Vulnerabilities
All
My stack
Known exploited
Public exploit
Critical (9+)
Likely exploited (EPSS ≥ 50%)
Changed, 24 h
New, 24 h
Sort:
risk
modified
published
CVSS
EPSS
| CVE | CVSS | EPSS | Vendor, product | Description | Modified |
|---|---|---|---|---|---|
| CVE-2026-65815 | 8.8 high | 2.0% | microsoft, dynamics_365 | Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network. | Sat 24 Oct |
| CVE-2026-33821 | 9.9 critical | 1.0% | microsoft, dynamics_365_customer_insights | Improper privilege management in Microsoft Dynamics 365 Customer Insights allows an authorized attacker to elevate privileges over a network. | Mon 26 Oct |
| CVE-2026-42898 | 9.9 critical | 1.0% | microsoft, dynamics_365 | Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network. | Mon 26 Oct |
| CVE-2026-47647 | 9.9 critical | 1.0% | microsoft, dynamics_365 | Improper access control in Microsoft Dynamics 365 allows an authorized attacker to elevate privileges over a network. | Mon 26 Oct |
| CVE-2026-42833 | 9.1 critical | 1.0% | microsoft, dynamics_365 | Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network. | Mon 26 Oct |
| CVE-2025-62210 | 8.7 high | 1.0% | microsoft, dynamics_365 | Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network. | 18 Oct |
| CVE-2025-62211 | 8.7 high | 1.0% | microsoft, dynamics_365 | Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network. | 18 Oct |
| CVE-2026-32210 | 7.5 high | 1.0% | microsoft, dynamics_365 | Server-side request forgery (ssrf) in Microsoft Dynamics 365 (Online) allows an unauthorized attacker to perform spoofing over a network. | Mon 26 Oct |
| CVE-2026-40375 | 6.5 medium | 1.0% | microsoft, dynamics_365_business_central_2024, dynamics_365_business_central_2025, dynamics_365_business_central_2026 | Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network. | 7 h ago |
| CVE-2026-66301 | 6.5 medium | 1.0% | microsoft, dynamics_365 | Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a network. | Sat 24 Oct |
| CVE-2025-62206 | 6.5 medium | 1.0% | microsoft, dynamics_365 | Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information over a network. | 18 Oct |
| CVE-2026-40417 | 7.8 high | 0.00% | microsoft, dynamics_365_business_central | Weak authentication in Dynamics Business Central allows an authorized attacker to elevate privileges locally. | Mon 26 Oct |
| CVE-2026-114123 | 7.5 high | 0.00% | no CPE yet | D365 F&O MCP Server is a Model Context Protocol server for querying Dynamics 365 Finance & Operations X++ code and metadata. Prior to version 1.11.0, the officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and infrastructure/main.bicep to default the apiKey parameter to an empty string and pass it to the App Service API_KEY setting. With API_KEY unset or empty, src/middleware/apiKeyAuth.ts passes requests through without authentication, while src/index.ts binds the HTTP listener to 0.0.0.0 by default. If the deployer leaves the optional key blank and does not add separate network restrictions or upstream authentication, the resulting public App Service allows unauthenticated JSON-RPC tools/call requests to /mcp. The deployment's MCP_SERVER_MODE=read-only setting does not prevent anonymous access to read/search tools, including search, get_object_info, batch_get_info, extension_info, security_info, find_references, and find_event_handlers, exposing indexed proprietary X++ source snippets and metadata. Exposed information can include business logic, extension and event-handler wiring, security-role and privilege structure, and labels originally indexed from PackagesLocalDirectory. Deployments protected by a configured API key, effective upstream authentication, or network restrictions preventing attacker access are outside this unauthenticated exposure scenario. This issue is fixed in version 1.11.0. | Thu 22 Oct |
| CVE-2025-10746 | 6.5 medium | 0.00% | no CPE yet | The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.9. This is due to missing capability checks and nonce verification on functions hooked to 'init'. This makes it possible for unauthenticated attackers to deactivate the plugin, tamper with OAuth configuration, and trigger test connections that expose sensitive data via direct request to vulnerable endpoints granted they can craft malicious requests with specific parameters. | 11 Oct |
| CVE-2026-47646 | 6.1 medium | 0.00% | microsoft, dynamics_365_customer_voice | Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Customer Voice allows an unauthorized attacker to perform spoofing over a network. | Sun 25 Oct |
15 of 15
Download these 15 as CSV · subscribe to this list.
EPSS scores: 2026-10-28. NVD cursor: 2026-10-29 00:22. The News page shows only notable CVEs (KEV, your stack, new criticals, EPSS over 50%, or active exploitation per SSVC); this table has all of them.