58.689 CVE tracked
799 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
16.478 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2025-53773 | HIGH 7.8 | microsoft visual_studio_2022 Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally. | 3.2% | — |
| CVE-2026-25187 | HIGH 7.8 | microsoft windows_10_1607 Improper link resolution before file access ('link following') in Winlogon allows an authorized attacker to elevate privileges locally. | 3.2% | — |
| CVE-1999-0899 | HIGH 7.2 | microsoft windows_nt The Windows NT 4.0 print spooler allows a local user to execute arbitrary commands due to inappropriate permissions that allow the user to specify an alternate print provider. | 3.2% | — |
| CVE-2015-6100 | MED 6.9 | microsoft windows_10 The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted app | 3.2% | — |
| CVE-2015-2524 | HIGH 7.2 | microsoft windows_10 Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 do not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Windows Task Management Eleva | 3.2% | — |
| CVE-2024-49062 | MED 6.5 | microsoft sharepoint_server Microsoft SharePoint Information Disclosure Vulnerability | 3.2% | — |
| CVE-2021-1710 | HIGH 7.8 | microsoft windows_10 Microsoft Windows Media Foundation Remote Code Execution Vulnerability | 3.2% | — |
| CVE-2022-30174 | HIGH 7.8 | microsoft 365_apps Microsoft Office Remote Code Execution Vulnerability | 3.2% | — |
| CVE-2016-3218 | HIGH 7.8 | microsoft windows_10 The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to gain privileges via a crafted application | 3.2% | — |
| CVE-2020-1093 | HIGH 7.5 | microsoft internet_explorer A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who s | 3.2% | — |
| CVE-2020-1064 | HIGH 7.5 | microsoft internet_explorer A remote code execution vulnerability exists in the way that the MSHTML engine improperly validates input. An attacker could execute arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacke | 3.2% | — |
| CVE-2020-1035 | HIGH 7.5 | microsoft internet_explorer A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who s | 3.2% | — |
| CVE-2005-3169 | MED 5.0 | microsoft windows_2000 Microsoft Windows 2000 before Update Rollup 1 for SP4, when the "audit directory service access" policy is enabled, does not record a 565 event message for File Delete Child operations on an Active Directory object in the security event log, which could allow | 3.2% | — |
| CVE-2004-2091 | MED 5.0 | microsoft baseline_security_analyzer Microsoft Baseline Security Analyzer (MBSA) 1.2 does not correctly identify systems that have been patched but remain vulnerable to exploit until the system is rebooted, possibly giving the administrator a false sense of security. | 3.2% | — |
| CVE-2023-24871 | HIGH 8.8 | microsoft windows_10_20h2 Windows Bluetooth Service Remote Code Execution Vulnerability | 3.2% | — |
| CVE-2020-8927 | MED 5.3 | canonical ubuntu_linux A buffer overflow exists in the Brotli library versions prior to 1.0.8 where an attacker controlling the input length of a "one-shot" decompression request to a script can trigger a crash, which happens when copying over chunks of data larger than 2 GiB. It is | 3.2% | — |
| CVE-2012-2519 | HIGH 7.9 | microsoft .net_framework Untrusted search path vulnerability in Entity Framework in ADO.NET in Microsoft .NET Framework 1.0 SP3, 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, and 4 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a dire | 3.2% | — |
| CVE-2025-24076 | HIGH 7.3 | microsoft windows_11_22h2 Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally. | 3.2% | — |
| CVE-2021-36929 | MED 6.3 | microsoft edge_chromium Microsoft Edge (Chromium-based) Information Disclosure Vulnerability | 3.2% | — |
| CVE-1999-0861 | LOW 2.6 | microsoft commercial_internet_system Race condition in the SSL ISAPI filter in IIS and other servers may leak information in plaintext. | 3.2% | — |
| CVE-2018-0749 | HIGH 7.8 | microsoft windows_10 The Microsoft Server Message Block (SMB) Server in Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows an | 3.2% | — |
| CVE-2021-1674 | HIGH 8.8 | microsoft windows_10 Windows Remote Desktop Protocol Core Security Feature Bypass Vulnerability | 3.2% | — |
| CVE-2021-1673 | HIGH 8.8 | microsoft windows_10 Remote Procedure Call Runtime Remote Code Execution Vulnerability | 3.2% | — |
| CVE-2021-1671 | HIGH 8.8 | microsoft windows_10 Remote Procedure Call Runtime Remote Code Execution Vulnerability | 3.2% | — |
| CVE-2021-1669 | HIGH 8.8 | microsoft remote_desktop Windows Remote Desktop Security Feature Bypass Vulnerability | 3.2% | — |