59.223 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
16.977 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2024-21391 | HIGH 8.8 | microsoft windows_10_1507 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability | 1.6% | — |
| CVE-2024-21352 | HIGH 8.8 | microsoft windows_10_1507 Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability | 1.6% | — |
| CVE-2020-1227 | MED 5.4 | microsoft sharepoint_enterprise_server <p>A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially | 1.6% | — |
| CVE-2019-1076 | MED 5.4 | microsoft azure_devops_server A Cross-site Scripting (XSS) vulnerability exists when Team Foundation Server does not properly sanitize user provided input, aka 'Team Foundation Server Cross-site Scripting Vulnerability'. | 1.6% | — |
| CVE-2020-0977 | MED 5.4 | microsoft sharepoint_enterprise_server A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2020-0972, CVE-2020- | 1.6% | — |
| CVE-2020-0975 | MED 5.4 | microsoft sharepoint_enterprise_server A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2020-0972, CVE-2020- | 1.6% | — |
| CVE-2020-0972 | MED 5.4 | microsoft sharepoint_enterprise_server A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft SharePoint Spoofing Vulnerability'. This CVE ID is unique from CVE-2020-0975, CVE-2020- | 1.6% | — |
| CVE-2024-38092 | HIGH 8.8 | microsoft azure_cyclecloud Azure CycleCloud Elevation of Privilege Vulnerability | 1.6% | — |
| CVE-2026-21536 | CRIT 9.8 | microsoft devices_pricing_program Microsoft Devices Pricing Program Remote Code Execution Vulnerability | 1.6% | — |
| CVE-2015-0098 | HIGH 7.2 | microsoft windows_7 Task Scheduler in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows local users to gain privileges by triggering application execution by an invalid task, aka "Task Scheduler Elevation of Privilege Vulnerability." | 1.6% | — |
| CVE-2024-38260 | HIGH 8.8 | microsoft windows_server_2008 Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability | 1.6% | — |
| CVE-2024-37340 | HIGH 8.8 | microsoft sql_2016_azure_connect_feature_pack Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability | 1.6% | — |
| CVE-2024-37339 | HIGH 8.8 | microsoft sql_2016_azure_connect_feature_pack Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability | 1.6% | — |
| CVE-2024-37338 | HIGH 8.8 | microsoft sql_2016_azure_connect_feature_pack Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability | 1.6% | — |
| CVE-2024-37335 | HIGH 8.8 | microsoft sql_2016_azure_connect_feature_pack Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability | 1.6% | — |
| CVE-2024-26191 | HIGH 8.8 | microsoft sql_2016_azure_connect_feature_pack Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability | 1.6% | — |
| CVE-2024-26186 | HIGH 8.8 | microsoft sql_2016_azure_connect_feature_pack Microsoft SQL Server Native Scoring Remote Code Execution Vulnerability | 1.6% | — |
| CVE-2015-1644 | HIGH 7.2 | microsoft windows_7 Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly constrain impersonation levels, which allows local use | 1.6% | — |
| CVE-2002-2283 | LOW 1.9 | microsoft windows_xp Microsoft Windows XP with Fast User Switching (FUS) enabled does not remove the "show processes from all users" privilege when the user is removed from the administrator group, which allows that user to view processes of other users. | 1.6% | — |
| CVE-2025-21223 | HIGH 8.8 | microsoft windows_10_1507 Windows Telephony Service Remote Code Execution Vulnerability | 1.6% | — |
| CVE-2019-1074 | MED 5.5 | microsoft windows_10 An elevation of privilege vulnerability exists in Microsoft Windows where certain folders, with local service privilege, are vulnerable to symbolic link attack. An attacker who successfully exploited this vulnerability could potentially access unauthorized inf | 1.6% | — |
| CVE-2025-21279 | MED 6.5 | microsoft edge_chromium Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | 1.6% | — |
| CVE-2021-38650 | HIGH 7.6 | microsoft 365_apps Microsoft Office Spoofing Vulnerability | 1.6% | — |
| CVE-2018-8572 | MED 5.4 | microsoft sharepoint_enterprise_server An elevation of privilege vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft SharePoint Elevation of Privilege Vulnerability." This affects Microsoft | 1.6% | — |
| CVE-2018-8547 | MED 5.4 | microsoft windows_10 A cross-site-scripting (XSS) vulnerability exists when an open source customization for Microsoft Active Directory Federation Services (AD FS) does not properly sanitize a specially crafted web request to an affected AD FS server, aka "Active Directory Federat | 1.6% | — |