CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-41106 — Url redirection to untrusted site ('open redirect') in M365 Copilot allows an un...

·Source: NIST NVD

Updated:

Executive Summary

Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network.

Analysis

Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network. CVSS Score: 9.3. Published: 2026-07-02T23:16:50.867.

Indicators of Compromise (1)

CVE (1)
CVE-2026-41106
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 2, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerabilityNEW

NVD CRITICAL: CVE-2026-9725 — The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress...

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 2.5.2 This is due to insufficient path validation in the store_design_data() function, which constructs a filesystem path from the user-supplied 'nbd_item_key' POST parameter sanitized only with sanitize_text_field() — which does not strip path

CVE-2026-9725
NIST NVD
MEDIUMVulnerability

Spyware found on phone of European Parliament member probing it

Stelios Kouloglou, formerly a member of the European Parliament's committee investigation abuses of commercial spyware, was twice infected with Pegasus while serving, researchers said.

The Record
MEDIUMVulnerability

Someone infected a spyware probe overseer with spyware

Citizen Lab says the phone of a member of Europe’s PEGA Committee was infected twice with Pegasus, the NSO Group spyware that gave the panel its name. The post Someone infected a spyware probe overseer with spyware appeared first on CyberScoop .

CyberScoop