58.848 CVE tracked
799 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
16.630 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2026-20816 | HIGH 7.8 | microsoft windows_10_1607 Time-of-check time-of-use (toctou) race condition in Windows Installer allows an authorized attacker to elevate privileges locally. | 2.5% | — |
| CVE-2021-34489 | HIGH 7.8 | microsoft windows_10 DirectWrite Remote Code Execution Vulnerability | 2.5% | — |
| CVE-2021-28449 | HIGH 7.8 | microsoft 365_apps Microsoft Office Remote Code Execution Vulnerability | 2.5% | — |
| CVE-2018-8323 | MED 5.4 | microsoft sharepoint_enterprise_server An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft | 2.5% | — |
| CVE-2018-8299 | MED 5.4 | microsoft sharepoint_enterprise_server An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft | 2.5% | — |
| CVE-2021-42276 | HIGH 7.8 | microsoft windows_10 Microsoft Windows Media Foundation Remote Code Execution Vulnerability | 2.5% | — |
| CVE-2021-34492 | HIGH 8.1 | microsoft windows_10 Windows Certificate Spoofing Vulnerability | 2.5% | — |
| CVE-2022-41042 | HIGH 7.4 | microsoft visual_studio_code Visual Studio Code Information Disclosure Vulnerability | 2.5% | — |
| CVE-2021-40465 | HIGH 7.8 | microsoft windows_10 Windows Text Shaping Remote Code Execution Vulnerability | 2.5% | — |
| CVE-2022-30161 | HIGH 8.8 | microsoft windows_10 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability | 2.5% | — |
| CVE-2022-30153 | HIGH 8.8 | microsoft windows_10 Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability | 2.5% | — |
| CVE-2023-38157 | MED 6.5 | microsoft edge_chromium Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability | 2.5% | — |
| CVE-2020-1173 | MED 6.8 | microsoft power_bi_report_server A spoofing vulnerability exists in Microsoft Power BI Report Server in the way it validates the content-type of uploaded attachments. An authenticated attacker could exploit the vulnerability by uploading a specially crafted payload and sending it to the user. | 2.5% | — |
| CVE-2019-0950 | MED 5.7 | microsoft sharepoint_foundation A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0949, CVE-2019- | 2.5% | — |
| CVE-2019-0949 | MED 5.7 | microsoft sharepoint_foundation A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2019-0950, CVE-2019- | 2.5% | — |
| CVE-1999-0585 | LOW 2.1 | microsoft windows_2000 A Windows NT administrator account has the default name of Administrator. | 2.5% | — |
| CVE-1999-0595 | LOW 2.1 | microsoft windows_2000 A Windows NT system does not clear the system page file during shutdown, which might allow sensitive information to be recorded. | 2.5% | — |
| CVE-2019-0670 | MED 6.1 | microsoft sharepoint_enterprise_server A spoofing vulnerability exists in Microsoft SharePoint when the application does not properly parse HTTP content, aka 'Microsoft SharePoint Spoofing Vulnerability'. | 2.5% | — |
| CVE-2023-36395 | HIGH 7.5 | microsoft windows_server_2008 Windows Deployment Services Denial of Service Vulnerability | 2.5% | — |
| CVE-2023-36392 | HIGH 7.5 | microsoft windows_server_2012 DHCP Server Service Denial of Service Vulnerability | 2.5% | — |
| CVE-2023-36786 | HIGH 7.2 | microsoft skype_for_business_server Skype for Business Remote Code Execution Vulnerability | 2.5% | — |
| CVE-2024-38146 | HIGH 7.5 | microsoft windows_10_1507 Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability | 2.5% | — |
| CVE-2024-38145 | HIGH 7.5 | microsoft windows_10_1507 Windows Layer-2 Bridge Network Driver Denial of Service Vulnerability | 2.5% | — |
| CVE-2022-26913 | HIGH 7.4 | microsoft windows_10 Windows Authentication Information Disclosure Vulnerability | 2.5% | — |
| CVE-2025-24052 | HIGH 7.8 | microsoft windows_10_1507 Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcement of the upcoming removal of ltmdm64.sys driver. The driver has been removed in the October cumula | 2.5% | — |