58.650 CVE tracked
799 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
16.478 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2025-29972 | CRIT 9.9 | microsoft azure_storage_resource_provider Server-side request forgery (ssrf) in Azure Storage Resource Provider allows an authorized attacker to perform spoofing over a network. | 3.5% | — |
| CVE-2017-0256 | MED 5.3 | microsoft asp.net_model_view_controller A spoofing vulnerability exists when the ASP.NET Core fails to properly sanitize web requests. | 3.5% | — |
| CVE-2021-27058 | HIGH 7.8 | microsoft 365_apps Microsoft Office ClickToRun Remote Code Execution Vulnerability | 3.5% | — |
| CVE-2018-8247 | MED 5.4 | microsoft office_online_server An elevation of privilege vulnerability exists when Office Web Apps Server 2013 and Office Online Server fail to properly handle web requests, aka "Microsoft Office Elevation of Privilege Vulnerability." This affects Microsoft Office, Microsoft Office Online S | 3.5% | — |
| CVE-2023-21552 | HIGH 7.8 | microsoft windows_10_1607 Windows GDI Elevation of Privilege Vulnerability | 3.5% | — |
| CVE-2019-0813 | CRIT 9.8 | microsoft windows_admin_center An elevation of privilege vulnerability exists when Windows Admin Center improperly impersonates operations in certain situations, aka 'Windows Admin Center Elevation of Privilege Vulnerability'. | 3.5% | — |
| CVE-2019-0959 | HIGH 7.0 | microsoft windows_10 An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory. An attacker who successfully exploited this vulnerability could run processes in an elevated context. To exploit the vuln | 3.5% | — |
| CVE-2022-39327 | HIGH 8.1 | microsoft azure_command-line_interface Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI contains a vulnerability for potential code injection. Critical scenarios are where a hosting machine runs an Azure CLI command where parameter values have b | 3.5% | — |
| CVE-2015-2512 | HIGH 7.2 | microsoft windows_10 The Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 allows local users to gain privileges via a craft | 3.5% | — |
| CVE-2026-50509 | HIGH 7.8 | microsoft windows_10_1607 Deserialization of untrusted data in Windows Wireless Wide Area Network Service allows an authorized attacker to elevate privileges locally. | 3.5% | — |
| CVE-2022-21904 | HIGH 7.5 | microsoft windows_10 Windows GDI Information Disclosure Vulnerability | 3.5% | — |
| CVE-2023-24892 | HIGH 8.2 | microsoft edge_chromium Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability | 3.5% | — |
| CVE-2019-1318 | MED 5.9 | microsoft windows_10 A spoofing vulnerability exists when Transport Layer Security (TLS) accesses non- Extended Master Secret (EMS) sessions, aka 'Microsoft Windows Transport Layer Security Spoofing Vulnerability'. | 3.5% | — |
| CVE-2019-0985 | HIGH 7.8 | microsoft windows_7 A remote code execution vulnerability exists when the Microsoft Speech API (SAPI) improperly handles text-to-speech (TTS) input. The vulnerability could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current us | 3.5% | — |
| CVE-2022-26824 | HIGH 7.2 | microsoft windows_server_2016 Windows DNS Server Remote Code Execution Vulnerability | 3.5% | — |
| CVE-2022-26823 | HIGH 7.2 | microsoft windows_server_2016 Windows DNS Server Remote Code Execution Vulnerability | 3.5% | — |
| CVE-2009-3275 | MED 5.0 | microsoft enterprise_library Blocks/Common/Src/Configuration/Manageability/Adm/AdmContentBuilder.cs in Microsoft patterns & practices Enterprise Library (aka EntLib) allows context-dependent attackers to cause a denial of service (CPU consumption) via an input string composed of many \ (b | 3.5% | — |
| CVE-2025-21181 | HIGH 7.5 | microsoft windows_10_1507 Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability | 3.5% | — |
| CVE-2022-26924 | HIGH 7.5 | microsoft yet_another_reverse_proxy YARP Denial of Service Vulnerability | 3.5% | — |
| CVE-2018-8153 | MED 5.4 | microsoft exchange_server A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Spoofing Vulnerability." This affects Microsoft Exchange Server. | 3.5% | — |
| CVE-1999-1084 | MED 4.6 | microsoft windows_nt The "AEDebug" registry key is installed with insecure permissions, which allows local users to modify the key to specify a Trojan Horse debugger which is automatically executed on a system crash. | 3.5% | — |
| CVE-2021-1694 | HIGH 7.5 | microsoft windows_10 Windows Update Stack Elevation of Privilege Vulnerability | 3.5% | — |
| CVE-2021-36933 | HIGH 7.5 | microsoft windows_10 Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability | 3.5% | — |
| CVE-2021-36932 | HIGH 7.5 | microsoft windows_10 Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability | 3.5% | — |
| CVE-2021-36926 | HIGH 7.5 | microsoft windows_10 Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability | 3.5% | — |