Teams (Microsoft) - vulnerabilities (CVEs)

31 CVEs, 0 in the last 30 days, 53 known versions, newest CVE from 2026-09-08. Vendor: Microsoft.

CVEs of Teams

• CVE-2026-65812 - CVSS 6.8 (medium), 2026-09-08: Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.
• CVE-2026-69559 - CVSS 6.3 (medium), 2026-09-08: Origin validation error in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.
• CVE-2026-65767 - CVSS 8.8 (high), 2026-08-11: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams for Android allows an authorized attacker to perform…
• CVE-2026-65769 - CVSS 7.5 (high), 2026-08-11: Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allows an unauthorized attacker to disclose information over a network.
• CVE-2026-65768 - CVSS 9.8 (critical), 2026-08-11: Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Teams for Android allows an unauthorized attacker to execute code…
• CVE-2026-65667 - CVSS 10 (critical), 2026-08-06: Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-62918 - CVSS 7.5 (high), 2026-08-06: Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network.
• CVE-2026-62896 - CVSS 9.6 (critical), 2026-08-06: Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network.
• CVE-2026-42835 - CVSS 8.1 (high), 2026-06-09: Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Teams for Android allows an authorized…
• CVE-2026-32185 - CVSS 5.5 (medium), 2026-05-12: Files or directories accessible to external parties in Microsoft Teams allows an unauthorized attacker to perform spoofing locally.
• CVE-2026-33823 - CVSS 9.6 (critical), 2026-05-07: Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network.
• CVE-2026-26133 - CVSS 7.1 (high), 2026-03-16: AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.
• CVE-2026-21535 - CVSS 8.2 (high), 2026-02-19: Improper access control in Microsoft Teams allows an unauthorized attacker to disclose information over a network.
• CVE-2025-53783 - CVSS 7.5 (high), 2025-08-12: Heap-based buffer overflow in Microsoft Teams allows an unauthorized attacker to execute code over a network.
• CVE-2025-49737 - CVSS 7 (high), 2025-07-08: Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Teams allows an authorized attacker to elevate…
• CVE-2025-49731 - CVSS 3.1 (low), 2025-07-08: Improper handling of insufficient permissions or privileges in Microsoft Teams allows an authorized attacker to elevate privileges over a network.
• CVE-2024-42004 - CVSS 9.8 (critical), 2024-12-18: A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. A specially crafted library can leverage Teams's…
• CVE-2024-41138 - CVSS 9.8 (critical), 2024-12-18: A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work or school) 24046.2813.2770.1094 for…
• CVE-2024-41145 - CVSS 9.8 (critical), 2024-12-18: A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. A specially crafted…
• CVE-2024-38197 - CVSS 6.5 (medium), 2024-08-13: Microsoft Teams for iOS Spoofing Vulnerability
• CVE-2024-21448 - CVSS 5 (medium), 2024-03-12: Microsoft Teams for Android Information Disclosure Vulnerability
• CVE-2024-21374 - CVSS 5 (medium), 2024-02-13: Microsoft Teams for Android Information Disclosure Vulnerability
• CVE-2023-4863 - CVSS 8.8 (high), 2023-09-12: Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write…
• CVE-2023-29328 - CVSS 8.8 (high), 2023-08-08: Microsoft Teams Remote Code Execution Vulnerability
• CVE-2023-29330 - CVSS 8.8 (high), 2023-08-08: Microsoft Teams Remote Code Execution Vulnerability
• CVE-2023-24881 - CVSS 6.5 (medium), 2023-07-11: Microsoft Teams Information Disclosure Vulnerability
• CVE-2022-21965 - CVSS 7.5 (high), 2022-02-09: Microsoft Teams Denial of Service Vulnerability
• CVE-2021-24114 - CVSS 5.7 (medium), 2021-02-25: Microsoft Teams iOS Information Disclosure Vulnerability
• CVE-2020-10146 - CVSS 5.7 (medium), 2020-12-09: The Microsoft Teams online service contains a stored cross-site scripting vulnerability in the displayName parameter that can be exploited on Teams clients to…
• CVE-2020-17091 - CVSS 7.8 (high), 2020-11-11: Microsoft Teams Remote Code Execution Vulnerability
• CVE-2019-5922 - CVSS 7.8 (high), 2019-03-12: Untrusted search path vulnerability in The installer of Microsoft Teams allows an attacker to gain privileges via a Trojan horse DLL in an unspecified…