59.223 CVE tracked
803 Exploited now
188 Used by ransomware
Last sync
Microsoft vulnerabilities
16.977 CVE
| Identifier | Severity, sort descending | Product and flaw | EPSS, sort descending | In KEV since, sort descending |
|---|---|---|---|---|
| CVE-2018-0964 | MED 6.1 | microsoft windows_10 An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system, aka "Hyper-V Information Disclosure Vulnerability." This affects Windows 10, | 1.6% | — |
| CVE-2018-0957 | MED 5.3 | microsoft windows_10 An information disclosure vulnerability exists when Windows Hyper-V on a host operating system fails to properly validate input from an authenticated user on a guest operating system, aka "Hyper-V Information Disclosure Vulnerability." This affects Windows Ser | 1.6% | — |
| CVE-2018-8650 | MED 5.4 | microsoft sharepoint_enterprise_server A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka "Microsoft Office SharePoint XSS Vulnerability." This affects Microsoft SharePoi | 1.6% | — |
| CVE-2007-0210 | HIGH 7.2 | microsoft windows_xp The Window Image Acquisition (WIA) Service in Microsoft Windows XP SP2 allows local users to gain privileges via unspecified vectors involving an "unchecked buffer," probably a buffer overflow. | 1.6% | — |
| CVE-2020-17063 | MED 6.8 | microsoft 365_apps Microsoft Office Online Spoofing Vulnerability | 1.6% | — |
| CVE-2020-1340 | MED 5.4 | microsoft nugetgallery A spoofing vulnerability exists when the NuGetGallery does not properly sanitize input on package metadata values, aka 'NuGetGallery Spoofing Vulnerability'. | 1.6% | — |
| CVE-2016-0135 | HIGH 8.4 | microsoft windows_10 The Secondary Logon Service in Microsoft Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Secondary Logon Elevation of Privilege Vulnerability." | 1.6% | — |
| CVE-2012-1864 | HIGH 7.2 | microsoft windows_2003_server win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle user-mode input passed to kernel mode for driver | 1.6% | — |
| CVE-2022-23258 | MED 4.3 | microsoft edge Microsoft Edge for Android Spoofing Vulnerability | 1.6% | — |
| CVE-2025-24056 | HIGH 8.8 | microsoft windows_10_1507 Heap-based buffer overflow in Windows Telephony Server allows an unauthorized attacker to execute code over a network. | 1.6% | — |
| CVE-2024-21353 | HIGH 8.8 | microsoft windows_server_2022_23h2 Microsoft WDAC ODBC Driver Remote Code Execution Vulnerability | 1.6% | — |
| CVE-2025-27477 | HIGH 8.8 | microsoft windows_10_1507 Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network. | 1.6% | — |
| CVE-2022-23261 | MED 5.3 | microsoft edge_chromium Microsoft Edge (Chromium-based) Tampering Vulnerability | 1.6% | — |
| CVE-2020-0663 | MED 4.2 | microsoft edge An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, which could allow an attacker to access information from one domain and inject it into another domain.In a web-based attack scenario, an attacke | 1.6% | — |
| CVE-2011-0043 | HIGH 7.2 | microsoft windows_2003_server Kerberos in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 supports weak hashing algorithms, which allows local users to gain privileges by operating a service that sends crafted service tickets, as demonstrated by the CRC32 algorithm, aka "Kerberos Unke | 1.6% | — |
| CVE-2024-21302 | MED 6.7 | microsoft windows_10_1507 Summary: As of July 8, 2025 Microsoft has completed mitigations to address this vulnerability. See KB5042562: Guidance for blocking rollback of virtualization-based security related updates and the Recommended Actions section of this CVE for guidance on how to | 1.6% | — |
| CVE-2023-35384 | MED 5.4 | microsoft windows_10_1507 Windows HTML Platforms Security Feature Bypass Vulnerability | 1.6% | — |
| CVE-2022-26929 | HIGH 7.8 | microsoft .net_framework .NET Framework Remote Code Execution Vulnerability | 1.6% | — |
| CVE-2019-1134 | MED 5.4 | microsoft sharepoint_enterprise_server A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. | 1.6% | — |
| CVE-2019-0831 | MED 5.4 | microsoft sharepoint_enterprise_server A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE- | 1.6% | — |
| CVE-2019-0830 | MED 5.4 | microsoft sharepoint_enterprise_server A cross-site-scripting (XSS) vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server, aka 'Microsoft Office SharePoint XSS Vulnerability'. This CVE ID is unique from CVE- | 1.6% | — |
| CVE-2019-0996 | MED 6.5 | microsoft azure_devops_server A spoofing vulnerability exists in Azure DevOps Server when it improperly handles requests to authorize applications, resulting in a cross-site request forgery. An attacker who successfully exploited this vulnerability could bypass OAuth protections and regist | 1.6% | — |
| CVE-2024-38214 | MED 6.5 | microsoft windows_server_2008 Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability | 1.6% | — |
| CVE-2021-28478 | HIGH 7.6 | microsoft sharepoint_foundation Microsoft SharePoint Server Spoofing Vulnerability | 1.6% | — |
| CVE-2023-23388 | HIGH 8.8 | microsoft windows_10_1507 Windows Bluetooth Driver Elevation of Privilege Vulnerability | 1.6% | — |