Product
4 published CVES affecting Microsoft Power Apps, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
Newest publication first
Improper restriction of xml external entity reference in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to disclose information over a network.
Uncontrolled search path element in Microsoft Power Apps allows an unauthorized attacker to execute code over a network.
Microsoft Power Apps (online) Spoofing Vulnerability
Microsoft Power Apps Spoofing Vulnerability
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.