Microsoft Power Platform — known CVE vulnerabilities

Every CVE whose affected-product data names Microsoft Power Platform, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (3)

• CVE-2023-36019 — CVSS 9.6 (critical): Microsoft Power Platform Connector Spoofing Vulnerability
• CVE-2024-38190 — CVSS 8.6 (high): Missing authorization in Power Platform allows an unauthenticated attacker to view sensitive information through a network attack vector.
• CVE-2024-35260 — CVSS 8.0 (high): An authenticated attacker can exploit an untrusted search path vulnerability in Microsoft Dataverse to execute code over a network.