3C
Product
365 Copilot
54
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 9High 38Medium 7Low 0
Watch
Add 365 Copilot to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-85885 | 8.8 | Sep 17 | Microsoft 365 Copilot Elevation of Privilege Vulnerability Affected: All versions, or not specified |
| CVE-2026-47645 | 8.8 | Jun 19 | Microsoft 365 Copilot's Business Chat Elevation of Privilege Vulnerability Affected: All versions, or not specified |
| CVE-2026-45463 | 8.4 | Jun 9 | Microsoft Office Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2026-45461 | 8.4 | Jun 9 | Microsoft Office Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2026-45474 | 8.4 | Jun 9 | Microsoft Office Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2026-45472 | 8.4 | Jun 9 | Microsoft Office Remote Code Execution Vulnerability Affected: All versions, or not specified |
| CVE-2026-40363 | 8.4 | May 12 | Microsoft Office Remote Code Execution Vulnerability Affected: before 16.0.19822.20190 |
| CVE-2025-49697 | 8.4 | Jul 8 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally Affected: All versions, or not specified |
| CVE-2025-49696 | 8.4 | Jul 8 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally Affected: All versions, or not specified |
| CVE-2025-49695 | 8.4 | Jul 8 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally Affected: All versions, or not specified |
| CVE-2025-47953 | 8.4 | Jun 10 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally Affected: All versions, or not specified |
| CVE-2025-47167 | 8.4 | Jun 10 | Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally Affected: before 16.0.18925.20000 |
| CVE-2025-47164 | 8.4 | Jun 10 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally Affected: All versions, or not specified |
| CVE-2025-47162 | 8.4 | Jun 10 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally Affected: All versions, or not specified |
| CVE-2026-50387 | 7.8 | Jul 14 | Windows GDI Elevation of Privilege Vulnerability Affected: All versions, or not specified |
| CVE-2026-42831 | 7.8 | May 12 | Microsoft Office Remote Code Execution Vulnerability Affected: before 16.0.19822.20190 |
| CVE-2026-26110 | 7.8 | Mar 10 | Microsoft Office Remote Code Execution Vulnerability Affected: before 16.0.19822.20000 |
| CVE-2026-26134 | 7.8 | Mar 10 | Microsoft Office Elevation of Privilege Vulnerability Affected: before 16.0.19822.20000 |
| CVE-2025-62557 | 7.8 | Dec 9 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally Affected: All versions, or not specified |
| CVE-2025-62554 | 7.8 | Dec 9 | Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally Affected: All versions, or not specified |
| CVE-2025-62199 | 7.8 | Nov 11 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally Affected: before 16.0.19426.20044 |
| CVE-2025-59234 | 7.8 | Oct 14 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally Affected: before 16.0.19328.20000 |
| CVE-2025-59227 | 7.8 | Oct 14 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally Affected: before 16.0.19328.20000 |
| CVE-2025-53732 | 7.8 | Aug 12 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally Affected: before 16.0.19127.20000 |
| CVE-2025-49702 | 7.8 | Jul 8 | Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally Affected: All versions, or not specified |
| CVE-2025-30388 | 7.8 | May 13 | Heap-based buffer overflow in Windows Win32K - GRFX allows an unauthorized attacker to execute code locally Affected: before 16.0.18827.20000 |
| CVE-2025-30386 | 7.8 | May 13 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally Affected: before 16.0.18827.20000 |
| CVE-2024-38250 | 7.8 | Sep 10 | Windows Graphics Component Elevation of Privilege Vulnerability Affected: All versions, or not specified |
| CVE-2026-85887 | 7.7 | Sep 17 | M365 Copilot Information Disclosure Vulnerability Affected: All versions, or not specified |
| CVE-2026-42895 | 7.5 | Jun 19 | Microsoft Copilot Tampering Vulnerability Affected: All versions, or not specified |
| CVE-2026-54130 | 7.5 | Jun 18 | M365 Copilot Information Disclosure Vulnerability Affected: All versions, or not specified |
| CVE-2026-42827 | 7.5 | May 22 | M365 Copilot Information Disclosure Vulnerability Affected: All versions, or not specified |
| CVE-2026-24307 | 7.5 | Jan 22 | M365 Copilot Information Disclosure Vulnerability Affected: All versions, or not specified |
| CVE-2025-32711 | 7.5 | Jun 11 | Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network Affected: All versions, or not specified |
| CVE-2025-26687 | 7.5 | Apr 8 | Use after free in Windows Win32K - GRFX allows an unauthorized attacker to elevate privileges over a network Affected: before 16.0.18730.20000 |
| CVE-2026-26133 | 7.1 | Mar 13 | M365 Copilot Information Disclosure Vulnerability Affected: before 2.107.2; before 16.0.19815.10000 |
| CVE-2026-24285 | 7.0 | Mar 10 | Win32k Elevation of Privilege Vulnerability Affected: before 16.0.19822.20000 |
| CVE-2023-36565 | 7.0 | Oct 10 | Microsoft Office Graphics Elevation of Privilege Vulnerability Affected: before 16.0.16827.20138 |
Showing 38