| CVE / ID | Title | Severity | CVSS | Source | Date |
|---|
| GHSA-r253-r9jw-qg44 | Crawl4AI: Unauthenticated RCE via Chromium launch-argument injection in browser_config.extra_args | CRITICAL | 10.0 | GitHub | 2026-06-18 |
| GHSA-82fg-2r99-h7v6 | Duplicate Advisory: PickleScan's pkgutil.resolve_name has a universal blocklist bypass | CRITICAL | 10.0 | GitHub | 2026-06-17 |
| CVE-2026-45480 | Azure Active Directory Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-06-09 |
| CVE-2026-48567 | Azure HorizonDB Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-06-09 |
| CVE-2026-40175 | Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain | CRITICAL | 10.0 | Microsoft | 2026-04-14 |
| CVE-2017-20230 | Storable versions before 3.05 for Perl has a stack overflow | CRITICAL | 10.0 | Microsoft | 2026-04-14 |
| CVE-2026-33819 | Microsoft Bing Remote Code Execution Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-04-14 |
| CVE-2026-32186 | Microsoft Bing Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-04-14 |
| CVE-2026-33107 | Azure Databricks Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-04-14 |
| CVE-2026-35431 | Microsoft Entra ID Entitlement Management Spoofing Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-04-14 |
| CVE-2026-32213 | Azure AI Foundry Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-04-14 |
| CVE-2026-33105 | Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-04-14 |
| CVE-2026-42960 | Possible cache poisoning via promiscuous records for the authority section | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-46595 | Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-39821 | Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-40412 | Azure Orbital Spatio Remote Code Execution Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-23652 | Microsoft Power Pages Remote Code Execution Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-47280 | Azure Resource Manager Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-42822 | Azure Local Disconnected Operations (ALDO) Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-42826 | Azure DevOps Information Disclosure Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-41104 | Microsoft Planetary Computer Pro Information Disclosure Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2026-42901 | Microsoft Entra ID Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-05-12 |
| CVE-2025-55241 | Azure Entra ID Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2025-09-09 |
| CVE-2025-54914 | Azure Networking Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2025-09-09 |
| CVE-2022-49043 | xmlXIncludeAddNode in xinclude.c in libxml2 before 2.11.0 has a use-after-free. | CRITICAL | 10.0 | Microsoft | 2025-01-14 |
| CVE-2026-32169 | Azure Cloud Shell Elevation of Privilege Vulnerability | CRITICAL | 10.0 | Microsoft | 2026-03-10 |
| GHSA-vmmj-pfw7-fjwp | npm PraisonAI codeMode sandbox escape via Function constructor | CRITICAL | 9.9 | GitHub | 2026-06-18 |
| CVE-2026-47647 | Dynamics 365 Elevation of Privilege Vulnerability | CRITICAL | 9.9 | Microsoft | 2026-06-09 |
| CVE-2026-48584 | Microsoft Azure Synapse Elevation of Privilege Vulnerability | CRITICAL | 9.9 | Microsoft | 2026-06-09 |
| CVE-2026-21515 | Azure IoT Central Elevation of Privilege Vulnerability | CRITICAL | 9.9 | Microsoft | 2026-04-14 |
| CVE-2026-7374 | Kubevirt: kubevirt virt-handler: privilege escalation and node compromise via symlink following vulnerability | CRITICAL | 9.9 | Microsoft | 2026-05-12 |
| CVE-2026-33109 | Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability | CRITICAL | 9.9 | Microsoft | 2026-05-12 |
| CVE-2026-40411 | Azure Virtual Network Gateway Remote Code Execution Vulnerability | CRITICAL | 9.9 | Microsoft | 2026-05-12 |
| CVE-2026-42898 | Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability | CRITICAL | 9.9 | Microsoft | 2026-05-12 |
| CVE-2026-42823 | Azure Logic Apps Elevation of Privilege Vulnerability | CRITICAL | 9.9 | Microsoft | 2026-05-12 |
| CVE-2026-24304 | Azure Resource Manager Elevation of Privilege Vulnerability | CRITICAL | 9.9 | Microsoft | 2026-01-13 |
| CVE-2024-41110 | Moby authz zero length regression | CRITICAL | 9.9 | Microsoft | 2024-07-09 |
| CVE-2025-21415 | Azure AI Face Service Elevation of Privilege Vulnerability | CRITICAL | 9.9 | Microsoft | 2025-01-14 |
| CVE-2026-26030 | GitHub: CVE-2026-26030 Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable | CRITICAL | 9.9 | Microsoft | 2026-03-10 |
| CVE-2026-49980 | Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026 | CRITICAL | 9.8 | GitHub | 2026-06-16 |