Product
4 published CVES affecting Microsoft power platform, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
Newest publication first
Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network.
Missing authorization in Power Platform allows an unauthenticated attacker to view sensitive information through a network attack vector.
An authenticated attacker can exploit an untrusted search path vulnerability in Microsoft Dataverse to execute code over a network.
Microsoft Power Platform Connector Spoofing Vulnerability
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.