Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-32192 | 7.8 high | 2.0% | microsoft, azure_monitor_agent | Deserialization of untrusted data in Azure Monitor Agent allows an authorized attacker to elevate privileges locally. | Mon 26 Oct |
| CVE-2025-62207 | 9.8 critical | 1.0% | microsoft, azure_monitor | Azure Monitor Elevation of Privilege Vulnerability | 18 Oct |
| CVE-2025-62550 | 8.8 high | 1.0% | microsoft, azure_monitor_agent | Out-of-bounds write in Azure Monitor Agent allows an authorized attacker to execute code over a network. | 14 Oct |
| CVE-2026-41105 | 8.1 high | 1.0% | microsoft, azure_monitor_action_group_notification_system | Server-side request forgery (ssrf) in Azure Notification Service allows an authorized attacker to elevate privileges over a network. | Mon 26 Oct |
| CVE-2025-59494 | 7.8 high | 1.0% | microsoft, azure_monitor_agent | Improper access control in Azure Monitor Agent allows an authorized attacker to elevate privileges locally. | 8 Oct |
| CVE-2026-47299 | 7.2 high | 1.0% | microsoft, azure_monitor_agent | Improper neutralization of special elements used in a command ('command injection') in Azure Monitor Agent allows an authorized attacker to elevate privileges over a network. | Fri 23 Oct |
| CVE-2025-59285 | 7.0 high | 1.0% | microsoft, azure_monitor_agent | Deserialization of untrusted data in Azure Monitor Agent allows an authorized attacker to elevate privileges locally. | 8 Oct |
| CVE-2025-55321 | 9.3 critical | 0.00% | microsoft, azure_monitor | Improper neutralization of input during web page generation ('cross-site scripting') in Azure Monitor allows an unauthorized attacker to perform spoofing over a network. | 8 Oct |
| CVE-2026-32168 | 7.8 high | 0.00% | microsoft, azure_monitor_agent | Improper input validation in Azure Monitor Agent allows an authorized attacker to elevate privileges locally. | Mon 26 Oct |
| CVE-2026-32204 | 7.8 high | 0.00% | microsoft, azure_monitor_agent | External control of file name or path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally. | Mon 26 Oct |
| CVE-2026-88967 | 7.7 high | — | no CPE yet | A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an attacker-controlled endpoint that disclose the data source's Azure access token (server-side request forgery). | 22 h ago |
| CVE-2025-59504 | 7.3 high | 0.00% | microsoft, azure_monitor_agent | Heap-based buffer overflow in Azure Monitor Agent allows an unauthorized attacker to execute code locally. | 18 Oct |
| CVE-2026-42830 | 6.5 medium | 0.00% | microsoft, azure_monitor_agent | Untrusted search path in Azure Monitor Agent allows an authorized attacker to elevate privileges locally. | Mon 26 Oct |
| CVE-2026-93294 | 6.3 medium | 0.00% | no CPE yet | A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity. | 16 Oct |
14 of 14
Download these 14 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.