58.650 CVE tracked
798 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
16.478 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2008-6063 | MED 4.3 | microsoft word Microsoft Word 2007, when the "Save as PDF" add-on is enabled, places an absolute pathname in the Subject field during an "Email as PDF" operation, which allows remote attackers to obtain sensitive information such as the sender's account name and a Temporary | 10.3% | — |
| CVE-2004-1686 | MED 5.0 | microsoft ie Internet Explorer 6.0 in Windows XP SP2 allows remote attackers to bypass the Information Bar prompt for ActiveX and Javascript via an XHTML page that contains an Internet Explorer formatted comment between the DOCTYPE tag and the HTML tag, as demonstrated usi | 10.3% | — |
| CVE-2025-50165 | CRIT 9.8 | microsoft windows_11_24h2 Untrusted pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. | 10.3% | — |
| CVE-2014-0317 | MED 5.4 | microsoft windows_server_2003 The Security Account Manager Remote (SAMR) protocol implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows Server 2012 Gold and R2 does not properly determine the user-loc | 10.2% | — |
| CVE-1999-0412 | HIGH 7.5 | microsoft internet_information_server In IIS and other web servers, an attacker can attack commands as SYSTEM if the server is running as SYSTEM and loading an ISAPI extension. | 10.2% | — |
| CVE-2013-3186 | HIGH 7.6 | microsoft internet_explorer The Protected Mode feature in Microsoft Internet Explorer 7 through 10 on Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not properly implement the Integrity Access Level (aka IL) prote | 10.2% | — |
| CVE-2017-8518 | HIGH 7.5 | microsoft edge Microsoft Edge allows a remote code execution vulnerability due to the way it accesses objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". | 10.2% | — |
| CVE-2020-0711 | HIGH 7.5 | microsoft chakracore A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0673, CVE-2020-0674, CVE-2020-0710, CVE-2020-071 | 10.2% | — |
| CVE-2006-3649 | MED 5.1 | microsoft visual_basic Buffer overflow in Microsoft Visual Basic for Applications (VBA) SDK 6.0 through 6.4, as used by Microsoft Office 2000 SP3, Office XP SP3, Project 2000 SR1, Project 2002 SP1, Access 2000 Runtime SP3, Visio 2002 SP2, and Works Suite 2004 through 2006, allows us | 10.2% | — |
| CVE-2015-2417 | MED 5.0 | microsoft windows_2003_server OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to gain privileges via crafted input, a | 10.2% | — |
| CVE-2015-2416 | MED 5.0 | microsoft windows_2003_server OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to gain privileges via crafted input, a | 10.2% | — |
| CVE-1999-0875 | HIGH 7.5 | microsoft windows_2000 DHCP clients with ICMP Router Discovery Protocol (IRDP) enabled allow remote attackers to modify their default routes. | 10.2% | — |
| CVE-1999-0802 | HIGH 7.6 | microsoft internet_explorer Buffer overflow in Internet Explorer 5 allows remote attackers to execute commands via a malformed Favorites icon. | 10.2% | — |
| CVE-2016-3212 | MED 6.1 | microsoft internet_explorer The XSS Filter in Microsoft Internet Explorer 9 through 11 does not properly identify JavaScript, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site, aka "Internet Explorer XSS Filter Vulnerability." | 10.2% | — |
| CVE-2024-49116 | HIGH 8.1 | microsoft windows_server_2016 Windows Remote Desktop Services Remote Code Execution Vulnerability | 10.2% | — |
| CVE-1999-0562 | HIGH 7.5 | microsoft windows_2000 The registry in Windows NT can be accessed remotely by users who are not administrators. | 10.1% | — |
| CVE-2017-8660 | HIGH 8.8 | microsoft edge Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to the way that Microsoft browser JavaScript engines render content when handling objects in m | 10.1% | — |
| CVE-2020-0713 | HIGH 7.5 | microsoft chakracore A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0673, CVE-2020-0674, CVE-2020-0710, CVE-2020-071 | 10.1% | — |
| CVE-2020-0712 | HIGH 7.5 | microsoft chakracore A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0673, CVE-2020-0674, CVE-2020-0710, CVE-2020-071 | 10.1% | — |
| CVE-2020-0710 | HIGH 7.5 | microsoft chakracore A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0673, CVE-2020-0674, CVE-2020-0711, CVE-2020-071 | 10.1% | — |
| CVE-2014-1809 | MED 6.8 | microsoft office The MSCOMCTL library in Microsoft Office 2007 SP3, 2010 SP1 and SP2, and 2013 Gold, SP1, RT, and RT SP1 makes it easier for remote attackers to bypass the ASLR protection mechanism via a crafted web site, as exploited in the wild in May 2014, aka "MSCOMCTL ASL | 10.1% | — |
| CVE-2019-1308 | HIGH 7.5 | microsoft chakracore A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1307, CVE-2019-1335, CVE-20 | 10.1% | — |
| CVE-2019-1307 | HIGH 7.5 | microsoft chakracore A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-1308, CVE-2019-1335, CVE-20 | 10.1% | — |
| CVE-2020-0872 | CRIT 9.6 | microsoft application_inspector A remote code execution vulnerability exists in Application Inspector version v1.0.23 or earlier when the tool reflects example code snippets from third-party source files into its HTML output, aka 'Remote Code Execution Vulnerability in Application Inspector' | 10.1% | — |
| CVE-2012-6502 | LOW 2.6 | microsoft internet_explorer Microsoft Internet Explorer before 10 allows remote attackers to obtain sensitive information about the existence of files, and read certain data from files, via a UNC share pathname in the SRC attribute of a SCRIPT element, as demonstrated by reading a name-v | 10.1% | — |