Product
7 published CVES affecting Microsoft Defender for Endpoint for Linux, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
Newest publication first
Improper control of generation of code ('code injection') in Microsoft Defender for Linux allows an unauthorized attacker to execute code over an adjacent network.
Time-of-check time-of-use (toctou) race condition in Microsoft Defender for Linux allows an authorized attacker to deny service locally.
Improper access control in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
External control of file name or path in Microsoft Defender for Endpoint allows an authorized attacker to elevate privileges locally.
Relative path traversal in Microsoft Defender for Endpoint allows an authorized attacker to perform spoofing locally.
Microsoft Defender for Endpoint Tampering Vulnerability
Microsoft Defender for Endpoint Spoofing Vulnerability
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.