun 9, 2026 · Updated Sep 24, 2026
Access of resource using incompatible type ('type confusion') in Windows Hyper-V allows an unauthorized attacker to execute code locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Out-of-bounds read in Windows Hyper-V allows an unauthorized attacker to execute code locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Out-of-bounds read in Microsoft UxTheme Library (uxtheme.dll) allows an authorized attacker to deny service locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Use after free in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
Published Jun 9, 2026 · Updated Sep 24, 2026
Missing authentication for critical function in M365 Copilot allows an unauthorized attacker to disclose information over a network.
Published Jun 18, 2026 · Updated Sep 24, 2026
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.
Published Jun 19, 2026 · Updated Sep 24, 2026
Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network.
Published Jun 19, 2026 · Updated Sep 24, 2026
Improper authentication in Azure Bot Service allows an authorized attacker to elevate privileges over a network.
Published Jun 18, 2026 · Updated Sep 24, 2026
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Entra ID allows an authorized attacker to perform spoofing over a network.
Published Jun 19, 2026 · Updated Sep 24, 2026
Exposure of sensitive information to an unauthorized actor in Cost Management Interactive Experiences allows an unauthorized attacker to disclose information over a network.
Published Jun 18, 2026 · Updated Sep 24, 2026
Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network.
Published Jun 4, 2026 · Updated Sep 24, 2026
Improper neutralization of special elements in output used by a downstream component ('injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over a network.
Published Jun 4, 2026 · Updated Sep 24, 2026
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Project Server allows an authorized attacker to perform spoofing over a network.
Published Jun 9, 2026 · Updated Sep 24, 2026
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Published Jun 9, 2026 · Updated Sep 24, 2026
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Integer underflow (wrap or wraparound) in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Published Jun 9, 2026 · Updated Sep 24, 2026
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
Published Jun 9, 2026 · Updated Sep 24, 2026
Heap-based buffer overflow in Microsoft Windows DNS allows an authorized attacker to elevate privileges locally.
Published Jun 9, 2026 · Updated Sep 24, 2026
A use-of-uninitialized memory vulnerability exists in libxls 1.6.3 when parsing malformed XLS files. The issue is reachable via xls_parseWorkBook() and is triggered by uninitialized heap memory originating from the OLE layer (ole2_read). The flaw is detectable with MemorySanitizer (MSAN) and can lead to undefined behavior, incorrect parsing logic, or potential information disclosure.
Published Jun 3, 2026 · Updated Sep 23, 2026
