59.223 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
16.977 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2011-2010 | HIGH 7.2 | microsoft pinyin_ime The Microsoft Office Input Method Editor (IME) for Simplified Chinese in Microsoft Pinyin IME 2010, Office Pinyin SimpleFast Style 2010, and Office Pinyin New Experience Style 2010 does not properly restrict access to configuration options, which allows local | 1.7% | — |
| CVE-2010-0719 | MED 4.7 | microsoft windows_2000 An unspecified API in Microsoft Windows 2000, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, and Windows 7 does not validate arguments, which allows local users to cause a denial of service (system crash) via a crafted application. | 1.7% | — |
| CVE-2005-1982 | LOW 3.6 | microsoft windows_2000 Unknown vulnerability in the PKINIT Protocol for Microsoft Windows 2000, Windows XP, and Windows Server 2003 could allow a local user to obtain information and spoof a server via a man-in-the-middle (MITM) attack between a client and a domain controller when P | 1.7% | — |
| CVE-2001-0547 | LOW 2.1 | microsoft isa_server Memory leak in the proxy service in Microsoft Internet Security and Acceleration (ISA) Server 2000 allows local attackers to cause a denial of service (resource exhaustion). | 1.7% | — |
| CVE-2024-49091 | HIGH 7.2 | microsoft windows_server_2012 Windows Domain Name Service Remote Code Execution Vulnerability | 1.7% | — |
| CVE-2022-24485 | HIGH 7.5 | microsoft windows_10 Win32 File Enumeration Remote Code Execution Vulnerability | 1.7% | — |
| CVE-2023-36021 | HIGH 8.0 | microsoft on-prem_data_gateway Microsoft On-Prem Data Gateway Security Feature Bypass Vulnerability | 1.7% | — |
| CVE-2019-1251 | MED 5.5 | microsoft windows_10 An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory, aka 'DirectWrite Information Disclosure Vulnerability'. This CVE ID is unique from CVE-2019-1244, CVE-2019-1245. | 1.7% | — |
| CVE-2019-1219 | MED 5.5 | microsoft windows_10 An information disclosure vulnerability exists when the Windows Transaction Manager improperly handles objects in memory, aka 'Windows Transaction Manager Information Disclosure Vulnerability'. | 1.7% | — |
| CVE-2019-1216 | MED 5.5 | microsoft windows_10 An information disclosure vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Information Disclosure Vulnerability'. | 1.7% | — |
| CVE-2025-21171 | HIGH 7.5 | microsoft .net .NET Remote Code Execution Vulnerability | 1.7% | — |
| CVE-2025-47171 | MED 6.7 | microsoft 365_apps Improper input validation in Microsoft Office Outlook allows an authorized attacker to execute code locally. | 1.7% | — |
| CVE-2019-0979 | MED 5.4 | microsoft azure_devops_server A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique f | 1.7% | — |
| CVE-2019-0872 | MED 5.4 | microsoft azure_devops_server A Cross-site Scripting (XSS) vulnerability exists when Azure DevOps Server and Team Foundation Server do not properly sanitize user provided input, aka 'Azure DevOps Server and Team Foundation Server Cross-site Scripting Vulnerability'. This CVE ID is unique f | 1.7% | — |
| CVE-2019-0777 | MED 5.4 | microsoft team_foundation_server A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'. | 1.7% | — |
| CVE-2002-0643 | MED 4.6 | microsoft data_engine The installation of Microsoft Data Engine 1.0 (MSDE 1.0), and Microsoft SQL Server 2000 creates setup.iss files with insecure permissions and does not delete them after installation, which allows local users to obtain sensitive data, including weakly encrypted | 1.7% | — |
| CVE-2021-26443 | CRIT 9.0 | microsoft windows_10 Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability | 1.7% | — |
| CVE-2022-35759 | MED 6.5 | microsoft windows_10_1507 Windows Local Security Authority (LSA) Denial of Service Vulnerability | 1.7% | — |
| CVE-2026-77484 | HIGH 8.8 | microsoft sql_server_2019 Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network. | 1.7% | — |
| CVE-2026-65772 | HIGH 8.8 | microsoft dynamics_365 Deserialization of untrusted data in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network. | 1.7% | — |
| CVE-2026-70321 | HIGH 8.8 | microsoft sharepoint_server Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 1.7% | — |
| CVE-2026-65815 | HIGH 8.8 | microsoft dynamics_365 Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network. | 1.7% | — |
| CVE-2026-65665 | HIGH 8.8 | microsoft sharepoint_server Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | 1.7% | — |
| CVE-2026-50515 | CRIT 9.9 | microsoft azure_service_bus Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network. | 1.7% | — |
| CVE-2026-50517 | CRIT 9.9 | microsoft 365_copilot Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network. | 1.7% | — |