Microsoft Security Center Center News

This CVE was assigned by Chrome.  Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2025) for more information.

This CVE was assigned by Chrome.  Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see [Google Chrome Releases](https://chromereleases.googleblog.com/2025) for more information.

Heap-based buffer overflow in Windows LUAFV allows an authorized attacker to elevate privileges locally.

Untrusted search path in Windows Narrator Braille allows an authorized attacker to elevate privileges locally.

Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Teams for Android allows an unauthorized attacker to execute code over a network.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Improper authentication in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

Relative path traversal in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

Incorrect authorization in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network.

Allocation of resources without limits or throttling in Windows Kernel allows an unauthorized attacker to deny service over a network.

Heap-based buffer overflow in Windows Imaging Component allows an unauthorized attacker to execute code locally.

Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an unauthorized attacker to execute code over a network.

Server-side request forgery (ssrf) in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.

Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.